A recent penetration test discovered that several employees were enticed to assist attackers by visiting specific websites and running downloaded files when prompted by phone calls. Which of the following would best address this issue?
Answer(s): A
Option A is correct because user-awareness training directly reduces social engineering susceptibility, addressing the root cause of phishing and BEC-like scenarios highlighted by the test.A) Correct — reinforces security culture and teaches recognizing adversarial prompts, reducing click-through and follow-on compromise.B) Incorrect — cannot guarantee all malicious sites are blocked; attackers may use compromised sites or legitimate domains, and user training remains essential.C) Incorrect — blocking all scripts is impractical and may break legitimate web functionality; not all script-based threats are encountered or user-driven.D) Incorrect — maritime control over run permissions is extreme and disrupts productivity; user education remains the preferred control for social engineering.
A security analyst at a company is reviewing an alert from the file integrity monitoring indicating a mismatch in the login. html file hash. After comparing the code with the previous version of the page source code, the analyst found the following code snippet added:Which of the following best describes the activity the analyst has observed?
Answer(s): C
Option C is correct because a mismatch in the file integrity monitor from login.html, coupled with a newly added code snippet, indicates an unauthorized modification to a system or web page source, i.e., an unauthorized change to content or configuration.A) Obfuscated links are about hidden or obfuscated URLs, not necessarily file integrity changes.B) Exfiltration involves data leaving the organization, not simply a code addition.D) Beaconing describes periodic communications to a remote host, not a local code change detected by FIM.Note: If the snippet’s behavior matched beaconing or exfiltration, additional indicators would be present; based on the given data, unauthorized changes best fits.
A security administrator has been notified by the IT operations department that some vulnerability reports contain an incomplete list of findings. Which of the following methods should be used to resolve this issue?
Option A is correct because a credentialed scan (credentialed scan) uses authenticated access to discover more details, often yielding a complete and accurate set of findings. Without credentials, scans may miss findings or produce partial results, leading to incomplete reports. Incorrect — B: External scan typically has limited visibility internal to the network and may miss internal findings. Incorrect — C: Differential scan is not a standard term in vulnerability management; it implies change analysis rather than improving completeness of findings. Incorrect — D: Network scan alone focuses on host discovery and open ports, not on validating full vulnerability findings or report completeness.
https://www.splunk.com/en_us/blog/learn/vulnerability-scanning.html
An organization enabled a SIEM rule to send an alert to a security analyst distribution list when ten failed logins occur within one minute. However, the control was unable to detect an attack with nine failed logins. Which of the following best represents what occurred?
Option C is correct because a false negative occurs when an attack is not detected by the security system; in this case, an attack with nine failed logins within one minute was not alerted. A) False positive would mean an alert fired for benign activity. B) True negative would mean no alert for benign activity. D) True positive would mean an alert correctly fired for a real attack. The nine-failure attempt was not flagged, indicating a detection gap rather than an erroneous alert.
A cybersecurity analyst is tasked with scanning a web application to understand where the scan will go and whether there are URIs that should be denied access prior to more in-depth scanning. Which of following best fits the type of scanning activity requested?
Answer(s): B
Option B is correct because a discovery scan maps a target’s surface—identifying URIs, endpoints, and accessible resources—without validating vulnerabilities or requiring credentials, aligning with pre-scan reconnaissance.A) Incorrect — Uncredentialed scan focuses on discovering vulnerabilities without credentials, not map/identify accessible URIs.C) Incorrect — Vulnerability scan checks for weaknesses, not primarily for listing resources or denied-access paths.D) Incorrect — Credentialed scan uses authenticated access to assess deeper vulnerabilities, not initial discovery of reachable URIs.
https://qualysguard.qg2.apps.qualys.com/portal-help/en/was/scans/ scanning_basics.htm
Which of the following best describes the process of requiring remediation of a known threat within a given time frame?
Option A is correct because SLA (Service Level Agreement) defines the expected service performance and time frames for remediation and incident response, including deadlines for addressing known threats. Incorrect — B) MOU (Memorandum of Understanding) outlines high-level intentions between parties, not remediation timelines. Incorrect — C) Best-effort patching describes informal, non-binding attempts without guaranteed timeframes. Incorrect — D) Organizational governance covers oversight and policies, not the specific remediation time targets for known threats.
Which of the following risk management principles is accomplished by purchasing cyber insurance?
Answer(s): D
Option D is correct because transferring risk via cyber insurance shifts financial consequences of a cyber event from the organization to an insurer, a classic risk transfer strategy in risk management. Incorrect — A (Accept): accepting risk means not taking any additional controls or financial policies; insurance is not merely acceptance. Incorrect — B (Avoid): avoidance would mean eliminating activities or systems that introduce risk, not transferring it. Incorrect — C (Mitigate): mitigation reduces impact or likelihood through controls, whereas insurance does not reduce probability or impact directly; it provides financial recovery rather than control effectiveness.
A recent audit of the vulnerability management program outlined the finding for increased awareness of securecoding practices. Which of the following would be best to address the finding?
Option A is correct because ongoing SDLC/training focused on top vulnerabilities improves secure coding awareness, reducing developer error and aligning with remediation of secure coding practices in the software development lifecycle.A) Correct — quarterly SDLC training targets developers directly, strengthening secure coding practices identified by the audit.B) Incorrect — yearly code repository inspections may miss rapid changes and do not emphasize secure coding education for developers.C) Incorrect — external penetration testing assesses external risk, not internal secure coding practices or developer awareness.D) Incorrect — more scanners increase discovery but do not address secure coding awareness or education.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.