An organization has deployed a cloud-based storage system for shared data that is in phase two of the data life cycle. Which of the following controls should the security team ensure are addressed? (Choose two.)
Answer(s): D,F
Option D is correct because encryption protects data at rest and in transit in a cloud storage system, mitigating confidentiality risk during data life cycle phase two. Option F is correct because access controls ensure proper authorization and enforcement of least privilege for shared cloud data, reducing exposure.A) Incorrect — Data classification typically occurs earlier to determine handling requirements, not specific to phase two controls.B) Incorrect — Data destruction is a later lifecycle activity focused on decommissioning, not ongoing phase two safeguards.C) Incorrect — Data loss prevention is a policy/technique to prevent leakage but not a direct phase-two control like encryption and access control.E) Incorrect — Backups support availability and recovery, but encryption and access controls address confidentiality and access management in this phase.
An analyst is conducting routine vulnerability assessments on the company infrastructure. When performing these scans, a business-critical server crashes, and the cause is traced back to the vulnerability scanner.Which of the following is the cause of this issue?
Answer(s): B
Option B is correct because vulnerability scanners can cause instability on production servers when operating in active scanning mode, which aggressively probes services and may overwhelm resources, leading to a crash. A) Without an agent, the scanner still functions in host-based or network-based scans; the issue described is tied to active probing rather than agent presence. C) Improper segmentation would affect network segmentation goals, not directly cause a server crash from scanning. D) A scanning window limits scan duration but does not inherently cause crashes; the crash is due to active scanning activity, not windowing.
An organization's threat intelligence team notes a recent trend in adversary privilege escalation procedures. Multiple threat groups have been observed utilizing native Windows tools to bypass system controls and execute commands with privileged credentials. Which of the following controls would be most effective to reduce the rate of success of such attempts?
Answer(s): C
Option C is correct because disabling or removing unnecessary services reduces the attack surface and prevents adversaries from leveraging dormant or misconfigured services to escalate privileges with local system tools. Reducing exposed services limits where native Windows tools can be invoked through misconfigurations, lowering privilege escalation pathways.A) Incorrect — While restricting UAC helps, relying solely on the most restrictive level across all devices may degrade usability and may not fully block abuse of native tools for privilege escalation who can operate within allowed permissions.B) Incorrect — MFA protects initial access and remote authentication but does not mitigate post-exploitation use of native Windows tools for local privilege escalation when credentials or tokens are already present.D) Incorrect — Blocking untrusted applications mitigates some malware execution but many attackers leverage trusted, signed, and native Windows utilities, so this alone does not address escalation via legitimate tools.
A new zero-day vulnerability was released. A security analyst is prioritizing which systems should receive deployment of compensating controls deployment first. The systems have been grouped into the categories shown below:Which of the following groups should be prioritized for compensating controls?
Option C is correct because compensating controls should be prioritized for systems with the highest risk exposure, such as those with direct access to critical assets, sensitive data, or widespread impact if exploited, which aligns with Group C’s characteristics in this scenario. Incorrect — A) Group A: lower risk exposure or less critical impact reduces urgency for compensating controls. Incorrect — B) Group B: intermediate risk but not as critical as Group C. Incorrect — D) Group D: lowest risk or least critical exposure, making it least priority for compensating controls.
A Chief Information Security Officer wants to map all the attack vectors that the company faces each day. Which of the following recommendations should the company align their security controls around?
Answer(s): D
Option D is correct because MITRE ATT&CK provides a globally accessible framework of attacker TTPs (tactics, techniques, and procedures) to map and analyze daily attack vectors, enabling aligned security controls and threat modeling.A) Incorrect — OSSTMM focuses on statistical testing and measurement of security processes, not a comprehensive attack-vector framework for ongoing mapping.B) Incorrect — Diamond Model describes intrusion events through four core components (Adversary, Capabilities, Infrastructure, Victim) but is less prescriptive for daily control alignment compared to ATT&CK.C) Incorrect — OWASP concentrates on web application security vulnerabilities, not the full spectrum of enterprise attack vectors.
Which of the following actions would an analyst most likely perform after an incident has been investigated?
Option B is correct because after an incident has been investigated, the analyst performs root cause analysis to determine underlying causes and contributing factors, enabling remediation and prevention of recurrence.A) Risk assessment is typically performed prior to or during project planning to identify threats and vulnerabilities, not as a post-incident investigative step.C) Incident response plan is the predefined procedure for handling incidents, used during containment and eradication, not the analysis after investigation.D) Tabletop exercise is a training activity to test plans and response capabilities, not the actual post-incident investigative analysis.
https://www.ibm.com/topics/incident-response
After completing a review of network activity, the threat hunting team discovers a device on the network that sends an outbound email via a mail client to a non-company email address daily at 10:00 p.m. Which of the following is potentially occurring?
Option D is correct because a device sending outbound email to an external address on a fixed schedule indicates data exfiltration, where sensitive information is covertly transferred outside the organization. Regulated timing and use of a mail client suggest automatic data leakage rather than normal operations.A) Incorrect — Irregular peer-to-peer communication implies direct device-to-device exchanges, not scheduled external mail exfiltration.B) Incorrect — Rogue device denotes unauthorized hardware; here behavior points to a compromised device, not necessarily unknown hardware.C) Incorrect — Abnormal OS process behavior could be a symptom, but the specific outbound email to an external address most strongly indicates exfiltration activity.
A vulnerability scanner generates the following output:The company has an SLA for patching that requires time frames to be met for high-risk vulnerabilities. Which of the following should the analyst prioritize first for remediation?
Answer(s): A
Option A is correct because high-risk, externally exposed, or functionally critical components (such as Oracle JDK) typically pose the greatest risk if unpatched and are often prioritized to meet SLA-based remediation deadlines. Incorrect – B: Cisco Webex is usually a user-facing application with user-side patching; not typically the highest risk unless in a critical dependency chain. Incorrect – C: Redis Server can be high risk if exposed, but patching frequency and exposure are typically lower than a widely used JDK vulnerability. Incorrect – D: SSL self-signed certificates are important for trust, but patching is not a remediation for vulnerability risk in the same way as applying a patch to a vulnerable component.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.