To minimize the impact of a security incident, a cybersecurity analyst has configured audit settings in the organization's cloud services. Which of the following security controls has the analyst configured?
Answer(s): D
Option D is correct because detective controls monitor events and detect security incidents, aligning with audit settings that identify and alert on incidents. A) Preventive controls aim to stop incidents before they occur, not just audit actions. B) Corrective controls focus on restoring systems after an incident, not on ongoing monitoring. C) Directive controls mandate security practices, not measurement or detection. Therefore, audit configurations in cloud services function as detective controls by revealing and logging anomalous or unauthorized activity.
A web developer reports the following error that appeared on a development server when testing a new application:Which of the following tools can be used to identify the application's point of failure?
Answer(s): C
Option C is correct because Immunity Debugger is a dynamic analysis tool used to identify the exact point of failure in an application by instrumenting and stepping through code during execution, which is essential for debugging in development. A) OpenVAS is a vulnerability scanner, not a debugger, so it won’t pinpoint an application failure point. B) Angry IP Scanner is a network host scanner, not applicable to code-level failure analysis. D) Burp Suite is a web application security testing suite for intercepting and manipulating traffic, not for identifying internal failure points in code.
Which of the following describes a contract that is used to define the various levels of maintenance to be provided by an external business vendor in a secure environment?
Option D is correct because a Service Level Agreement (SLA) defines performance, maintenance, and support levels expected from an external vendor in a secure environment, including response times, uptime, and responsibilities.A) Incorrect — MOU (Memorandum of Understanding) outlines general intent and collaboration, not specific maintenance levels or security obligations.B) Incorrect — NDA (Non-Disclosure Agreement) protects confidential information, not maintenance scope or service levels.C) Incorrect — BIA (Business Impact Analysis) assesses criticality and recovery priorities, not contractual maintenance terms.D) Correct — SLA specifies maintenance levels, security controls, and service expectations with an external vendor.
A security team is concerned about recent Layer 4 DDoS attacks against the company website. Which of the following controls would best mitigate the attacks?
Option C is correct because a Content Delivery Network (CDN) distributes traffic across multiple edge locations, absorbs large volumes of traffic, and provides caching and rate-limiting that mitigate Layer 4 DDoS floods targeting a single origin server. Incorrect — A: Blocking with firewall rules is often insufficient against high-volume Layer 4 floods and can degrade legitimate traffic; attackers can spoof or overwhelm beyond simple ACLs. Incorrect — B: An IPS detects and blocks malicious traffic but may not scale to massive DDoS volumes at the edge and can be bypassed by volumetric floods. Incorrect — D: A load balancer distributes traffic but doesn’t inherently absorb large attacks; it’s not a primary DDoS mitigation at scale.
An analyst is reviewing system logs while threat hunting:Which of the following hosts should be investigated first?
Option C is correct because PC3 is identified as the initial focal point in the scenario, guiding threat-hunting priorities to the host with suspicious or anomalous log indicators. Correct — PC3 likely exhibits the strongest signals warranting immediate investigation. A) Incorrect — PC1 is not the prioritized host based on provided cue; lacks the detected anomalous indicators. B) Incorrect — PC2 does not meet the priority signals as the first target in threat hunting. D) Incorrect — PC4 is not the initial host of interest according to the scenario. E) Incorrect — PC5 is not the first host to investigate given the threat indicators.
An organization needs to bring in data collection and aggregation from various endpoints. Which of the following is the best tool to deploy to help analysts gather this data?
Option C is correct because EDR (Endpoint Detection and Response) provides centralized data collection, telemetry, and threat detection from endpoints, enabling analysts to aggregate and correlate security events across the environment. A) DLP focuses on data loss prevention, not comprehensive endpoint telemetry. B) NAC deals with network access control, not data collection from endpoints. D) NIDS monitors network traffic for anomalies, not endpoint-centric data aggregation. EDR supplies the necessary visibility and analytics for cross-endpoint data collection and incident response. Correct — C
A regulated organization experienced a security breach that exposed a list of customer names with corresponding PII data. Which of the following is the best reason for developing the organization's communication plans?
Answer(s): B
Option B is correct because regulatory requirements typically mandate timely notification to the appropriate authorities after a breach involving PII, ensuring compliance with incident reporting laws and regulations.A) Incorrect — Public relations is important but not the primary reason for a regulatory-compliant communication plan; the plan’s objective is statutory reporting to authorities, not PR timing.C) Incorrect — Automated customer notification may be part of incident response, but regulatory reporting to authorities is the key driver for developing the communication plan.D) Incorrect — Executive approval is a governance step, but the essential purpose of the plan is meeting regulatory obligations for incident reporting, not just securing approvers.
Following an incident, a security analyst needs to create a script for downloading the configuration of all assets from the cloud tenancy. Which of the following authentication methods should the analyst use?
Option D is correct because a key pair enables programmatic, automated authentication for accessing cloud configurations without human interaction, supporting secure, non-interactive API calls suitable for asset inventory retrieval. A) Incorrect — MFA adds a second factor for interactive logins, not suited for automated scripts that must run unattended without prompting for second-factor input. B) Incorrect — User and password are password-based credentials often subject to credential theft and require interactive session management; not ideal for automation and non-repudiation. C) Incorrect — PAM is a local authentication framework, not a cloud API authentication method for retrieving tenancy configurations.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.