A penetration tester is conducting a test on an organization's software development website. The penetration tester sends the following request to the web interface:Which of the following exploits is most likely being attempted?
Answer(s): A
Option A is correct because SQL injection targets the database by inserting or altering queries via the web interface, which aligns with a test against a software development website that processes user inputs into SQL statements. Incorrect — B (Local file inclusion) would attempt to read server files by including local paths; not typically via generic input that resembles a query. Incorrect — C (Cross-site scripting) injects scripts to run in a browser context, not to manipulate SQL results. Incorrect — D (Directory traversal) tries to access restricted files by path manipulation, not directly involving SQL execution.
Two employees in the finance department installed a freeware application that contained embedded malware. The network is robustly segmented based on areas of responsibility. These computers had critical sensitive information stored locally that needs to be recovered. The department manager advised all department employees to turn off their computers until the security team could be contacted about the issue. Which of the following is the first step the incident response staff members should take when they arrive?
Answer(s): E
Option E is correct because the first step is to preserve evidence and prevent further spread by isolating affected assets from the network (offline review and containment).A) Incorrect — turning systems on and backing up without containment risks spreading malware and corrupts evidence.B) Incorrect — removing software without containment may allow persistence or propagation and overlook evidence collection.C) Incorrect — reimaging without proper containment and evidence handling can compromise forensic integrity.D) Incorrect — logging in with admin credentials before containment risks contaminating the incident data and may violate chain-of-custody.
A manufacturer has hired a third-party consultant to assess the security of an OT network that includes both fragile and legacy equipment. Which of the following must be considered to ensure the consultant does no harm to operations?
Answer(s): C
Option C is correct because passive vulnerability scanning minimizes impact on OT operations by observing traffic and configurations without actively probing devices, reducing risk to fragile/legacy equipment. A) Incorrect — Nmap Scripting Engine scanning is active scanning and can induce load or trigger protective responses on OT devices, increasing risk to operations. B) Incorrect — Preserving ladder logic state is important for recovery, but not a direct method to prevent harm during scanning activities. D) Incorrect — Running scans during off-peak hours reduces impact but does not guarantee safety for fragile OT networks; passive methods are preferred for harm avoidance.
A team of analysts is developing a new internal system that correlates information from a variety of sources, analyzes that information, and then triggers notifications according to company policy. Which of the following technologies was deployed?
Option A is correct because a SIEM (Security Information and Event Management) system collects, correlates, analyzes data from multiple sources, and triggers alerts per policy. It fits the described workflow of data aggregation, correlation, and notification.B) Incorrect — SOAR (Security Orchestration, Automation, and Response) focuses on playbooks and automated incident response, not primarily on initial data correlation and policy-driven notifications from diverse sources as described.C) Incorrect — IPS (Intrusion Prevention System) is network-based and blocks or alerts on threats at the network layer, not a broad correlating analytics and notification platform.D) Incorrect — CERT (Computer Emergency Response Team) is an incident response organization, not a technology deployed for correlation and notification in a system.
Which of following would best mitigate the effects of a new ransomware attack that was not properly stopped by the company antivirus?
Option C is correct because deploying sandboxing isolates unknown or suspicious executables in a controlled environment, preventing ransomware from executing on the host and allowing analysis before it can affect production systems. This containment complements antivirus by stopping zero-day or signature-less malware during runtime.A) Incorrect — Installing a firewall defends network perimeters and controls traffic flows but does not directly stop or contain ransomware that has already bypassed endpoint defenses or is propagating inside the network. B) Incorrect — Vulnerability management reduces exposure by patching weaknesses, yet it does not mitigate active ransomware execution or rapid lateral movement once malware is running. D) Incorrect — Updating the application blocklist helps with known malicious binaries, but ransomware often evolves or uses living-off-the-land techniques that evade static blocklists; sandboxing provides runtime containment.
A Chief Information Security Officer wants to implement security by design, starting with the implementation of a security scanning method to identify vulnerabilities, including SQL injection, RFI, XSS, etc. Which of the following would most likely meet the requirement?
Option C is correct because Dynamic Application Security Testing (DAST) assesses running applications, identifying runtime vulnerabilities such as SQL injection, RFI, and XSS without source code access. It aligns with security by design by scanning in a live environment and detecting exploitable flaws.A) Reverse engineering: Incorrect — focuses on understanding compiled binaries or protocols, not actively testing for web app vulnerabilities in production-like contexts.B) Known environment testing: Incorrect — vague; does not specify dynamic analysis of a live application to identify common web app flaws.D) Code debugging: Incorrect — targets source code defects, not runtime vulnerabilities exposed by web interfaces.
A security analyst scans a host and generates the following output:Which of the following best describes the output?
Answer(s): D
Option D is correct because the output indicates a vulnerability alert related to web-based exploits, typically from a web server scan or vulnerability scanner identifying exploitable web app weaknesses. Incorrect —A) The host being unresponsive to ICMP would be shown as no-reply or timeout, not a web-exploit vulnerability. B) A vulnerable mail server would appear as mail service weaknesses, not web-exploit indicators. C) Unsecured FTP suggests file transfer protocol issues, not web application vulnerabilities. D) While web-based exploits are indicated, the exact output line is necessary to confirm the specific vulnerability; without it, other services cannot be ruled out with certainty. INSUFFICIENT_KNOWLEDGE
The security team at a company, which was a recent target of ransomware, compiled a list of hosts that were identified as impacted and in scope for this incident. Based on the following host list:Which of the following systems was most pivotal to the threat actor in its distribution of the encryption binary via Group Policy?
Option D is correct because DCEast01 (the domain controller or central AD/Group Policy server) is typically pivotal for enforcing or distributing Group Policy objects, including ransomware payloads, to multiple endpoints. Compromise of a central GPO server enables widespread deployment of the encryption binary. Incorrect — A) SQL01 is a database server unlikely to centrally distribute GPOs. Incorrect — B) WK10-Sales07 is a user/workstation and not responsible for policy distribution. Incorrect — C) WK7-Plant01 is a workstation in a plant subnet, not a control point for GPO dissemination. Incorrect — E) HQAdmin9 is an admin host but not necessarily the GPO distribution point.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.