A cybersecurity team has witnessed numerous vulnerability events recently that have affected operating systems. The team decides to implement host-based IPS, firewalls and two-factor authentication. Which of the following does this most likely describe?
Answer(s): A
Option A is correct because implementing host-based IPS, firewalls, and two-factor authentication aligns with system hardening—reducing attack surface and strengthening defenses on hosts. Incorrect — B: Hybrid network architecture describes a mix of on-premises and cloud networking, not specific host defenses. Incorrect — C: Continuous authorization is about ongoing access control and policy enforcement, not primarily about implementing host controls during vulnerability events. Incorrect — D: Secure access service edge refers to a security model consolidating access control at the network edge, not necessarily host-based protections.
A security analyst needs to secure digital evidence related to an incident. The security analyst must ensure thatthe accuracy of the data cannot be repudiated. Which of the following should be implemented?
Answer(s): C
Option C is correct because integrity validation (e.g., cryptographic hashing, checksums) ensures data accuracy and non-repudiation of digital evidence, which is essential in incident response and for legal admissibility. A) Offline storage preserves data availability but does not inherently guarantee non-repudiation or integrity verification. B) Evidence collection describes gathering data but not mechanisms to prove data integrity or prevent repudiation. D) Legal hold prevents alteration during litigation but does not by itself provide non-repudiation or integrity guarantees for the collected evidence.
An analyst investigated a website and produced the following:Which of the following syntaxes did the analyst use to discover the application versions on this vulnerable website?
Option C is correct because -sV enables version detection in Nmap, allowing identification of application versions on the target. A, B, and D do not explicitly request version information in the same manner: -sS performs a TCP SYN scan (not versioning), -C runs default scripts (not specifically version detection), and -A enables aggressive scanning including OS detection, version detection, script scanning, and traceroute but is broader than just version discovery. Therefore, only -sV directly targets discovering application versions.
A cybersecurity analyst is doing triage in a SIEM and notices that the time stamps between the firewall and the host under investigation are off by 43 minutes. Which of the following is the most likely scenario occurring with the time stamps?
A) Correct — NTP (Network Time Protocol) not configured on the host would cause time drift between systems, leading to a mismatch of about 43 minutes and complicating correlation in the SIEM. B) Incorrect — Assuming the analyst is viewing wrong information isn’t implied by a consistent time skew; the issue is time synchronization, not data selection. C) Incorrect — Firewall using UTC would not inherently cause a mismatch with a host unless the host is unsynchronized; this option presumes a fixed standard without timing misalignment. D) Incorrect — If the host were offline, logs wouldn’t be generated or accessible; time skew is unrelated to offline status.
A payroll department employee was the target of a phishing attack in which an attacker impersonated a department director and requested that direct deposit information be updated to a new account. Afterward, a deposit was made into the unauthorized account. Which of the following is one of the first actions the incident response team should take when they receive notification of the attack?
Answer(s): B
Option B is correct because reviewing the actions taken by the employee and the related email is an immediate containment and evidence-gathering step to understand scope, determine if credentials or directives were followed, and preserve logging for forensics. This aligns with incident response activities to validate the phishing chain of events before taking broader actions.A) Incorrect — Scanning the employee’s computer may be part of containment but is not the first action; it risks alerting attackers and may not address the phishing chain or credential theft evidence yet.C) Incorrect — Terminating the employee is punitive and not a first IR action; it can undermine investigation and HR processes.D) Incorrect — Security awareness training is preventive and post-event; it should follow analysis, not precede incident containment.
A security analyst has found the following suspicious DNS traffic while analyzing a packet capture:DNS traffic while a tunneling session is active.The mean time between queries is less than one second.The average query length exceeds 100 characters.Which of the following attacks most likely occurred?
Option A is correct because high-frequency DNS queries with long, data-carrying payloads are indicative of DNS exfiltration, where data is tunneled out through DNS queries. Incorrect — B (DNS spoofing) involves falsified responses to redirect or deceive, not sustained tunneling traffic. Incorrect — C (DNS zone transfer) is a legitimate or misconfigured replication of zone data between servers, not typically a rapid, data-rich exfiltration pattern. Incorrect — D (DNS poisoning) corrupts cache with forged records to misdirect resolution; it does not describe continuous high-volume query tunneling.
A small company does not have enough staff to effectively segregate duties to prevent error and fraud in payroll management. The Chief Information Security Officer (CISO) decides to maintain and review logs and audit trails to mitigate risk. Which of the following did the CISO implement?
Option B is correct because compensating controls are alternative measures implemented when primary controls (like separating duties) are not feasible, such as maintaining and reviewing logs and audit trails to mitigate risk in payroll management. A) Incorrect — Corrective controls restore systems after a breach, not primarily to mitigate fraud when duties can’t be separated. C) Incorrect — Operational controls are day-to-day procedures, but the scenario focuses on compensating risk due to lack of separation, not routine operations. D) Incorrect — Administrative controls are policy and procedure-based; while relevant, the specific mitigation via logging/auditing aligns with compensating controls.
During the log analysis phase, the following suspicious command is detected:<?php preg_replace(` /.*/e', `system("ping -c 4 10.0.0.1");', `'; ?>Which of the following is being attempted?
Option B is correct because the code executes a system command from PHP, enabling remote code execution (RCE) via preg_replace with the /e modifier, which evaluates the replacement string as PHP code. Incorrect — A) Buffer overflow is a memory corruption vulnerability, not an immediate PHP code execution technique. Incorrect — C) ICMP tunneling uses ICMP to transfer data, not executing system commands. Incorrect — D) Smurf attack is a flood of ICMP echo replies, unrelated to code execution.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.