An email hosting provider added a new data center with new public IP addresses. Which of the following most likely needs to be updated to ensure emails from the new data center do not get blocked by spam filters?
Answer(s): B
Option B is correct because SPF (Sender Policy Framework) specifies which hosts are authorized to send email for a domain. Updating SPF with the new public IP addresses ensures receiving mail servers accept messages from the new data center and reduces false positives as spam. A) DKIM: DKIM signs messages to verify integrity and origin but does not control which hosts can send for a domain. C) SMTP: SMTP is the protocol for sending mail, not a mechanism to authorize sending hosts. D) DMARC: DMARC relies on SPF and DKIM alignment; while important, SPF is the primary step to authorize the new IPs, DMARC policies will enforce results based on SPF/DKIM.
A laptop that is company owned and managed is suspected to have malware. The company implemented centralized security logging. Which of the following log sources will confirm the malware infection?
Answer(s): A
Option A is correct because XDR logs aggregate data across endpoints, network, and cloud to correlate indicators of compromise and detect malware infections. Incorrect — B: Firewall logs show network traffic but may not directly confirm malware on a host unless lateral movement or exfiltration is evident; not definitive malware infection alone. Incorrect — C: IDS logs detect network-based intrusions or suspicious traffic, but malware on a host may be hidden; not definitive without endpoint context. Incorrect — D: MFA logs pertain to authentication events and do not confirm malware presence on an endpoint.
Which of the following best describes the goal of a disaster recovery exercise as preparation for possible incidents?
Option A is correct because disaster recovery exercises focus on validating continuity controls and recovery metrics to ensure the organization can restore operations after a disruption. Incorrect — B: exercises may confirm roles but primary goal is readiness of continuity processes, not just role verification. Incorrect — C: DR exercises do not primarily provide vulnerability handling recommendations. Incorrect — D: while controls are exercised, the emphasis is on recovery objectives and metrics, not testing implemented security controls per se.
A security analyst has prepared a vulnerability scan that contains all of the company's functional subnets. During the initial scan users reported that network printers began to print pages that contained unreadable text and icons. Which of the following should the analyst do to ensure this behavior does not occur during subsequent vulnerability scans?
Answer(s): C
Option C is correct because tailoring a scan for the printer subnet limits impact on sensitive devices by applying appropriate scope and exclusions, reducing unintended effects during vulnerability assessments.A) Incorrect — Non-credentialed scans may miss certain vulnerabilities but do not address the abnormal printer behavior caused by scanning scope; they can still affect devices differently.B) Incorrect — Ignoring embedded web server ports might reduce some noise but does not prevent printing corruption caused by broad subsystem scanning; it preserves risk of misinterpretation on printers.D) Incorrect — Increasing timeout thresholds does not mitigate the device-specific disruption from a large, unfocused scan; it may worsen impact by prolonging sessions.
A Chief Information Security Officer has outlined several requirements for a new vulnerability scanning project:Must use minimal network bandwidthMust use minimal host resourcesMust provide accurate, near real-time updatesMust not have any stored credentials in configuration on the scannerWhich of the following vulnerability scanning methods should be used to best meet these requirements?
Option B is correct because agent-based scanning minimizes network bandwidth (local agent communicates results efficiently) and host resource usage is distributed to the endpoint, while still enabling near real-time updates without exposing credentials in scanner configurations. It avoids storing credentials on the scanner, since credentials can be managed by the agent on the host. Incorrect — A: Internal can still require network-heavy scans and may not minimize host resource use or credential handling as effectively. Incorrect — C: Active scanning generates direct traffic to targets, increasing bandwidth and resource use and often requires stored credentials or secrets. Incorrect — D: Uncredentialed scans provide limited access and may miss vulns, and do not address near real-time update or credential storage concerns as effectively.
An employee is no longer able to log in to an account after updating a browser. The employee usually has several tabs open in the browser. Which of the following attacks was most likely performed?
Option C is correct because CSRF exploits a user’s active session to perform actions without their intent, often enabling login or account actions when the user is authenticated and has multiple tabs open. RFI (Remote File Inclusion) and LFI (Local File Inclusion) target server-side file processing, not user session hijacking. XSS (Cross-Site Scripting) injects scripts into pages but does not inherently explain login disruption after a browser update with multiple tabs. Therefore CSRF best matches an authentication/login impact tied to an existing user session across multiple tabs.
Which of the following does "federation" most likely refer to within the context of identity and accessmanagement?
Option B is correct because federation in IAM refers to using a single credential set to access multiple domains or security boundaries, typically via standards like SAML or OAuth, enabling single sign-on across trusted domains.A) Incorrect — describes RBAC/groups and elevated access, not federation.C) Incorrect — describes multi-factor authentication (MFA), not federated identity across domains.D) Incorrect — describes identity governance or attribute-based access control (ABAC), not the cross-domain credential federation concept.Note: If any part seems ambiguous or uncertain about federation specifics, indicate INSUFFICIENT_KNOWLEDGE.
The Chief Information Security Officer for an organization recently received approval to install a new EDR solution. Following the installation, the number of alerts that require remediation by an analyst has tripled. Which of the following should the organization utilize to best centralize the workload for the internal security team? (Choose two.)
Answer(s): A,B
Option A and B are correct because: SOAR automates and orchestrates incident response, centralizing remediation workflows and playbooks, which helps scale with increased EDR alerts. SIEM aggregates logs and alerts from EDR and other sources, enabling centralized analysis and correlation to prioritize threats. Incorrect assumptions:C) MSP is a managed service provider, not a workload-centralization mechanism for internal security response. D) NGFW is a network firewall; it does not centralize security operations or remediation workflows. E) XDR extends detection across multiple domains but does not replace the centralized workflow orchestration provided by SOAR; in practice, XDR complements SIEM/SOAR rather than replacing centralized orchestration. F) DLP focuses on data loss prevention, not centralized incident workflow management.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.