An analyst suspects cleartext passwords are being sent over the network. Which of the following tools would best support the analyst's investigation?
Answer(s): C
Option C is correct because Wireshark captures and analyzes network traffic, enabling inspection of plaintext credentials in transit. It can filter for common authentication protocols and display cleartext passwords if not encrypted. Incorrect — A: OpenVAS is a vulnerability scanner, not a traffic analyzer. Incorrect — B: Angry IP Scanner enumerates live hosts and ports, not wire data. Incorrect — D: Maltego focuses on data relationships and intelligence gathering, not real-time packet capture.
Using open-source intelligence gathered from technical forums, a threat actor compiles and tests a malicious downloader to ensure it will not be detected by the victim organization's endpoint security protections. Which ofthe following stages of the Cyber Kill Chain best aligns with the threat actor's actions?
Answer(s): D
Option D is correct because weaponization involves creating and testing a malware payload (downloader) to evade defenses before deployment. Incorrect — A (Delivery): relates to delivering the weapon to the target, not development/testing. Incorrect — B (Reconnaissance): gathering intelligence about the target; not creating/bundling the payload. Incorrect — C (Exploitation): exploiting a vulnerability to execute code on the target; not crafting or testing the payload to bypass security.
An organization would like to ensure its cloud infrastructure has a hardened configuration. A requirement is to create a server image that can be deployed with a secure template. Which of the following is the best resource to ensure secure configuration?
Answer(s): A
Option A is correct because CIS Benchmarks provide consensus-based security configuration guidelines and checklists for hardening server images and cloud templates, aligning with secure-by-default practices. Incorrect — B PCI DSS focuses on payment card data security controls, not general hardening guidance. Incorrect — C OWASP Top 10 identifies common web application vulnerabilities, not system hardening or image templates. Incorrect — D ISO 27001 defines an information security management system framework and controls, but does not provide specific hardening templates or baseline configurations for cloud images.
A security analyst reviews the following Arachni scan results for a web application that stores PII data:Which of the following should be remediated first?
Option A is correct because SQL injection directly compromises data confidentiality and integrity, enabling unauthorized access to PII and potential full DB compromise, which poses severe risk and should be remediated first. Incorrect — B (RFI): Remote file inclusion can lead to code execution but is typically less common and often depends on specific server configurations; still important but not universally as critical as SQLi for PII exposure. Incorrect — C (XSS): Reflects client-side script injection, risking session hijacking and data leakage, but generally has a lower immediate impact on backend data security than SQLi. Incorrect — D (Code injection): Broad category; may be high risk, but SQLi directly enables data access without needing exploit chaining in many apps.
Which of the following stakeholders are most likely to receive a vulnerability scan report? (Choose two.)
Answer(s): A,F
Option A is correct because executive management often reviews security posture and risk metrics, including vulnerability findings, to make strategic decisions. Option F is correct because systems administration is typically the primary recipient and owner of remediation actions for detected vulnerabilities.A) Correct — leadership reviews risk and governance reports, including vulnerability scan results, to inform business decisions.B) Incorrect — law enforcement is not involved in internal vulnerability remediation reporting.C) Incorrect — marketing typically has no need for technical vulnerability details.D) Incorrect — legal may need risk implications but not the primary vulnerability scan report for remediation.E) Incorrect — product owner may be aware of security risks, but vulnerability reports are primarily for remediation and governance, not stakeholder-facing product decisions.
Which of the following techniques can help a SOC team to reduce the number of alerts related to the internal security activities that the analysts have to triage?
Option D is correct because adding a SOAR rule to drop irrelevant and duplicated notifications reduces alert churn by suppressing non-actionable or duplicate alerts, enabling analysts to focus on meaningful incidents. A) Enriching SIEM data aids triage but does not reduce alert volume; it may actually increase context, not suppression. B) Disabling alerting during scans hides important signals and degrades visibility. C) Filtering low-severity alarms reduces noise but risks missing legitimate issues if misconfigured; it does not systematically handle duplicates/irrelevancies like a SOAR deduplication rule.
An analyst is evaluating a vulnerability management dashboard. The analyst sees that a previously remediated vulnerability has reappeared on a database server. Which of the following is the most likely cause?
Answer(s): B
Option B is correct because a rollback on the instance would restore the system to its prior state, reintroducing previously remediated vulnerabilities as if they were never fixed. A) Incorrect — false positives are unlikely to reappear after remediation unless the remediation was incorrect or not applied; reappearance suggests a remediation action was undone rather than a false alarm. C) Incorrect — lacking credentials would typically prevent discovery of vulnerabilities, not cause a previously fixed issue to reappear. D) Incorrect — updating VM software may introduce new findings or false positives, but does not explain a historically remediated issue resurfacing through rollback.
A company has decided to expose several systems to the internet. The systems are currently available internally only. A security analyst is using a subset of CVSS3.1 exploitability metrics to prioritize the vulnerabilities that would be the most exploitable when the systems are exposed to the internet. The systems and the vulnerabilities are shown below:Which of the following systems should be prioritized for patching?
Option C is correct because blane has the most exploitable vulnerability when exposed to the internet, based on CVSS3.1 exploitability submetrics (e.g., low Attack Vector/Requires Privilege Escalation, high User Interaction) that increase exploitability in an internet-facing context. A, B, and D are less exploitable given their vulnerability characteristics under CVSS3.1: A and B have lower exploitability scores or defensive mitigations, and D presents a comparatively lower likelihood of exploitation when exposed. Overall, prioritization should focus on the system with the highest exploitability score in the CVSS3.1 metric set.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.