During an incident in which a user machine was compromised, an analyst recovered a binary file that potentially caused the exploitation. Which of the following techniques could be used for further analysis?
Answer(s): B
Option B is correct because static analysis examines code without executing it, enabling investigators to inspect the recovered binary for indicators of compromise, known vulnerabilities, or malicious logic. A) Fuzzing tests inputs against a program by causing crashes or unexpected behavior, not for analyzing an already recovered binary. C) Sandboxing executes code in a controlled environment; while useful, it is an isolation/run-time analysis step, not the primary static examination of the binary. D) Packet capture analyzes network traffic, not the binary itself.
A leader on the vulnerability management team is trying to reduce the team's workload by automating some simple but time-consuming tasks. Which of the following activities should the team leader consider first?
Answer(s): D
Option D is correct because automating health and communication checks ensures ongoing monitoring integrity and reduces manual triage, addressing recurring operational tasks foundational to vulnerability management automation.A is incorrect because assigning a custom recommendation for each finding is a manual, subjective optimization that adds workload rather than reducing it.B is incorrect because analyzing false positives is an important accuracy activity but not typically the first automation target for reducing toil; it often requires analyst judgment and tuning over time.C is incorrect because rendering an additional executive report adds reporting workload, not core automation for vulnerability management tasks.
The Chief Information Security Officer (CISO) of a large management firm has selected a cybersecurity framework that will help the organization demonstrate its investment in tools and systems to protect its data.Which of the following did the CISO most likely select?
Answer(s): C
The C is correct because ISO 27001 is an international standard for an information security management system (ISMS) that demonstrates an organization’s commitment to protecting data through a structured framework of policies, risk assessment, and controls suitable for compliance and governance. A) PCI DSS focuses specifically on payment card data and compliance, not a general ISMS. B) COBIT is a governance framework for IT management and governance, not primarily a formal ISMS demonstration. D) ITIL covers IT service management processes, not an information security framework for data protection governance.
A high volume of failed RDP authentication attempts was logged on a critical server within a one-hour period. All of the attempts originated from the same remote IP address and made use of a single valid domain user account. Which of the following would be the most effective mitigating control to reduce the rate of success of this brute-force attack?
Answer(s): A
Option A is correct because enabling account lockout after a limited number of failed attempts directly mitigates brute-force success by temporarily suspending access after repeated failures, limiting rapid credential guessing from a single IP. This aligns with standard authentication hardening and Brute Force/Password Attack mitigations in CySA+.Incorrect —B: Installing a third-party remote access tool and disabling RDP on all devices is a drastic change that may affect operations and does not selectively mitigate brute-force rate on a single account; it’s not the most effective immediate control for rate reduction.C: Blocking the remote IP address addresses the attacker source but may be easily rotated; it doesn’t reduce the rate of attempts from the legitimate user’s account or system behavior.D: Increasing log-on auditing improves detection, not prevention; it does not reduce the rate of successful attempts.
An incident response analyst is investigating the root cause of a recent malware outbreak. Initial binary analysis indicates that this malware disables host security services and performs cleanup routines on its infected hosts, including deletion of initial dropper and removal of event log entries and prefetch files from the host. Which of the following data sources would most likely reveal evidence of the root cause? (Choose two.)
Answer(s): B,E
Option B is correct because registry artifacts can reveal persistence mechanisms, configuration, and indicators left by malware, aiding root-cause analysis. Option E is correct because file system metadata (timestamps, attributes, and audit trails) helps reconstruct infection steps and file activity, even after cleanup. Incorrect — A: Creation time of dropper may show timing but not comprehensive root-cause data. Incorrect — C: EDR data is useful but may be incomplete if tampering occurred; not the two best sources for this scenario. Incorrect — D: Prefetch files may be removed or cleaned and not reliable evidence. Incorrect — F: Sysmon event log can help, but registry and file metadata more directly reveal root cause here.
When undertaking a cloud migration of multiple SaaS applications, an organization's systems administrators struggled with the complexity of extending identity and access management to cloud-based assets. Which of the following service models would have reduced the complexity of this project?
Option A is correct because CASB (Cloud Access Security Broker) centralizes visibility and control over SaaS usage, identities, and access across cloud services, reducing IAM extension complexity during cloud migrations. B) SASE consolidates networking and security services but does not specifically address IAM integration for multiple SaaS apps. C) ZTNA secures access to applications by identity and context but is not primarily a governance/visibility solution for broad SaaS IAM fragmentation. D) SWG (Secure Web Gateway) focuses on web traffic monitoring and policy enforcement rather than comprehensive IAM extension across SaaS platforms. INSUFFICIENT_KNOWLEDGE
A security analyst reviews the following extract of a vulnerability scan that was performed against the web server:Which of the following recommendations should the security analyst provide to harden the web server?
Option A is correct because removing or obscuring the server's version information from the HTTP response reduces fingerprinting risk and helps prevent targeted exploits targeting known server versions. B) Incorrect — Disabling tcp_wrappers is irrelevant unless the host uses TCP wrappers; modern web servers typically rely on other access control mechanisms, and this may not harden the web server for web traffic. C) Incorrect — Deleting /wp-login.php would break site functionality and is not a legitimate hardening measure; it could disrupt service and isn’t a recommended security control. D) Incorrect — Closing port 22 (SSH) is unrelated to hardening the web server’s HTTP/HTTPS surface; SSH access is separate from web service hardening.
A security analyst is responding to an incident that involves a malicious attack on a network data closet. Which of the following best explains how the analyst should properly document the incident?
Option D is correct because documenting incident scenes typically involves capturing visual evidence (photos) of impacted items to preserve chain-of-custody and support later analysis and legal proceedings. A, B, and C do not directly capture tangible, rapid-scene evidence needed for incident documentation: A may back up configurations but not visual scene evidence; B records connections but lacks physical context; C diagrams infrastructure after the fact, which may miss real-time conditions and evidence integrity. Incorrect — A) Backing up device configs is relevant to recovery/forensics later but not immediate documentation of the scene; Incorrect — B) Recording connections is useful for mapping but not sufficient as primary scene documentation; Incorrect — C) Creating a full diagram helps design understanding but does not capture current state and evidence at the scene; Incorrect — D) Take photos of the impacted items.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.