support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. CompTIA
  4. CS0-003

CompTIA CS0-003 Exam Actual Questions
CompTIA CySA+ (CS0-003) (Page 3 )

Updated On: 13-Jun-2026
Page 3 of 73
PDF with 571 Questions

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

  1. Business continuity plan
  2. Vulnerability management plan
  3. Disaster recovery plan
  4. Asset management plan

Answer(s): A

Explanation:

Option A is correct because a business continuity plan (BCP) explicitly ensures ongoing availability of mission-critical services during and after incidents, outlining recovery strategies, continuity requirements, and operational processes. Incorrect — B: Vulnerability management focuses on identifying and remediating weaknesses, not ensuring service availability during incidents. Incorrect — C: Disaster recovery plan concentrates on restoring IT systems after a disruption, but BCP covers broader organizational continuity beyond IT recovery. Incorrect — D: Asset management plan tracks assets, not continuity or availability of services.



The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high- risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

  1. Deploy a CASB and enable policy enforcement
  2. Configure MFA with strict access
  3. Deploy an API gateway
  4. Enable SSO to the cloud applications

Answer(s): A

Explanation:

Option A is correct because deploying a CASB (Cloud Access Security Broker) enables visibility, data loss prevention, and policy enforcement over shadow IT by controlling and monitoring cloud app usage across the enterprise. Incorrect — B: MFA with strict access reduces account compromise risk but doesn’t directly control or discover unsanctioned cloud apps. Incorrect — C: API gateway secures APIs but does not address visibility or governance of third-party cloud services. Incorrect — D: SSO simplifies authentication but does not provide policy enforcement or discovery of unsanctioned cloud applications.



An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first?

  1. CDN
  2. Vulnerability scanner
  3. DNS
  4. Web server

Answer(s): C

Explanation:

Option C is correct because DNS logs can reveal DNS amplification or cache miss patterns, record spikes in query types, and upstream resolver issues typically seen in DDoS affecting external SaaS access. Reviewing DNS may show authoritative name server failures or TTL-based misconfigurations that disrupt SaaS resolution during an outage.
A) CDN logs focus on content delivery performance and edge-cache behavior, not the root cause of external SaaS access disruption.
B) Vulnerability scanner logs pertain to known weaknesses and asset posture, not real-time attack traffic or resolution failures.
D) Web server logs record inbound HTTP requests but may not reflect upstream DNS or global routing issues causing the outage.



A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

  1. Weaponization
  2. Reconnaissance
  3. Delivery
  4. Exploitation

Answer(s): D

Explanation:

Option D is correct because exploitation refers to the stage where the attacker leverages access gained via social engineering to achieve initial foothold and maintain access without triggering immediate loss. A) Weaponization is the pairing of payload with delivery method prior to deployment. B) Reconnaissance involves gathering information about the target before engagement. C) Delivery is the delivery of the weaponized payload to the target. The scenario describes maintaining access after gaining entry, which aligns with exploitation, not the earlier stages.



An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?

  1. Exploitation
  2. Reconnaissance
  3. Command and control
  4. Actions on objectives

Answer(s): B

Explanation:

Option B is correct because scanning external-facing assets from an external IP corresponds to reconnaissance, where an attacker gathers information about targets. Incorrect — A: Exploitation involves leveraging a vulnerability to gain access, not scanning. Incorrect — C: Command and control refers to maintaining remote access and controlling compromised hosts, not initial discovery. Incorrect — D: Actions on objectives describe post-compromise activities to achieve goals, not the information-gathering phase.



An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.)

  1. Beaconing
  2. Domain Name System hijacking
  3. Social engineering attack
  4. On-path attack
  5. Obfuscated links
  6. Address Resolution Protocol poisoning

Answer(s): C,E

Explanation:

Option C is correct — social engineering attack: targeted emails to administrators likely aim to manipulate or trick, a classic social engineering technique. Option E is correct — obfuscated links: concealed URL in the email indicates link obfuscation to mislead recipients.
A) Beaconing — incorrect: beaconing refers to periodic signaling from malware to a C2 server, not targeted admin emails.
B) Domain Name System hijacking — incorrect: DNS hijacking involves tampering DNS responses, not concealed URLs in phishing-like emails.
D) On-path attack — incorrect: requires attacker to position itself on communication path (man-in-the-middle), not described here.
F) Address Resolution Protocol poisoning — incorrect: ARP poisoning is local network spoofing, not email-based link concealment.



During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

  1. Conduct regular red team exercises over the application in production
  2. Ensure that all implemented coding libraries are regularly checked
  3. Use application security scanning as part of the pipeline for the CI/CD flow
  4. Implement proper input validation for any data entry form

Answer(s): C

Explanation:

Option C is correct because integrating application security scanning into the CI/CD pipeline ensures continuous, automated vulnerability detection during each SDLC phase, reducing repeat findings in production and aligning with secure development practices.
A) Incorrect — red team exercises in production assess real-world attacks but don’t address automated, ongoing defect discovery within the SDLC and may not catch root causes early.
B) Incorrect — checking coding libraries helps but does not continuously scan the application’s own code for vulnerabilities throughout the pipeline.
D) Incorrect — input validation is essential but focuses on runtime security controls rather than mitigating recurring vulnerabilities identified by scanners across SDLC.



An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

  1. Proprietary systems
  2. Legacy systems
  3. Unsupported operating systems
  4. Lack of maintenance windows

Answer(s): A

Explanation:

Option A is correct because proprietary systems constrain remediation by vendor access and tooling, preventing timely upgrades for those critical appliances. B is incorrect because legacy systems imply outdated software, not necessarily vendor access constraints. C is incorrect because unsupported OS typically means no vendor updates, whereas the issue here is that access to the vendor-appliance is unavailable. D is incorrect because lack of maintenance windows describes scheduling constraints, not the fundamental barrier of vendor-controlled devices. Correct — proprietary constraints impede remediation despite downtime being feasible for other systems.



  PDF
Viewing page 3 of 73
Viewing questions 17 - 24 out of 571 questions


CS0-003 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!