A cybersecurity analyst is participating with the DLP project team to classify the organization's data. Which of the following is the primary purpose for classifying data?
Answer(s): D
Option D is correct because data classification establishes the data’s value to the organization, guiding protection levels, access controls, and prioritization of security efforts. It helps determine handling requirements and risk posture based on asset value.A) Incorrect — While classification informs regulatory considerations, the primary purpose is not identifying compliance alone.B) Incorrect — DLP rule creation is a downstream use of classification, not the fundamental purpose.C) Incorrect — Data classification is not primarily about IT spend prioritization, though it influences resource allocation.
A security analyst observed the following activity from a privileged account:Accessing emails and sensitive informationAudit logs being modifiedAbnormal log-in timesWhich of the following best describes the observed activity?
Option D is correct because the combination of accessing emails/sensitive data, modifying audit logs, and abnormal login times from a privileged account indicates an insider threat manipulating systems for concealment. A) Incorrect — Irregular peer-to-peer communication describes unusual direct device-to-device traffic, not privileged access abuse or audit tampering. B) Incorrect — Unauthorized privileges imply gaining access to higher rights, but do not necessarily indicate log tampering or the broader insider behavior pattern. C) Incorrect — Rogue devices imply unapproved hardware on the network, not account-based privilege abuse or audit manipulation.
A vulnerability management team found four major vulnerabilities during an assessment and needs to provide a report for the proper prioritization for further mitigation. Which of the following vulnerabilities should have the highest priority for the mitigation process?
Answer(s): B
Option B is correct because a vulnerability tied to an active adversary campaign with IoCs in the SIEM indicates immediate, targeted risk and likelihood of exploitation, elevating priority for mitigation per threat-centric risk assessment.A) Incorrect — Threats/IoCs in a different industry reduce immediate relevance; cross-industry targeting lowers likelihood for the assessed environment.C) Incorrect — No adversaries or IoCs imply lower likelihood of exploitation; remediation can be deprioritized relative to active campaigns.D) Incorrect — Isolated system with no IoCs presents limited exposure and network impact, reducing urgency compared to campaign-connected vulnerabilities.
A security analyst received an alert regarding multiple successful MFA log-ins for a particular user. When reviewing the authentication logs, the analyst sees the following:Which of the following are most likely occurring, based on the MFA logs? (Choose two.)
Answer(s): B,C
Option B is correct because push phishing can lead to multiple successful MFA prompts/logins when an attacker coaxes the user to approve pushes, enabling unauthorized access. Option C is correct because impossible geo-velocity indicates logins occurring from geographically disparate locations in a timeframe that exceeds plausible travel speed, matching rapid MFA-enabled accesses.A) Dictionary attack: typically targets passwords, not MFA push/geo patterns; MFA logs would show compromised credentials but not the rapid geo-velocity behavior.D) Subscriber identity module swapping: involves SIM tampering, not MFA logins pattern.E) Rogue access point: relates to network access manipulation, not MFA correlation.F) Password spray: causes many accounts targeted with low-entropy passwords, not rapid MFA successes for a single user.
A security analyst has identified a new malware file that has impacted the organization. The malware is polymorphic and has built-in conditional triggers that require a connection to the internet. The CPU has an idle process of at least 70%. Which of the following best describes how the security analyst can effectively review the malware without compromising the organization's network?
Answer(s): C
Option C is correct because creating a virtual host on the security analyst’s workstation provides an isolated, controlled environment (sandbox) to analyze transient and networked behaviors without exposing the production network. It leverages local virtualization to monitor runtime actions and network calls safely.A) Incorrect — RDP on an unused workstation risks lateral movement to other assets if containment fails and may place malware on an endpoint connected to the network. B) Incorrect — Off-network infected asset detaches containment but may still be uncontrolled, and removing from production does not guarantee isolated behavioral analysis. D) Incorrect — Online sandbox services introduce external network connectivity and potential data exfiltration risk; preference is an internal, isolated VM.
Which of the following threat-modeling procedures is in the OWASP Web Security Testing Guide?
Option C is correct because the OWASP Web Security Testing Guide emphasizes decomposing the application to understand architecture, data flows, and trust boundaries as a foundational threat-modeling activity. Incorrect — A: Review of security requirements is not unique to threat modeling in OWASP; it’s a broader safety-process step. Incorrect — B: Compliance checks focus on regulatory adherence, not the threat-modeling decomposition. Incorrect — D: Security by design is a principle, not a specific threat-modeling procedure outlined in the guide.
Which of the following would an organization use to develop a business continuity plan?
Option C is correct because a business continuity plan centers on identifying and prioritizing critical systems to ensure rapid recovery and continuity of operations during disruptions.A) Incorrect — A diagram of systems and interdependencies is useful for understanding architecture and recovery dependencies but does not by itself establish prioritization or recovery actions required for business continuity.B) Incorrect — A software repository supports software management, not continuity planning or prioritization of critical assets.D) Incorrect — A CMDB provides asset information, but a printed off-site copy alone does not constitute a business continuity plan or its prioritization framework.
The management team requests monthly KPI reports on the company's cybersecurity program. Which of the following KPIs would identify how long a security threat goes unnoticed in the environment?
Option C is correct because Mean Time to Detect (MTTD) measures the duration from initial breach or intrusion to when it is detected, directly indicating how long a threat remains unnoticed in the environment.A) Employee turnover is not a cybersecurity KPI and does not reflect detection capabilities.B) Intrusion attempts quantify attack frequency, not the detection latency.D) Level of preparedness assesses overall defensive readiness, not the time-to-detection metric.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.