Which of the following best describes the key elements of a successful information security program?
Answer(s): B
Option B is correct because a successful information security program rests on formalizing Security policy implementation, defining roles and responsibilities, and classifying information assets to guide protection measures and governance.A) Incorrect — focuses on specific activities (BIA, asset/change management, and comms) but misses overall governance and policy framework.C) Incorrect — centers on DR/BCP and access control definitions; omits policy, governance, and asset classification as foundational elements.D) Incorrect — describes organizational structure and operational procedures rather than the essential program elements of policy, governance, and asset classification.
A systems administrator notices unfamiliar directory names on a production server. The administrator reviews the directory listings and files, and then concludes the server has been compromised. Which of the following steps should the administrator take next?
Option B is correct because following the company's incident response plan is the defined, structured process to handle a suspected compromise, ensuring proper containment, eradication, and recovery steps are followed consistently.A) Incorrect — Informing the internal incident response team may occur, but it is not the immediate next step unless the plan specifies escalation; the plan governs the sequence.C) Incorrect — Reviewing lessons learned is part of post-incident activity, not the immediate response to an active compromise.D) Incorrect — Determining when access started is an investigation activity that occurs during containment/eradication, but the first action is to execute the incident response plan.
Which of the following is a nation-state actor least likely to be concerned with?
Answer(s): D
Option D is correct because nation-state actors are typically focused on strategic objectives and operational impact rather than facilitating retrospective forensic analyses for legal action; they often aim to avoid attribution and legal exposure, not participate in post-incident forensic proceedings. Option A is incorrect because MITRE ATT&CK detection and mapping are relevant for adversary emulation and defense; nation-states are concerned with being detected within ATT&CK as part of assessing exposure. Option B is incorrect because reconnaissance is a foundational phase; preventing or detecting it is a core defensive objective against nation-state campaigns. Option C is incorrect because actors analyze their own actions and objectives to calibrate operations and avoid mission failure.
Which of the following is a commonly used four-component framework to communicate threat actor behavior?
Option B is correct because the Diamond Model of Intrusion Analysis is a four-component framework (adapter, capability, infrastructure, risk) used to characterize threat actor behavior and intrusion campaigns.A) Incorrect — STRIDE is a threat-modeling framework focusing on six categories of security threats (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege), not a four-component actor-behavior model.C) Incorrect — Cyber Kill Chain describes attacker phases from reconnaissance to actions on objectives, not a four-component framework of actor behavior.D) Incorrect — MITRE ATT&CK catalogs adversary tactics, techniques, and procedures, not a four-component behavior framework.
An employee downloads a freeware program to change the desktop to the classic look of legacy Windows. Shortly after the employee installs the program, a high volume of random DNS queries begin to originate from the system. An investigation on the system reveals the following:Add-MpPreference ExclusionPath `%Program Files%\ksyconfig'Which of the following is possibly occurring?
Option D is correct because defense evasion is used to avoid detection and attribution; the DNS bursts and suspicious Add-MpPreference ExclusionPath indicate the attacker is hiding behavior by creating exclusions, allowing persistence of malicious activity while evading security controls.A) Incorrect — Persistence is about maintaining access; while plausible, the exclusion and sudden DNS activity more directly indicate evasion of defenses rather than establishing a long-term foothold.B) Incorrect — Privilege escalation requires increasing access rights; there is no evidence of token or privilege manipulation in the provided artifacts.C) Incorrect — Credential harvesting involves stealing credentials; no credential collection or exfiltration mechanism is described here.
An organization discovered a data breach that resulted in PII being released to the public. During the lessons learned review, the panel identified discrepancies regarding who was responsible for external reporting, as well as the timing requirements. Which of the following actions would best address the reporting issue?
Option B is correct because it directly ensures that external reporting SLAs are defined by aligning federal laws, regulatory requirements, and organizational policies, reducing ambiguity about timing and responsibility in breach events. A) While playbooks and SLAs are useful, they don’t establish the legal obligations and required timelines for external reporting. C) Defining which incidents require external notifications addresses scope but not the specific reporting timelines and legal obligations. D) Assigning roles improves coordination but does not document or ensure external reporting requirements or statutory timelines. INSUFFICIENT_KNOWLEDGE
During an incident, a security analyst discovers a large amount of PII has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee's personal email. Which of the following should the analyst recommend be done first?
Answer(s): A
Option A is correct because initiating a legal hold on the employee’s mailbox preserves relevant emails and metadata for eDiscovery and investigation, ensuring tamper-evident preservation of evidence before potential remediation actions. This aligns with incident response and compliance requirements when PII may be exfiltrated.B is incorrect because enabling web proxy filtering occurs after evidence preservation and may not address existing exfiltration evidence; it also could disrupt legitimate communications.C is incorrect because disabling public email access with CASB may impede remediation but does not preserve evidentiary data.D is incorrect because a firewall deny rule would block traffic but does not guarantee preservation of existing exfiltration artifacts or align with legal hold processes.
Which of the following can be used to learn more about TTPs used by cybercriminals?
Option B is correct because MITRE ATT&CK catalogs adversary TTPs ( tactics, techniques, and procedures ), providing a structured framework to study how cybercriminals operate. Incorrect — A: ZenMAP is a network scanner for discovery and mapping, not a TTP framework. Incorrect — C: NIST provides cybersecurity standards and guidelines, not a specific compilation of attacker TTPs. Incorrect — D: theHarvester is a reconnaissance tool for collecting email addresses and domain names, not a TTP ontology.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.