Which of the following statements best describes the MITRE ATT&CK framework?
Answer(s): C
Option C is correct because MITRE ATT&CK maps attacker behaviors to tactics and techniques, helping defenders identify where an attacker functions in the intrusion kill chain and focus detection and response efforts.A) Incorrect — ATT&CK is not a testing framework for applications. B) Incorrect — threat intelligence sharing and mitigation development align more with threat intel programs, not the ATT&CK matrix itself. D) Incorrect — while ATT&CK is open and evolves, the core purpose is attacker behavior mapping, not threat tracking as a standalone description. E) Incorrect — ATT&CK describes attack techniques and tactics, not a strict sequential intrusion phase model like the traditional kill chain.
A Chief Information Security Officer (CISO) is concerned that a specific threat actor who is known to target the company's business type may be able to breach the network and remain inside of it for an extended period of time. Which of the following techniques should be performed to meet the CISO's goals?
Answer(s): B
Option B is correct because adversary emulation tests use threat-relevant attack scenarios to assess dwell time and detection gaps, aligning with the goal of simulating a known actor’s long-term presence.A) Incorrect — Vulnerability scanning identifies weaknesses but does not simulate a specific threat actor or study extended persistence.C) Incorrect — Passive discovery focuses on gathering baseline information without emulating adversaries or assessing prolonged breach tactics.D) Incorrect — Bug bounty programs reward external researchers for finding flaws, not for testing attacker dwell time or persistence within a targeted threat model.
A security analyst receives an alert for suspicious activity on a company laptop. An excerpt of the log is shown below:Which of the following has most likely occurred?
Answer(s): A
Option A is correct because the log excerpt indicates activity consistent with an Office document containing a malicious macro being opened, a common vector flagged by security alerts for suspicious macro-enabled documents. Incorrect — B: credential-stealing sites would show credential harvesting activity or credential prompts, not macro execution traces. Incorrect — C: phishing link in email would typically present email indicators or redirections, not macro-related execution in a local file. Incorrect — D: web browser vulnerability exploitation would show exploit patterns in browser process activity or targeted payloads, not macro execution from an Office document.
During an incident, some IoCs of possible ransomware contamination were found in a group of servers in a segment of the network. Which of the following steps should be taken next?
Option A is correct because isolation is the immediate containment step to prevent further lateral movement and data exfiltration when IoCs indicate potential ransomware in a network segment. This preserves evidence and minimizes impact while assessment proceeds.B) Incorrect — Remediation follows containment and involves removing malware and applying fixes; skipping isolation risks spread and data loss.C) Incorrect — Reimaging is a remediation activity after containment when systems are compromised, but should not occur before isolating affected hosts.D) Incorrect — Preservation is important for forensics, but isolation takes priority to contain the incident and protect other assets.
An MSSP received several alerts from customer 1, which caused a missed incident response deadline for customer 2. Which of the following best describes the document that was violated?
Option C is correct because an SLA (Service Level Agreement) defines expected service performance and incident response times between a provider (MSSP) and a customer. A missed incident response deadline constitutes a breach of SLA terms. A) KPI measures performance metrics, not contractual response obligations. B) SLO defines target service level for a specific service, but SLA encompasses overall commitments and remedies; however, the missed deadline indicates SLA failure, not just an SLO. D) MOU is a non-binding agreement outlining intent, not enforceable service levels.
Which of the following is a reason proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response?
Option A is correct because proper handling and reporting of evidence preserves chain of custody and admissibility, ensuring the evidence is legally acceptable if presented in court. Incorrect — B focuses on lessons-learned analysis, which is post-incident but not primarily about evidence handling for legal admissibility. Incorrect — C mentions postmortem analysis; while evidence is useful, the primary compliance driver is admissibility, not postmortem use. Incorrect — D discusses preventing loss of a data source; important, but proper evidence handling for legal reporting is broader and directly tied to court readiness.
An attacker has just gained access to the syslog server on a LAN. Reviewing the syslog entries has allowed the attacker to prioritize possible next targets. Which of the following is this an example of?
Option A is correct because collecting and analyzing syslog data to identify targets without active probing constitutes passive network footprinting, revealing assets and potential weaknesses from logs. Incorrect — B: OS fingerprinting involves active or passive methods to determine operating systems; logs alone don’t reveal OS specifics necessarily. Incorrect — C: Service port identification entails discovering open ports/services, not inferred targets from log data. Incorrect — D: Application versioning is about identifying software versions, typically via banners or probes, not prioritizing targets from syslog summaries.
A security analyst observed the following activities in chronological order:1. Protocol violation alerts on external firewall2. Unauthorized internal scanning activity3. Changes in outbound network performanceWhich of the following best describes the goal of the threat actor?
Option A is correct because the sequence shows external protocol violations, internal scanning, and changes in outbound performance consistent with data exfiltration activity where an actor probes networks and attempts to move data out, often preceded by reconnaissance and foothold integrity checks. Incorrect — B (Unusual traffic spikes) describes anomalies in volume, not specifically target data movement; the observed external protocol violations and outbound changes imply more than generic spikes. Incorrect — C (Rogue devices) would involve unknown endpoints within the network rather than external protocol violations and outbound data flow patterns. Incorrect — D (Irregular peer-to-peer communication) suggests P2P traffic irregularities, which is a specific channel not clearly evidenced by the sequence.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.