After reviewing the final report for a penetration test, a cybersecurity analyst prioritizes the remediation for input validation vulnerabilities. Which of the following attacks is the analyst seeking to prevent?
Answer(s): D
Option D is correct because input validation vulnerabilities enable cross-site scripting (XSS), where attacker-supplied input is not properly sanitized, allowing scripts to execute in a user’s browser. Incorrect — A) DNS poisoning targets DNS records, not input validation. Incorrect — B) Pharming redirects users via compromised DNS or hosts file, not due to input validation in apps. Incorrect — C) Phishing relies on social engineering and deceptive messages, not on input validation weaknesses.
During a security test, a security analyst found a critical application with a buffer overflow vulnerability. Which of the following would be best to mitigate the vulnerability at the application level?
Answer(s): B
Option B is correct because input validation prevents malformed or oversized data from reaching vulnerable code paths, mitigating buffer overflow risks at the application level. Incorrect — A) OS hardening reduces system exposure but does not directly address how the application handles input. Incorrect — C) Updating third-party dependencies mitigates known flaws in libraries, but not the root buffer handling within the application without code changes. Incorrect — D) Address Space Layout Randomization complicates exploitation but doesn’t fix the underlying vulnerability in the application’s code.
The SOC received a threat intelligence notification indicating that an employee's credentials were found on the dark web. The user's web and log-in activities were reviewed for malicious or anomalous connections, data uploads/downloads, and exploits. A review of the controls confirmed multifactor authentication was enabled. Which of the following should be done first to mitigate impact to the business networks and assets?
Answer(s): A
Option A is correct because a forced password reset directly mitigates risk from credential compromise, especially after exposure on the dark web, reducing potential ongoing unauthorized access even with MFA in place.B is incorrect because notifying the user does not mitigate active risk to systems or assets.C is incorrect because an ad hoc AV scan on one laptop may help local containment but does not address lateral movement or credential-based access across the environment.D is incorrect because least privilege review is important but not the immediate first step when credentials are exposed; containment comes first.E is incorrect because lowering SOC alert thresholds could increase risk visibility gaps, delaying detection.
A security analyst is working on a server patch management policy that will allow the infrastructure team to beinformed more quickly about new patches. Which of the following would most likely be required by the infrastructure team so that vulnerabilities can be remediated quickly? (Choose two.)
Answer(s): A,C
Option A is correct because hostname visibility helps correlate patch advisories to specific assets in the infrastructure, enabling targeted remediation and rapid notification. Option C is correct because CVE details provide the standardized vulnerability identifiers, severity, and affected products needed to prioritize and track patches.A) Incorrect — Missing KPI is not directly related to patch remediation or notification of new patches.B) Incorrect — POC availability is useful for testing but not essential for rapid vulnerability remediations across the fleet.D) Incorrect — IoCs are used for detection of breaches, not for implementing or prioritizing patches.E) Incorrect — npm identifier is specific to JavaScript package management, not general server patching workflows.
Chief Information Security Officer (CISO) wants to disable a functionality on a business-critical web application that is vulnerable to RCE in order to maintain the minimum risk level with minimal increased cost. Which of the following risk treatments best describes what the CISO is looking for?
Option B is correct because Mitigate involves reducing risk to an acceptable level by implementing controls or compensating actions (disabling vulnerable functionality to lower exposure and cost). A) Transfer would shift risk to a third party and doesn’t apply to technical vulnerability remediation. C) Accept means no action is taken beyond monitoring, which would leave the vulnerability at risk. D) Avoid would require eliminating the activity entirely, which is more drastic or impractical for a business-critical web app; mitigation targets residual risk with cost-conscious controls.
A company has a primary control in place to restrict access to a sensitive database. However, the company discovered an authentication vulnerability that could bypass this control. Which of the following is the best compensating control?
Answer(s): C
Option C is correct because a compensating control is an alternative safeguard that mitigates risk when the primary control is compromised; adding an additional layer of access controls directly addresses unauthorized access due to the authentication vulnerability. A) Regular penetration tests identify vulnerabilities but do not mitigate an existing bypass by themselves. B) Security awareness helps reduce social engineering but does not strengthen access validation for the database. D) IDS alerts detect incidents but do not prevent access; they are detective, not preventive, controls. Therefore C best compensates for the bypassed primary control.
An analyst discovers unusual outbound connections to an IP that was previously blocked at the web proxy and firewall. Upon further investigation, it appears that the proxy and firewall rules that were in place were removed by a service account that is not recognized. Which of the following parts of the Cyber Kill Chain does this describe?
Option B is correct because unusual outbound connections to a previously blocked IP indicate established command and control (C2) communication after initial compromise, aligning with the Cyber Kill Chain phase where attacker maintains control and exfiltrates data. A) Delivery refers to initial delivery of the weapon or exploit, not ongoing C2. C) Reconnaissance involves information gathering prior to intrusion, not post-compromise control. D) Weaponization is the pairing of payload with delivery method, occurring before compromise. INSUFFICIENT_KNOWLEDGE
An organization's email account was compromised by a bad actor. Given the following information:Which of the following is the length of time the team took to detect the threat?
Option A is correct because 25 minutes represents the time elapsed from initial compromise to detection as described in the scenario, aligning with typical Mean Time to Detect (MTTD) metrics used in CySA+ to quantify detection efficiency.B is incorrect — 40 minutes would indicate a longer MTTD than stated, which does not match the given scenario.C is incorrect — 45 minutes similarly implies a longer detection window than provided.D is incorrect — 2 hours would be far outside a reasonable detection window and contradicts the stated correct answer.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.