A threat hunter seeks to identify new persistence mechanisms installed in an organization's environment. In collecting scheduled tasks from all enterprise workstations, the following host details are aggregated:Which of the following actions should the hunter perform first based on the details above?
Answer(s): A
Option A is correct because retrieving the specific executable (taskhw.exe) from the impacted host is the most direct step to verify its provenance, integrity, and to perform hash comparison and malware analysis for persistence mechanisms.B is incorrect because scanning for other systems with taskhdw.exe may help later but does not verify the initial host's compromise or establish a baseline for attribution.C is incorrect because a public malware search may be limiting, and could miss targeted, version-specific indicators of compromise tied to the internal environment.D is incorrect because changing the account without first validating and understanding the persistence vector could disrupt legitimate tasks and alert adversaries.
A SOC analyst is analyzing traffic on a network and notices an unauthorized scan. Which of the following types of activities is being observed?
Option A is correct because an unauthorized scan is typically a potential precursor to an attack, indicating reconnaissance activity that can precede exploitation.A) Correct — The scan represents initial threat intelligence gathering and identification of targets, which aligns with a precursor to an attack.B) Incorrect — Unauthorized peer-to-peer communication implies illicit P2P traffic between hosts, not specifically a scanning activity.C) Incorrect — A rogue device is a compromised or unmanaged host presenting itself on the network, not the act of scanning.D) Incorrect — System updates refer to legitimate or managed software patching, not network reconnaissance.
HOTSPOTWelcome to the Enterprise Help Desk System. Please work the ticket escalated to you in the help desk ticket queue.INSTRUCTIONSClick on the ticket to see the ticket details. Additional content is available on tabs within the ticket.First, select the appropriate issue from the drop-down menu. Then, select the MOST likely root cause from second drop-down menu.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.Hot Area:
SIMULATIONA company recently experienced a security incident. The security team has determined a user clicked on a link embedded in a phishing email that was sent to the entire company. The link resulted in a malware download, which was subsequently installed and run.INSTRUCTIONSPart 1Review the artifacts associated with the security Incident. Identify the name of the malware, the malicious IP address, and the date and time when the malware executable entered the organization.Part 2Review the kill chain items and select an appropriate control for each that would improve the security posture of the organization and would have helped to prevent this incident from occurring. Each control may only be used once, and not all controls will be used.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Kill Chain Item:Phishing email - Email filteringActive links - VPNMalicious website access - IP blocklistMalware download - Firewall file type filterMalware install - Restricted local user permissionsMalware execution - Updated antivirusFile encryption - BackupsIdentify the following:Malicious executable - Payroll.xlsxMalicious IP Address - 81.161.63.103Date/time malware entered organization- 1 Dec 2019 14:03:19
A company classifies security groups by risk level. Any group with a high-risk classification requires multiple levels of approval for member or owner changes. Which of the following inhibitors to remediation is the company utilizing?
Organizational governance refers to the structures, policies, and processes that control how decisions are made within an organization, particularly regarding risk and security. In this scenario, the company has implemented a governance policy that requires multiple levels of approval for changes to high-risk security groups. This process helps ensure that any modifications to sensitive groups are carefully vetted, reducing the risk of unauthorized access. Requiring multiple approvals is a governance measure designed to enforce strict control over critical security changes.
An analyst reviews a recent government alert on new zero-day threats and finds the following CVE metrics for the most critical of the vulnerabilities:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:W/RC:RWhich of the following represents the exploit code maturity of this critical vulnerability?
Option A is correct because E:U denotes Exploit Code Maturity as Unproven/Unknown in the CVSS metrics, indicating no exploit code is publicly available or confirmed for the vulnerability. Incorrect — B) S:C (Scope) indicates the vulnerability affects resources beyond the security authority of the vulnerable component, not exploit maturity. Incorrect — C) RC:R (Remediation Level) refers to the availability of a fix, not exploit code maturity. Incorrect — D) AV:N (Attack Vector) describes the means by which the exploit can be launched (network), not exploit maturity. Incorrect — E) AC:L (Attack Complexity) indicates the ease of exploit, not exploit code maturity.
A security analyst detects an email server that had been compromised in the internal network. Users have been reporting strange messages in their email inboxes and unusual network traffic. Which of the following incident response steps should be performed next?
Answer(s): C
Option C is correct because containment aims to limit the spread and impact of a confirmed compromise, which is the immediate next step after detection to prevent further data loss or additional hosts becoming affected. A) Preparation occurs prior to incident detection, focusing on readiness rather than actions taken during an active incident. B) Validation is about confirming that an incident occurred, which should already be established before containment. D) Eradication involves removing the cause of the incident, which typically follows containment once the threat is isolated.
A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization's environment. An analyst views the details of these events below:Which of the following statements best describes the intent of the attacker, based on this one-liner?
Option C is correct because the one-liner indicates execution of a PowerShell script, specifically "AccessToken.ps1," which is a clear indicator of PowerShell-based activity often used to access or modify tokens for privilege escalation or lateral movement.A) Incorrect — JavaScript-based privilege escalation is not implied by a PowerShell one-liner and JavaScript is not the focus of the provided event details.B) Incorrect — There is no evidence of a malware download script or payload distribution; the indicator points to PowerShell script execution, not a download.D) Incorrect — Persistence mechanisms require specific actions (registry run keys, scheduled tasks, services) beyond a single PowerShell script execution; the one-liner alone does not demonstrate persistence.
Post your Comments and Discuss CompTIA CS0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CS0-003 content, but please register or login to continue.