support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. CompTIA
  4. CS0-003

CompTIA CS0-003 Exam Actual Questions
CompTIA CySA+ (CS0-003) (Page 5 )

Updated On: 13-Jun-2026
Page 5 of 73
PDF with 571 Questions

A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

  1. Create a timeline of events detailing the date stamps, user account hostname and IP information associated with the activities
  2. Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation
  3. Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation
  4. Notify the SOC manager for awareness after confirmation that the activity was intentional

Answer(s): B

Explanation:

Option B is correct because protecting PII and limiting access aligns with HR and privacy policies during investigations, ensuring confidentiality and compliance. A) Creates a detailed timeline but still may expose user data; privacy controls are more critical. C) Code-naming may obscure the case but does not address privacy protections or access controls. D) Notification after confirmation does not address data minimization or access control requirements essential for privacy policy compliance.



Which of the following is the first step that should be performed when establishing a disaster recovery plan?

  1. Agree on the goals and objectives of the plan
  2. Determine the site to be used during a disaster
  3. Demonstrate adherence to a standard disaster recovery process
  4. Identify applications to be run during a disaster

Answer(s): A

Explanation:

Option A is correct because establishing disaster recovery begins with aligning on goals and objectives (RTO/RPO, scope, stakeholders) to guide all subsequent planning. Incorrect — B: site selection is a planning detail after objectives are set. Incorrect — C: adherence to a standard process is an ongoing control, not the initial step. Incorrect — D: identifying applications is part of scope and impact analysis, which follows goal setting.



A technician identifies a vulnerability on a server and applies a software patch. Which of the following should be the next step in the remediation process?

  1. Testing
  2. Implementation
  3. Validation
  4. Rollback

Answer(s): C

Explanation:

Option C is correct because after applying a patch, validation confirms that the vulnerability is mitigated and no new issues were introduced. Testing (A) refers to verifying fixes in a controlled environment before deployment, which may occur earlier in the cycle. Implementation (B) is the act of applying the patch, already done. Rollback (D) is used if the patch causes issues requiring revert. Therefore, validation ensures the remediation effectiveness in the production environment.



The analyst reviews the following endpoint log entry:



Which of the following has occurred?

  1. Registry change
  2. Rename computer
  3. New account introduced
  4. Privilege escalation

Answer(s): C

Explanation:

Option C is correct because a new account introduction is the observable event in the log entry, indicating a user or service account creation. Incorrect — A (Registry change) would show modifications to registry keys, not account creation. Incorrect — B (Rename computer) would log a host name change event, not a new account. Incorrect — D (Privilege escalation) would show elevation actions or group/role changes, not necessarily a new account creation.



A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes what the security program did?

  1. Data enrichment
  2. Security control plane
  3. Threat feed combination
  4. Single pane of glass

Answer(s): D

Explanation:

Option D is correct because a “single pane of glass” describes consolidating tools and data into one interface, reducing MTTR by eliminating context switching and enabling faster detection and response via a unified view in the SIEM.
A) Data enrichment is adding context to events; while helpful, it doesn’t imply a unified interface or reduced tool hopping.
B) Security control plane refers to the architecture coordinating controls, not specifically to unified visualization or MTTR reduction.
C) Threat feed combination involves aggregating threat intelligence; it doesn’t address consolidation of tooling into a single view.



Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:



Which of the following choices should the analyst look at first?

  1. wh4dc-748gy.lan (192.168.86.152)
  2. officerokuplayer.lan (192.168.86.22)
  3. imaging.lan (192.168.86.150)
  4. xlaptop.lan (192.168.86.249)
  5. p4wnp1_aloa.lan (192.168.86.56)

Answer(s): E

Explanation:

Option E is correct because p4wnp1_aloa.lan (192.168.86.56) likely indicates a compromised or attacker-controlled host name (e.g., generic/default or suspicious naming) that should be investigated first when anomalous activity is reported.
A) wh4dc-748gy.lan (192.168.86.152) - looks like a normal hostname pattern; not inherently suspicious.
B) officerokuplayer.lan (192.168.86.22) - resembles a typical user/device hostname; not indicative of compromise.
C) imaging.lan (192.168.86.150) - benign-sounding imaging host; not flagged as suspicious.
D) xlaptop.lan (192.168.86.249) - generic laptop naming; requires investigation but not primary suspect.
F) Inspector notes: None of the others show obvious attacker-controlled naming; E stands out as least legitimate.



When starting an investigation, which of the following must be done first?

  1. Notify law enforcement
  2. Secure the scene
  3. Seize all related evidence
  4. Interview the witnesses

Answer(s): B

Explanation:

Option B is correct because securing the scene is the first essential step to preserve evidence integrity and prevent tampering during the initial incident response. It establishes a controlled environment for investigation and chain of custody.
A) Notifying law enforcement is not the immediate first action in most internal investigations; it comes later if required by policy or law and may depend on the severity and jurisdiction.
C) Seizing all related evidence is premature without stabilization and documented procedures; improper collection can contaminate the evidentiary trail.
D) Interviewing witnesses is important but should occur after securing the scene and preserving evidence to avoid influencing memory or actions.



Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

  1. The lead should review what is documented in the incident response policy or plan
  2. Management level members of the CSIRT should make that decision
  3. The lead has the authority to decide who to communicate with at any t me
  4. Subject matter experts on the team should communicate with others within the specified area of expertise

Answer(s): A

Explanation:

Option A is correct because the incident response policy or plan defines the who, when, and communication pathways during incidents, guiding the CSIRT lead’s actions in a standardized way. Incorrect — B: Management-level members may influence strategy but formal communication roles are defined in the policy, not delegated ad hoc. Incorrect — C: The lead does not have unilateral authority to decide whom to contact at any time; communications follow the policy and escalation matrices. Incorrect — D: Subject matter experts communicate within their expertise, but the overarching communication plan governs who is notified and when, not just SME discretion.



  PDF
Viewing page 5 of 73
Viewing questions 33 - 40 out of 571 questions


CS0-003 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!