CS0-003 Sample Questions & Answers

A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:Security Policy 1006: Vulnerability Management1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.According to the security policy, which of the following vulnerabilities should be the highest priority to patch?

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

A security analyst is reviewing a new cloud architecture proposal that utilizes a dedicated secure access layer to connect users to applications. The architecture combines SD-WAN capabilities with comprehensive security functions such as SWG, CASB, FWaaS, and ZTNA, delivered primarily as a service. Which of the following terms BEST describes this architecture?

During a vulnerability scan analysis, an analyst identifies a critical finding on a legacy server. The vulnerability allows remote code execution (RCE) but requires the attacker to have an existing low-privileged user account on the system. The server is located in a segmented VLAN with no direct internet access. When calculating the CVSS v3.1 score to prioritize this vulnerability, which Attack Vector (AV) metric should be selected?

A SOC analyst is investigating a suspicious process on a Windows endpoint. The process svchost.exe is initiating outbound connections to an external IP address on port 4444. The analyst runs Get-Process in PowerShell and notices the process has no parent ID link to services.exe and is running from C:\Temp. Which phase of the Cyber Kill Chain is MOST likely being observed?

An organization is preparing its quarterly executive security report. The CISO requests a metric that best communicates the efficiency of the security team in neutralizing confirmed threats once they are detected. Which of the following KPIs should be highlighted?

A security analyst is writing a Python script to parse a large volume of JSON logs from a web application firewall. The goal is to identify IP addresses that have triggered more than 100 SQL injection alerts in the last hour. Which of the following logical structures would be MOST appropriate for this task?

A company is adopting a DevSecOps model. The security team wants to implement a control that automatically checks for hardcoded credentials in the source code before it can be merged into the main branch. Which type of tool should be integrated into the CI/CD pipeline?

While analyzing a PCAP file from a suspected data exfiltration incident, an analyst observes the following sequence of packets:

1. Client sends SYN to Server Port 443
2. Server sends SYN-ACK to Client
3. Client sends ACK to Server
4. Client sends TLS Client Hello
5. Server sends TLS Server Hello
6. Client sends 15GB of UDP traffic to Server Port 53

What is the MOST likely technique being used for exfiltration?

A security analyst is reviewing the logs of a web application and notices the following URL request:
https://example.com/search?query= alert(document.cookie)
Which vulnerability is the attacker attempting to exploit?

Which of the following containment strategies is MOST appropriate when a critical production database server is confirmed to be infected with ransomware, but the encryption process has not yet completed?

Case Study: GlobalTech Corp has recently acquired a smaller startup. The startup uses a hybrid cloud environment with AWS and on-premise servers. During the integration, GlobalTech's security team discovers that the startup has no centralized logging and uses shared root accounts for AWS management.

Which of the following immediate actions should the security team prioritize to improve the security posture? (Select TWO)

True or False: In a Zero Trust Architecture, a user who has successfully authenticated via MFA to the VPN is automatically trusted to access all internal applications without further verification.

A security analyst is reviewing a vulnerability scan report for a fleet of IoT devices. The scan indicates that the devices are using a deprecated version of the SSH protocol (v1). Why is this considered a high-risk vulnerability?