[Jan 04, 2024] CS0-003 Test Prep Training Practice Exam Questions Practice Tests [Q42-Q64]

NEW QUESTION 42
A company receives a penetration test report summary from a third party. The report summary indicates a proxy has some patches that need to be applied. The proxy is sitting in a rack and is not being used, as the company has replaced it with a new one. The CVE score of the vulnerability on the proxy is a 9.8.
Which of the following best practices should the company follow with this proxy?

Leave the proxy as is.

Decomission the proxy.

Migrate the proxy to the cloud.

Patch the proxy

NEW QUESTION 43
A technician is analyzing output from a popular network mapping tool for a PCI audit:

Which of the following best describes the output?

The host is not up or responding.

The host is running excessive cipher suites.

The host is allowing insecure cipher suites.

The Secure Shell port on this host is closed

NEW QUESTION 44
Joe, a leading sales person at an organization, has announced on social media that he is leaving his current role to start a new company that will compete with his current employer. Joe is soliciting his current employer’s customers. However, Joe has not resigned or discussed this with his current supervisor yet. Which of the following would be the best action for the incident response team to recommend?

Isolate Joe’s PC from the network

Reimage the PC based on standard operating procedures

Initiate a remote wipe of Joe’s PC using mobile device management

Perform no action until HR or legal counsel advises on next steps

NEW QUESTION 45
New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?

Human resources must email a copy of a user agreement to all new employees

Supervisors must get verbal confirmation from new employees indicating they have read the user agreement

All new employees must take a test about the company security policy during the cjitoardmg process

All new employees must sign a user agreement to acknowledge the company security policy

NEW QUESTION 46
An organization has tracked several incidents that are listed in the following table:
Which of the following is the organization’s MTTD?

140

150

160

180

NEW QUESTION 47
A company’s user accounts have been compromised. Users are also reporting that the company’s internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?

There is an issue with the SSL certificate causinq port 443 to become unavailable for HTTPS access

An on-path attack is being performed by someone with internal access that forces users into port 80

The web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80

An error was caused by BGP due to new rules applied over the company’s internal routers

NEW QUESTION 48
A security analyst discovers an LFI vulnerability that can be exploited to extract credentials from the underlying host. Which of the following patterns can the security analyst use to search the web server logs for evidence of exploitation of that particular vulnerability?

/etc/ shadow

curl localhost

; printenv

cat /proc/self/

NEW QUESTION 49
Which of the following concepts is using an API to insert bulk access requests from a file into an identity management system an example of?

Command and control

Data enrichment

Automation

Single sign-on

Automation is the best concept to describe the example, as it reflects the use of technology to perform tasks or processes without human intervention. Automation can help to improve efficiency, accuracy, consistency, and scalability of various operations, such as identity and access management (IAM). IAM is a security framework that enables organizations to manage the identities and access rights of users and devices across different systems and applications. IAM can help to ensure that only authorized users and devices can access the appropriate resources at the appropriate time and for the appropriate purpose. IAM can involve various tasks or processes, such as authentication, authorization, provisioning, deprovisioning, auditing, or reporting.
Automation can help to simplify and streamline these tasks or processes by using software tools or scripts that can execute predefined actions or workflows based on certain triggers or conditions. For example, automation can help to create, update, or delete user accounts in bulk based on a file or a database, rather than manually entering or modifying each account individually. The example in the question shows that an API is used to insert bulk access requests from a file into an identity management system. An API (Application Programming Interface) is a set of rules or specifications that defines how different software components or systems can communicate and exchange data with each other. An API can help to enable automation by providing a standardized and consistent way to access and manipulate data or functionality of a software component or system. The example in the question shows that an API is used to automate the process of inserting bulk access requests from a file into an identity management system, rather than manually entering each request one by one. The other options are not correct, as they describe different concepts or techniques. Command and control is a term that refers to the ability of an attacker to remotely control a compromised system or device, such as using malware or backdoors. Command and control is not related to what is described in the example.
Data enrichment is a term that refers to the process of enhancing or augmenting existing data with additional information from external sources, such as adding demographic or behavioral attributes to customer profiles.
Data enrichment is not related to what is described in the example. Single sign-on is a term that refers to an authentication method that allows users to access multiple systems or applications with one set of credentials, such as using a single username and password for different websites or services. Single sign-on is not related to what is described in the example.

NEW QUESTION 50
A new prototype for a company’s flagship product was leaked on the internet As a result, the management team has locked out all USB drives Optical drive writers are not present on company computers The sales team has been granted an exception to share sales presentation files with third parties Which of the following would allow the IT team to determine which devices are USB enabled?

Asset tagging

Device encryption

Data loss prevention

SIEMIogs

NEW QUESTION 51
A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?

function w() { info=$(ping -c 1 $1 | awk -F “/” ‘END{print $1}’) && echo “$1 | $info” }

function x() { info=$(geoiplookup $1) && echo “$1 | $info” }

function y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo “$1 | $info” }

function z() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }

NEW QUESTION 52
A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools. Which of the following best describes what the security program did?

Data enrichment

Security control plane

Threat feed combination

Single pane of glass

NEW QUESTION 53
An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

Take a snapshot of the compromised server and verify its integrity

Restore the affected server to remove any malware

Contact the appropriate government agency to investigate

Research the malware strain to perform attribution

NEW QUESTION 54
A security analyst receives an alert for suspicious activity on a company laptop An excerpt of the log is shown below:

Which of the following has most likely occurred?

An Office document with a malicious macro was opened.

A credential-stealing website was visited.

A phishing link in an email was clicked

A web browser vulnerability was exploited.

An Office document with a malicious macro was opened is the most likely explanation for the suspicious activity on the company laptop, as it reflects the common technique of using macros to execute PowerShell commands that download and run malware. A macro is a piece of code that can automate tasks or perform actions in an Office document, such as a Word file or an Excel spreadsheet. Macros can be useful and legitimate, but they can also be abused by threat actors to deliver malware or perform malicious actions on the system. A malicious macro can be embedded in an Office document that is sent as an attachment in a phishing email or hosted on a compromised website. When the user opens the document, they may be prompted to enable macros or content, which will trigger the execution of the malicious code. The malicious macro can then use PowerShell, which is a scripting language and command-line shell that is built into Windows, to perform various tasks, such as downloading and running malware from a remote URL, bypassing security controls, or establishing persistence on the system. The log excerpt shows that PowerShell was used to download a string from a URL using the WebClient.DownloadString method, which is a common way to fetch and execute malicious code from the internet. The log also shows that PowerShell was used to invoke an expression (iex) that contains obfuscated code, which is another common way to evade detection and analysis.
The other options are not as likely as an Office document with a malicious macro was opened, as they do not match the evidence in the log excerpt. A credential-stealing website was visited is possible, but it does not explain why PowerShell was used to download and execute code from a URL. A phishing link in an email was clicked is also possible, but it does not explain what happened after the link was clicked or how PowerShell was involved. A web browser vulnerability was exploited is unlikely, as it does not explain why PowerShell was used to download and execute code from a URL.

NEW QUESTION 55
Which of the following statements best describes the MITRE ATT&CK framework?

It provides a comprehensive method to test the security of applications.

It provides threat intelligence sharing and development of action and mitigation strategies.

It helps identify and stop enemy activity by highlighting the areas where an attacker functions.

It tracks and understands threats and is an open-source project that evolves.

It breaks down intrusions into a clearly defined sequence of phases.

NEW QUESTION 56
An analyst is conducting monitoring against an authorized team that win perform adversarial techniques. The analyst interacts with the team twice per day to set the stage for the techniques to be used. Which of the following teams is the analyst a member of?

Orange team

Blue team

Red team

Purple team

The correct answer is A. Orange team.
An orange team is a team that is involved in facilitation and training of other teams in cybersecurity. An orange team assists the yellow team, which is the management or leadership team that oversees the cybersecurity strategy and governance of an organization. An orange team helps the yellow team to understand the cybersecurity risks and challenges, as well as the roles and responsibilities of other teams, such as the red, blue, and purple teams12.
In this scenario, the analyst is conducting monitoring against an authorized team that will perform adversarial techniques. This means that the analyst is observing and evaluating the performance of another team that is simulating real-world attacks against the organization’s systems or networks. This could be either a red team or a purple team, depending on whether they are working independently or collaboratively with the defensive team345.
The analyst interacts with the team twice per day to set the stage for the techniques to be used. This means that the analyst is providing guidance and feedback to the team on how to conduct their testing and what techniques to use. This could also involve setting up scenarios, objectives, rules of engagement, and success criteria for the testing. This implies that the analyst is facilitating and training the team to improve their skills and capabilities in cybersecurity12.
Therefore, based on these descriptions, the analyst is a member of an orange team, which is involved in facilitation and training of other teams in cybersecurity.
The other options are incorrect because they do not match the role and function of the analyst in this scenario.
Option B is incorrect because a blue team is a defensive security team that monitors and protects the organization’s systems and networks from real or simulated attacks. A blue team does not conduct monitoring against an authorized team that will perform adversarial techniques, but rather defends against them345.
Option C is incorrect because a red team is an offensive security team that discovers and exploits vulnerabilities in the organization’s systems or networks by simulating real-world attacks. A red team does not conduct monitoring against an authorized team that will perform adversarial techniques, but rather performs them345.
Option D is incorrect because a purple team is not a separate security team, but rather a collaborative approach between the red and blue teams to improve the organization’s overall security. A purple team does not conduct monitoring against an authorized team that will perform adversarial techniques, but rather works with them345.
References:
1 Infosec Color Wheel & The Difference Between Red & Blue Teams
2 The colors of cybersecurity – UW-Madison Information Technology
3 Red Team vs. Blue Team vs. Purple Team Compared – U.S. Cybersecurity
4 Red Team vs. Blue Team vs. Purple Team: What’s The Difference? | Varonis
5 Red, blue, and purple teams: Cybersecurity roles explained | Pluralsight Blog

NEW QUESTION 57
A security analyst found the following vulnerability on the company’s website:
<INPUT TYPE=”IMAGE” SRC=”javascript:alert(‘test’);”>
Which of the following should be implemented to prevent this type of attack in the future?

Input sanitization

Output encoding

Code obfuscation

Prepared statements

NEW QUESTION 58
A Chief Information Security Officer wants to map all the attack vectors that the company faces each day.
Which of the following recommendations should the company align their security controls around?

OSSTMM

Diamond Model Of Intrusion Analysis

OWASP

MITRE ATT&CK

NEW QUESTION 59
Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:

Which of the following choices should the analyst look at first?

wh4dc-748gy.lan (192.168.86.152)

lan (192.168.86.22)

imaging.lan (192.168.86.150)

xlaptop.lan (192.168.86.249)

p4wnp1_aloa.lan (192.168.86.56)

NEW QUESTION 60
A company creates digitally signed packages for its devices. Which of the following best describes the method by which the security packages are delivered to the company’s customers?

Antitamper mechanism

SELinux

Trusted firmware updates

eFuse

NEW QUESTION 61
A company brings in a consultant to make improvements to its website. After the consultant leaves. a web developer notices unusual activity on the website and submits a suspicious file containing the following code to the security team:

Which of the following did the consultant do?
Implanted a backdoor
Implemented privilege escalation
Implemented clickjacking
Patched the web server

Implanted a backdoor.

A backdoor is a method that allows an unauthorized user to access a system or network without the permission or knowledge of the owner. A backdoor can be installed by exploiting a software vulnerability, by using malware, or by physically modifying the hardware or firmware of the device. A backdoor can be used for various malicious purposes, such as stealing data, installing malware, executing commands, or taking control of the system.
In this case, the consultant implanted a backdoor in the website by using an HTML and PHP code snippet that displays an image of a shutdown button and an alert message that says “Exit”. However, the code also echoes the remote address of the server, which means that it sends the IP address of the visitor to the attacker. This way, the attacker can identify and target the visitors of the website and use their IP addresses to launch further attacks or gain access to their devices.
The code snippet is an example of a clickjacking attack, which is a type of interface-based attack that tricks a user into clicking on a hidden or disguised element on a webpage. However, clickjacking is not the main goal of the consultant, but rather a means to implant the backdoor. Therefore, option C is incorrect.
Option B is also incorrect because privilege escalation is an attack technique that allows an attacker to gain higher or more permissions than they are supposed to have on a system or network. Privilege escalation can be achieved by exploiting a software vulnerability, by using malware, or by abusing misconfigurations or weak access controls. However, there is no evidence that the consultant implemented privilege escalation on the website or gained any elevated privileges.
Option D is also incorrect because patching is a process of applying updates to software to fix errors, improve performance, or enhance security. Patching can prevent or mitigate various types of attacks, such as exploits, malware infections, or denial-of-service attacks. However, there is no indication that the consultant patched the web server or improved its security in any way.
Explanation:
The correct answer is
Reference:
1 What Is a Backdoor & How to Prevent Backdoor Attacks (2023)
2 What is Clickjacking? Tutorial & Examples | Web Security Academy
3 What Is Privilege Escalation and How It Relates to Web Security | Acunetix
4 What Is Patching? | Best Practices For Patch Management – cWatch Blog

NEW QUESTION 62
A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization’s environment. An analyst views the details of these events below:

Which of the following statements best describes the intent of the attacker, based on this one-liner?

Attacker is escalating privileges via JavaScript.

Attacker is utilizing custom malware to download an additional script.

Attacker is executing PowerShell script “AccessToken.psr.

Attacker is attempting to install persistence mechanisms on the target machine.

NEW QUESTION 63
A security analyst performs a vulnerability scan. Based on the metrics from the scan results, the analyst must prioritize which hosts to patch. The analyst runs the tool and receives the following output:

Which of the following hosts should be patched first, based on the metrics?

host01

host02

host03

host04

NEW QUESTION 64
A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user’s workstation, to build the case for the investigation. Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

Create a timeline of events detailinq the date stamps, user account hostname and IP information associated with the activities

Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation

Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identity the case as an HR-related investigation

Notify the SOC manager for awareness after confirmation that the activity was intentional