CS0-003 Exam Questions and Answers | Exam-Dumps.net (Page: 11)

QUESTION: 81

A virtual web server in a server pool was infected with malware after an analyst used the internet to research a system issue. After the server was rebuilt and added back into the server pool, users reported issues with the website, indicating the site could not be trusted.
Which of the following is the most likely cause of the server issue?

The server was configured to use SSL to securely transmit data.
The server was supporting weak TLS protocols for client connections.
The malware infected all the web servers in the pool.
The digital certificate on the web server was self-signed.

Answer(s): D

Reveal Solution Next Question

QUESTION: 82

A zero-day command injection vulnerability was published. A security administrator is analyzing the following logs for evidence of adversaries attempting to exploit the vulnerability:

Which of the following log entries provides evidence of the attempted exploit?

Log entry 1
Log entry 2
Log entry 3
Log entry 4

Answer(s): A

Reveal Solution Next Question

QUESTION: 83

A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts. The analyst is working with the respective system owners to help determine the best methodology that seeks to promote confidentiality, availability, and integrity of the data being hosted.
Which of the following should the security analyst perform first to categorize and prioritize the respective systems?

Interview the users who access these systems.
Scan the systems to see which vulnerabilities currently exist.
Configure alerts for vendor-specific zero-day exploits.
Determine the asset value of each system.

Answer(s): D

Reveal Solution Next Question

QUESTION: 84

A security analyst is reviewing the following alert that was triggered by FIM on a critical system:

Which of the following best describes the suspicious activity that is occurring?

A fake antivirus program was installed by the user.
A network drive was added to allow exfiltration of data.
A new program has been set to execute on system start.
The host firewall on 192.168.1.10 was disabled.

Answer(s): C

Reveal Solution Next Question

QUESTION: 85

Which of the following best describes the document that defines the expectation to network customers that patching will only occur between 2:00 a.m. and 4:00 a.m.?

SLA
LOI
MOU
KPI

Answer(s): A

Reveal Solution Next Question

QUESTION: 86

A cybersecurity analyst is reviewing SIEM logs and observes consistent requests originating from an internal host to a blocklisted external server.
Which of the following best describes the activity that is taking place?

Data exfiltration
Rogue device
Scanning
Beaconing

Answer(s): D

Reveal Solution Next Question

QUESTION: 87

An incident response team is working with law enforcement to investigate an active web server compromise. The decision has been made to keep the server running and to implement compensating controls for a period of time. The web service must be accessible from the internet via the reverse proxy and must connect to a database server.
Which of the following compensating controls will help contain the adversary while meeting the other requirements? (Choose two).

Drop the tables on the database server to prevent data exfiltration.
Deploy EDR on the web server and the database server to reduce the adversary’s capabilities.
Stop the httpd service on the web server so that the adversary cannot use web exploits.
Use microsegmentation to restrict connectivity to/from the web and database servers.
Comment out the HTTP account in the /etc/passwd file of the web server.
Move the database from the database server to the web server.

Answer(s): B,D

Reveal Solution Next Question

QUESTION: 88

An incident response team member is triaging a Linux server. The output is shown below:

Which of the following is the adversary most likely trying to do?

Create a backdoor root account named zsh.
Execute commands through an unsecured service account.
Send a beacon to a command-and-control server.
Perform a denial-of-service attack on the web server.

Answer(s): B

Reveal Solution Next Question

CompTIA CS0-003 Exam (page: 11) CompTIA CySA+ (CS0-003) Updated on: 01-Sep-2025

QUESTION: 81

QUESTION: 82

QUESTION: 83

QUESTION: 84

QUESTION: 85

QUESTION: 86

QUESTION: 87

QUESTION: 88

CompTIA CS0-003 Exam (page: 11)
CompTIA CySA+ (CS0-003)
Updated on: 01-Sep-2025