CompTIA CS0-003 Dumps in PDF and Online - Page: 2

QUESTION: 9

Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

Business continuity plan
Vulnerability management plan
Disaster recovery plan
Asset management plan

Answer(s): A

Explanation:

Option A is correct because a business continuity plan (BCP) explicitly ensures ongoing availability of mission-critical services during and after incidents, outlining recovery strategies, continuity requirements, and operational processes. Incorrect — B: Vulnerability management focuses on identifying and remediating weaknesses, not ensuring service availability during incidents. Incorrect — C: Disaster recovery plan concentrates on restoring IT systems after a disruption, but BCP covers broader organizational continuity beyond IT recovery. Incorrect — D: Asset management plan tracks assets, not continuity or availability of services.

Reveal Solution Next Question

QUESTION: 10

The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high- risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?

Deploy a CASB and enable policy enforcement
Configure MFA with strict access
Deploy an API gateway
Enable SSO to the cloud applications

Answer(s): A

Explanation:

Option A is correct because deploying a CASB (Cloud Access Security Broker) enables visibility, data loss prevention, and policy enforcement over shadow IT by controlling and monitoring cloud app usage across the enterprise. Incorrect — B: MFA with strict access reduces account compromise risk but doesn’t directly control or discover unsanctioned cloud apps. Incorrect — C: API gateway secures APIs but does not address visibility or governance of third-party cloud services. Incorrect — D: SSO simplifies authentication but does not provide policy enforcement or discovery of unsanctioned cloud applications.

Reveal Solution Next Question

QUESTION: 11

An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack. Which of the following logs should the team review first?

CDN
Vulnerability scanner
DNS
Web server

Answer(s): C

Explanation:

Option C is correct because DNS logs can reveal DNS amplification or cache miss patterns, record spikes in query types, and upstream resolver issues typically seen in DDoS affecting external SaaS access. Reviewing DNS may show authoritative name server failures or TTL-based misconfigurations that disrupt SaaS resolution during an outage.
A) CDN logs focus on content delivery performance and edge-cache behavior, not the root cause of external SaaS access disruption.
B) Vulnerability scanner logs pertain to known weaknesses and asset posture, not real-time attack traffic or resolution failures.
D) Web server logs record inbound HTTP requests but may not reflect upstream DNS or global routing issues causing the outage.

Reveal Solution Next Question

QUESTION: 12

A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

Weaponization
Reconnaissance
Delivery
Exploitation

Answer(s): D

Explanation:

Option D is correct because exploitation refers to the stage where the attacker leverages access gained via social engineering to achieve initial foothold and maintain access without triggering immediate loss. A) Weaponization is the pairing of payload with delivery method prior to deployment. B) Reconnaissance involves gathering information about the target before engagement. C) Delivery is the delivery of the weaponized payload to the target. The scenario describes maintaining access after gaining entry, which aligns with exploitation, not the earlier stages.

Reveal Solution Next Question

QUESTION: 13

An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?

Exploitation
Reconnaissance
Command and control
Actions on objectives

Answer(s): B

Explanation:

Option B is correct because scanning external-facing assets from an external IP corresponds to reconnaissance, where an attacker gathers information about targets. Incorrect — A: Exploitation involves leveraging a vulnerability to gain access, not scanning. Incorrect — C: Command and control refers to maintaining remote access and controlling compromised hosts, not initial discovery. Incorrect — D: Actions on objectives describe post-compromise activities to achieve goals, not the information-gathering phase.

Reveal Solution Next Question

QUESTION: 14

An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country. Which of the following best describes what is happening? (Choose two.)

Beaconing
Domain Name System hijacking
Social engineering attack
On-path attack
Obfuscated links
Address Resolution Protocol poisoning

Answer(s): C,E

Explanation:

Option C is correct — social engineering attack: targeted emails to administrators likely aim to manipulate or trick, a classic social engineering technique. Option E is correct — obfuscated links: concealed URL in the email indicates link obfuscation to mislead recipients.
A) Beaconing — incorrect: beaconing refers to periodic signaling from malware to a C2 server, not targeted admin emails.
B) Domain Name System hijacking — incorrect: DNS hijacking involves tampering DNS responses, not concealed URLs in phishing-like emails.
D) On-path attack — incorrect: requires attacker to position itself on communication path (man-in-the-middle), not described here.
F) Address Resolution Protocol poisoning — incorrect: ARP poisoning is local network spoofing, not email-based link concealment.

Reveal Solution Next Question

QUESTION: 15

During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application. Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

Conduct regular red team exercises over the application in production
Ensure that all implemented coding libraries are regularly checked
Use application security scanning as part of the pipeline for the CI/CD flow
Implement proper input validation for any data entry form

Answer(s): C

Explanation:

Option C is correct because integrating application security scanning into the CI/CD pipeline ensures continuous, automated vulnerability detection during each SDLC phase, reducing repeat findings in production and aligning with secure development practices.
A) Incorrect — red team exercises in production assess real-world attacks but don’t address automated, ongoing defect discovery within the SDLC and may not catch root causes early.
B) Incorrect — checking coding libraries helps but does not continuously scan the application’s own code for vulnerabilities throughout the pipeline.
D) Incorrect — input validation is essential but focuses on runtime security controls rather than mitigating recurring vulnerabilities identified by scanners across SDLC.

Reveal Solution Next Question

QUESTION: 16

An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

Proprietary systems
Legacy systems
Unsupported operating systems
Lack of maintenance windows

Answer(s): A

Explanation:

Option A is correct because proprietary systems constrain remediation by vendor access and tooling, preventing timely upgrades for those critical appliances. B is incorrect because legacy systems imply outdated software, not necessarily vendor access constraints. C is incorrect because unsupported OS typically means no vendor updates, whereas the issue here is that access to the vendor-appliance is unavailable. D is incorrect because lack of maintenance windows describes scheduling constraints, not the fundamental barrier of vendor-controlled devices. Correct — proprietary constraints impede remediation despite downtime being feasible for other systems.

Reveal Solution Next Question

CompTIA CySA+ (CS0-003) CS0-003 Dumps in PDF

Free CompTIA CS0-003 Real Questions (page: 2)

QUESTION: 9

Explanation:

QUESTION: 10

Explanation:

QUESTION: 11

Explanation:

QUESTION: 12

Explanation:

QUESTION: 13

Explanation:

QUESTION: 14

Explanation:

QUESTION: 15

Explanation:

QUESTION: 16

Explanation: