CS0-003 Exam Questions and Answers | Exam-Dumps (Page: 4)

QUESTION: 25

A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation.
Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

Create a timeline of events detailing the date stamps, user account hostname and IP information associated with the activities
Ensure that the case details do not reflect any user-identifiable information Password protect the evidence and restrict access to personnel related to the investigation
Create a code name for the investigation in the ticketing system so that all personnel with access will not be able to easily identify the case as an HR-related investigation
Notify the SOC manager for awareness after confirmation that the activity was intentional

Answer(s): B

Reveal Solution Next Question

QUESTION: 26

Which of the following is the first step that should be performed when establishing a disaster recovery plan?

Agree on the goals and objectives of the plan
Determine the site to be used during a disaster
Demonstrate adherence to a standard disaster recovery process
Identify applications to be run during a disaster

Answer(s): A

Reveal Solution Next Question

QUESTION: 27

A technician identifies a vulnerability on a server and applies a software patch.
Which of the following should be the next step in the remediation process?

Testing
Implementation
Validation
Rollback

Answer(s): C

Reveal Solution Next Question

QUESTION: 28

The analyst reviews the following endpoint log entry:

Which of the following has occurred?

Registry change
Rename computer
New account introduced
Privilege escalation

Answer(s): C

Reveal Solution Next Question

QUESTION: 29

A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools.
Which of the following best describes what the security program did?

Data enrichment
Security control plane
Threat feed combination
Single pane of glass

Answer(s): D

Reveal Solution Next Question

QUESTION: 30

Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment. Given the following output:

Which of the following choices should the analyst look at first?

wh4dc-748gy.lan (192.168.86.152)
officerokuplayer.lan (192.168.86.22)
imaging.lan (192.168.86.150)
xlaptop.lan (192.168.86.249)
p4wnp1_aloa.lan (192.168.86.56)

Answer(s): E

Reveal Solution Next Question

QUESTION: 31

When starting an investigation, which of the following must be done first?

Notify law enforcement
Secure the scene
Seize all related evidence
Interview the witnesses

Answer(s): B

Reveal Solution Next Question

QUESTION: 32

Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

The lead should review what is documented in the incident response policy or plan
Management level members of the CSIRT should make that decision
The lead has the authority to decide who to communicate with at any t me
Subject matter experts on the team should communicate with others within the specified area of expertise

Answer(s): A

Reveal Solution Next Question

CompTIA CS0-003 Exam (page: 4) CompTIA CySA+ (CS0-003) Updated on: 12-Jan-2026

QUESTION: 25

QUESTION: 26

QUESTION: 27

QUESTION: 28

QUESTION: 29

QUESTION: 30

QUESTION: 31

QUESTION: 32

CompTIA CS0-003 Exam (page: 4)
CompTIA CySA+ (CS0-003)
Updated on: 12-Jan-2026