Comptia

CS0-003 Free Practice Questions — Page 11

Question 56

The security team reviews a web server for XSS and runs the following Nmap scan: Which of the following most accurately describes the result of the scan?

A. An output of characters > and " as the parameters used in the attempt
B. The vulnerable parameter ID and unfiltered characters returned
C. The vulnerable parameter ID and unfiltered or encoded characters passed > and " as unsafe
D. The vulnerable parameter ID with a SQL Injection attempt
Show Answer
Correct Answer: C
Explanation:
An Nmap XSS script typically reports the vulnerable parameter and shows how special characters like > and " are handled in the server response. The result described indicates that the parameter is identified and that unsafe characters are passed back either unfiltered or encoded, which aligns with detecting an XSS condition rather than SQL injection or merely listing test characters.

Question 57

Which of the following threat-hunting concepts is most concerned with identifying the behaviors of the bad actor?

A. Threat intelligence sharing
B. Indicators of compromise
C. Insider threat analysis
D. Tactics, techniques, and procedures
Show Answer
Correct Answer: D
Explanation:
Tactics, techniques, and procedures (TTPs) focus on how adversaries operate—their methods, behaviors, and patterns of action. Threat hunting that looks for bad-actor behavior is therefore most aligned with analyzing TTPs, rather than static artifacts like indicators of compromise or broader activities like intelligence sharing.

Question 58

Which of the following is the best authentication method to secure access to sensitive data?

A. An assigned device that generates a randomized code for log-in
B. Biometrics and a device with a personalized code for log-in
C. Alphanumeric/special character username and passphrase for log-in
D. A one-time code received by email and push authorization for log-in
Show Answer
Correct Answer: B
Explanation:
The strongest authentication combines multiple independent factors. Option B uses biometrics (something you are) together with a device and personalized code (something you have and/or something you know), providing true multi‑factor authentication. The other options rely on single factors or weaker combinations that are more vulnerable to phishing, credential theft, or interception.

Question 59

Which of the following best explains the importance of the implementation of a secure software development life cycle in a company with an internal development team?

A. Increases the product price by using the implementation as a piece of marketing
B. Decreases the risks of the software usage and complies with regulatory requirements
C. Improves the agile process and decreases the amount of tests before the final deployment
D. Transfers the responsibility for security flaws to the vulnerability management team
Show Answer
Correct Answer: B
Explanation:
A secure software development life cycle integrates security practices throughout design, development, testing, and deployment, which reduces vulnerabilities and operational risk while helping the organization meet regulatory and compliance requirements.

Question 60

SIMULATION - Approximately 100 employees at your company have received a phishing email. As a security analyst, you have been tasked with handling this situation. INSTRUCTIONS - Review the information provided and determine the following: 1. How many employees clicked on the link in the phishing email? 2. On how many workstations was the malware installed? 3. What is the executable file name of the malware? If at any time you would like to bring back the initial state of the simulation. please click the Reset All button.

Illustration for CS0-003 question 60 Illustration for CS0-003 question 60 Illustration for CS0-003 question 60 Illustration for CS0-003 question 60
Show Answer
Correct Answer: 4 1 time.exe
Explanation:
Email server logs show four recipients who later initiated outbound activity consistent with clicking the phishing link. File/Proxy logs indicate only one workstation proceeded to download and execute a suspicious payload. SIEM process-creation events identify the anomalous executable responsible for the infection as time.exe.

Question 61

A security manager has decided to form a special group of analysts who participate in both penetration testing and defending the company's network infrastructure during exercises. Which of the following teams should the group form in order to achieve this goal?

A. Blue team
B. Purple team
C. Red team
D. Green team
Show Answer
Correct Answer: B
Explanation:
Penetration testing is performed by red teams (offensive), while defense is handled by blue teams. A purple team combines and coordinates both functions, enabling analysts to participate in attacking and defending during exercises.

Question 62

A red team engineer discovers that analyzing multiple pieces of less sensitive public information results in knowledge of a sensitive piece of confidential information. Which of the following best describes this security issue?

A. Inference
B. Stored procedure
C. Aggregation
D. Cross-origin resource sharing
Show Answer
Correct Answer: A
Explanation:
The scenario describes deducing a sensitive or confidential fact by analyzing multiple pieces of less sensitive or public information. This is the classic definition of an inference problem. Aggregation refers to the act of combining data, whereas the security issue arises from the ability to infer protected information from that combined analysis.

Question 63

An analyst is reviewing an SSLscan from a web server in an environment: The analyst needs to immediately disable ciphers that do not comply with company security standards. Which of the following ciphers is the least secure and should be disabled?

A. AES128-SHA
B. 128 bits DHE-RSA-AES128-GCM-SHA256 DHE 2048 bits
C. ECDHE-RSA-AES128-SHA Curve 25519 DHE 253
D. ECDHE-RSA-AES256-GCM-SHA384 Curve P-384 DHE 384
E. DES-CBC3-SHA
F. AES256-GCM-SHA384
Show Answer
Correct Answer: E
Explanation:
DES-CBC3-SHA (3DES) is the least secure option listed. It relies on a 64-bit block cipher, making it vulnerable to birthday attacks (e.g., SWEET32), and has been deprecated by modern security standards (NIST, PCI DSS, TLS best practices). The other options use modern AES with GCM or stronger key exchange mechanisms, which are significantly more secure.

Question 64

A company runs a website that allows public posts. Recently, some users report that when visiting the website, pop-ups appear asking the users for their credentials. Which of the following is the most likely cause of this issue?

A. Rootkit
B. SQL injection
C. CSRF
D. XSS
Show Answer
Correct Answer: D
Explanation:
The most likely cause is Cross-Site Scripting (XSS). Because the website allows public posts, an attacker can inject malicious JavaScript into user-generated content. When other users visit the site, the script executes in their browsers and can display fake pop-up login prompts to steal credentials. Rootkits affect systems, not web pages; SQL injection targets backend databases; and CSRF causes unauthorized actions but does not create credential-stealing pop-ups.

Question 65

An analyst wants to detect outdated software packages on a server. Which of the following methodologies will achieve this objective?

A. Data loss prevention
B. Configuration management
C. Common vulnerabilities and exposures
D. Credentialed scanning
Show Answer
Correct Answer: D
Explanation:
Credentialed scanning uses valid authentication to log into the system and enumerate installed software, versions, and patch levels. This visibility allows accurate identification of outdated or unpatched packages. Data loss prevention focuses on protecting sensitive data, configuration management manages desired states rather than actively discovering outdated software, and CVE is a vulnerability catalog rather than a detection methodology.

$19

Get all 528 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.