CertBlaze

Comptia

CS0-003 Free Practice Questions — Page 12

Question 66

A third-party assessment of a recent incident determined that the incident response team spent too long trying to get the scope needed for the incident timeline and too much time was spent searching for false positives. Which of the following should the team work on first?

A. Playbook edits
B. Ticket system automation
C. Detection tuning
D. Standard operating procedure refinement
Show Answer
Correct Answer: C
Explanation:
The primary issues were excessive time spent identifying scope and chasing false positives. Detection tuning directly addresses both by improving signal quality, reducing noise, and enabling faster, more accurate incident scoping. Other options are secondary process improvements that depend on having reliable detections first.

Question 67

An analyst reviews the following web server log entries: %2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd No attacks or malicious attempts have been discovered. Which of the following most likely describes what took place?

A. A SQL injection query took place to gather information from a sensitive file.
B. A PHP injection was leveraged to ensure that the sensitive file could be accessed.
C. Base64 was used to prevent the IPS from detecting the fully encoded string.
D. Directory traversal was performed to obtain a sensitive file for further reconnaissance.
Show Answer
Correct Answer: D
Explanation:
The URL-encoded string %2E%2E translates to '..', forming ../../../../../../etc/passwd when decoded. This is a classic directory traversal attempt to access files outside the web root, specifically the sensitive Unix/Linux /etc/passwd file, typically for reconnaissance.

Question 68

An organization performs software assurance activities and reviews some web framework code that uses exploitable jquery modules. Which of the following tools or techniques should the organization use to help identify these issues?

A. Security Content Automation Protocol
B. Application fuzzing
C. Common weakness enumeration
D. Static analysis
Show Answer
Correct Answer: D
Explanation:
Static analysis examines source code without executing it and is well suited for identifying insecure or outdated libraries, such as exploitable jQuery modules, as well as other coding weaknesses. This directly supports software assurance activities focused on reviewing framework code.

Question 69

A security analyst finds an application that cannot enforce the organization’s password policy. An exception is granted. As a compensating control, all users must confirm that their passwords comply with the organization’s policy. Which of the following types of compensating controls is the organization using?

A. Corrective
B. Managerial
C. Technical
D. Detective
Show Answer
Correct Answer: B
Explanation:
Requiring users to attest that their passwords comply with policy is an administrative/procedural measure that relies on policy and user behavior rather than technical enforcement. That makes it a managerial (administrative) compensating control, not corrective, technical, or detective.

Question 70

Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

A. Routing table, registers, physical memory, archival media, hard disk, physical configuration
B. Routing table, registers, physical memory, temporary partition, hard disk, physical configuration
C. Cache, routing table, physical memory, network topology, temporary partition, hard disk
D. Cache, routing table, physical memory, temporary partition, hard disk, physical configuration
Show Answer
Correct Answer: D
Explanation:
The accepted order of volatility in digital forensics ranks data from that which is lost fastest to that which is most persistent. CPU cache is the most volatile, followed by routing tables and other live network data, then physical memory (RAM). Temporary partitions such as swap or page files are less volatile than RAM but more volatile than persistent storage. Hard disks are non‑volatile, and physical configuration (hardware setup, network layout) changes least and is therefore least volatile. This sequence matches option D.

Question 71

A security analyst is working on a server patch management policy that will allow the infrastructure team to be informed more quickly about new patches. Which of the following would most likely be required by the infrastructure team so that vulnerabilities can be remediated quickly? (Choose two.)

A. Hostname
B. Missing KPI
C. CVE details
D. Baseline configuration
E. IoCs
F. npm identifier
Show Answer
Correct Answer: A, C
Explanation:
To remediate vulnerabilities quickly, the infrastructure team needs actionable and targeted information. The hostname identifies exactly which server requires patching so engineers can locate and update it without delay. CVE details provide standardized information about the vulnerability a patch addresses, including severity and impact, allowing proper prioritization and validation of the fix. Other options are either too indirect or unrelated to patch deployment speed.

Question 72

A user is flagged for consistently consuming a high volume of network bandwidth over the past week. During the investigation, the security analyst finds traffic to the following websites: Which of the following data flows should the analyst investigate first?

A. netflix.com
B. youtube.com
C. tiktok.com
D. gmail.com
E. translate.google.com
F. office.com
Show Answer
Correct Answer: D
Explanation:
Gmail traffic is atypical for sustained high-bandwidth usage compared to common streaming sites and is more indicative of potential data exfiltration (e.g., large attachments or automated uploads). Streaming services like Netflix, YouTube, and TikTok commonly generate high bandwidth but are usually benign, making Gmail the highest-priority flow to investigate.

Question 73

An organization has implemented code into a production environment. During a routine test, a penetration tester found that some of the code had a backdoor implemented causing a developer to make changes outside of the change management windows. Which of the following is the best way to prevent this issue?

A. SDLC training
B. Dynamic analysis
C. Debugging
D. Source code review
Show Answer
Correct Answer: D
Explanation:
The core problem is that a backdoor was introduced into production code, bypassing normal controls. The most effective preventative control is a source code review, which can detect unauthorized changes, hidden backdoors, and violations of coding and security standards before deployment. While SDLC training is beneficial, it is indirect and does not reliably prevent malicious or unauthorized code changes. Dynamic analysis and debugging occur later or focus on runtime behavior rather than preventing insertion of backdoors.

Question 74

A WAF weekly report shows that a daily spike occurs from the same subnet. An open-source review indicates the IP addresses belong to a legitimate internet service provider but have been flagged for DDoS attacks and reconnaissance scanning in the past year. Which of the following actions should a SOC analyst take first in response to these traffic uptick activities?

A. Recommend a firewall rule implementation to deny all traffic from the IP subnet.
B. Continue monitoring because the traffic spike did not cause any security notifications or concerns.
C. Review the network logs to identify the context of traffic and what action was taken.
D. Check the resource consumption levels to determine whether the uptick is due to a device performance issue.
Show Answer
Correct Answer: C
Explanation:
The first step is to validate and understand the activity before taking action. Reviewing WAF and network logs provides context on the nature, intent, and impact of the traffic spike, and whether it correlates with malicious behavior. This evidence-based analysis informs appropriate response; blocking immediately risks disrupting legitimate traffic, while ignoring the spike could miss early indicators of attack.

Question 75

HOTSPOT - A healthcare organization must develop an action plan based on the findings from a risk assessment. The action plan must consist of risk categorization and prioritization. INSTRUCTIONS - Click on the audit report and risk matrix to review their contents. Assign a categorization to each risk and determine the order in which the findings must be prioritized for remediation according to the risk rating score. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Illustration for CS0-003 question 75 Illustration for CS0-003 question 75 Illustration for CS0-003 question 75
Show Answer
Correct Answer: 1. A large number of potentially malicious emails is reaching end-user and shared mailboxes. Priority: 1 Risk: High (25) 2. A large volume of ICMP traffic is detected from an external source to Server2. Priority: 2 Risk: High (20) 3. A list of patient prescription information was emailed to the incorrect recipient. Priority: 3 Risk: High (15) 4. PHI data was found within the development and test environments. Priority: 4 Risk: Medium (9) 5. Sensitive materials were found on a fax machine in a common area. Priority: 5 Risk: Medium (6) 6. Unauthorized software was discovered on technician workstations. Priority: 6 Risk: Low (4) 7. The internet-facing web server allows access to data without requiring credentials. Priority: 7 Risk: Low (3) 8. Improperly configured third-party websites pose security risks to internal assets. Priority: 8 Risk: Low (2)
Explanation:
Each risk score is calculated using the risk matrix by multiplying likelihood and severity. Risks are categorized as Low (0–4), Medium (5–9), or High (10–25). Prioritization is based on descending risk score, with the highest scores remediated first.

$19

Get all 528 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full CS0-003 study guide →