CertBlaze

Comptia

CS0-003 Free Practice Questions — Page 13

Question 121

Which of the following defines the proper sequence of data volatility regarding the evidence collection process, from the most to least volatile?

A. Routing table, registers, physical memory, archival media, hard disk, physical configuration
B. Routing table, registers, physical memory, temporary partition, hard disk, physical configuration
C. Cache, routing table, physical memory, network topology, temporary partition, hard disk
D. Cache, routing table, physical memory, temporary partition, hard disk, physical configuration
Show Answer
Correct Answer: D
Explanation:
The standard order of volatility in digital forensics places CPU cache/registers first, followed by volatile system state such as routing tables and RAM, then less volatile storage such as temporary/swap storage, then persistent disks, and finally relatively static physical configuration. Among the options, D best matches this sequence.

Question 122

A security analyst is working on a server patch management policy that will allow the infrastructure team to be informed more quickly about new patches. Which of the following would most likely be required by the infrastructure team so that vulnerabilities can be remediated quickly? (Choose two.)

A. Hostname
B. Missing KPI
C. CVE details
D. Baseline configuration
E. IoCs
F. npm identifier
Show Answer
Correct Answer: A, C
Explanation:
The infrastructure team needs to know which systems require patching (hostname) and which specific vulnerabilities are being addressed (CVE details) so they can identify affected assets, prioritize remediation, and deploy the appropriate patches. Missing KPI is not a standard patching input, baseline configuration is useful for compliance but not the key information to accelerate patch remediation, IoCs are for threat detection, and an npm identifier is specific to Node.js packages rather than general server patch management.

Question 123

A user is flagged for consistently consuming a high volume of network bandwidth over the past week. During the investigation, the security analyst finds traffic to the following websites: Which of the following data flows should the analyst investigate first?

A. netflix.com
B. youtube.com
C. tiktok.com
D. gmail.com
E. translate.google.com
F. office.com
Show Answer
Correct Answer: D
Explanation:
Investigate gmail.com first because webmail is a common channel for unauthorized data exfiltration. High-bandwidth use involving streaming services (Netflix, YouTube, TikTok) is often benign media consumption, while Office.com is commonly used for legitimate productivity and Google Translate is not typically associated with sustained high-volume transfers. Webmail traffic can indicate large outbound attachments or uploads that warrant immediate review.

Question 124

An organization has implemented code into a production environment. During a routine test, a penetration tester found that some of the code had a backdoor implemented causing a developer to make changes outside of the change management windows. Which of the following is the best way to prevent this issue?

A. SDLC training
B. Dynamic analysis
C. Debugging
D. Source code review
Show Answer
Correct Answer: D
Explanation:
Source code review is the best preventive control for detecting unauthorized or malicious code such as backdoors before deployment. It helps identify code changes that bypass normal processes and is more directly effective against intentionally inserted backdoors than SDLC training. Dynamic analysis tests runtime behavior, and debugging is for troubleshooting rather than preventing malicious code insertion.

Question 125

A WAF weekly report shows that a daily spike occurs from the same subnet. An open-source review indicates the IP addresses belong to a legitimate internet service provider but have been flagged for DDoS attacks and reconnaissance scanning in the past year. Which of the following actions should a SOC analyst take first in response to these traffic uptick activities?

A. Recommend a firewall rule implementation to deny all traffic from the IP subnet.
B. Continue monitoring because the traffic spike did not cause any security notifications or concerns.
C. Review the network logs to identify the context of traffic and what action was taken.
D. Check the resource consumption levels to determine whether the uptick is due to a device performance issue.
Show Answer
Correct Answer: C
Explanation:
The first response should be to investigate by reviewing network and WAF logs to determine the nature, context, and disposition of the traffic. A legitimate ISP subnet may generate benign traffic, and historical reputation alone is insufficient to justify blocking. Reviewing logs reveals whether the traffic is reconnaissance, DDoS-related, normal activity, or already mitigated, informing any subsequent containment actions. Monitoring without investigation is insufficient, and checking resource consumption does not establish the traffic's intent.

Question 126

HOTSPOT - A healthcare organization must develop an action plan based on the findings from a risk assessment. The action plan must consist of risk categorization and prioritization. INSTRUCTIONS - Click on the audit report and risk matrix to review their contents. Assign a categorization to each risk and determine the order in which the findings must be prioritized for remediation according to the risk rating score. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Illustration for CS0-003 question 126 Illustration for CS0-003 question 126 Illustration for CS0-003 question 126
Show Answer
Correct Answer: 1. Patient prescription emailed incorrectly — Priority 3 — High 2. Improperly configured third-party websites — Priority 8 — Low 3. Large ICMP traffic — Priority 2 — High 4. Unauthorized software — Priority 6 — Low 5. Internet-facing web server without credentials — Priority 7 — Low 6. Malicious emails — Priority 1 — High 7. PHI in development/test — Priority 4 — Medium 8. Sensitive materials on fax machine — Priority 5 — Medium
Explanation:
Risk score = likelihood × impact. Categories: Low 0–4, Medium 5–9, High 10–25. Priorities are ordered from highest score to lowest: 25, 20, 15, 9, 6, 4, 3, 2.

Question 127

A security analyst receives an alert with the following packet capture attached: Which of the following has occurred?

A. sslscan reconnaissance
B. A password stuffing attack
C. An Nmap scan
D. An nc reverse shell
Show Answer
Correct Answer: C
Explanation:
A TCP three-way handshake followed immediately by a reset (RST) on a service port is characteristic of a TCP connect scan used by Nmap to determine whether the port is open. It is not indicative of password stuffing, an nc reverse shell, or specifically sslscan reconnaissance.

Question 128

An organization is preparing for a disaster recovery exercise. Which of the following actions should be implemented first?

A. Gather all internal stakeholders and review the actions according to the defined incident playbook.
B. Coordinate the supporting staff for the recovery process to ensure availability at the recovery site.
C. Ensure that the vendor for the disaster recovery site is scheduled to support the recovery.
D. Identify a business-critical system and test by failing over to the disaster recovery location.
Show Answer
Correct Answer: A
Explanation:
Preparation for a disaster recovery exercise begins with ensuring all internal stakeholders understand their roles and the procedures defined in the incident/disaster recovery playbook. Reviewing responsibilities and communication before coordinating logistics or executing failover helps ensure the exercise is conducted consistently and safely. Scheduling vendors, arranging recovery-site staff, and testing failover are subsequent steps once the exercise plan has been reviewed.

Question 129

A security analyst is developing a script to filter firewall vulnerabilities. The script will impact the integrity of data hosted on devices connected to networks. Which of the following is a CVSS v4.0 that the analyst can use to test a true positive for the script?

A. AV:L/AC:H/AT:N/PR:L/VI:H/VC:H/VA:H/SC:N/SI:N/SA:N
B. AV:N/AC:L/AT:N/PR:N/VI:N/VC:N/VA:N/SC:N/SI:H/SA:L
C. AV:P/AC:L/AT:N/PR:H/VI:L/VC:L/VA:L/SC:N/SI:N/SA:N
D. AV:A/AC:L/AT:N/PR:H/VI:N/VC:L/VA:L/SC:N/SI:N/SA:H
Show Answer
Correct Answer: B
Explanation:
In CVSS v4.0, impacts to devices beyond the vulnerable system are represented by the Subsequent System (S*) metrics. The prompt emphasizes integrity of data hosted on devices connected to networks, which maps to Subsequent System Integrity (SI). Option B is the only vector with SI:H and is also network exploitable (AV:N), making it the best fit for a firewall vulnerability affecting connected systems.

Question 130

A security analyst provides the management team with an after action report for a security incident. Which of the following is the management team most likely to review in order to correct validated issues with the incident response processes?

A. Tabletop exercise
B. Lessons learned
C. Root cause analysis
D. Forensic analysis
Show Answer
Correct Answer: B
Explanation:
An after action report is used to identify improvements following an incident. Management reviews the lessons learned to address validated gaps in the incident response process, such as procedural, communication, and coordination issues. Root cause analysis focuses on why the incident occurred, forensic analysis focuses on technical evidence, and a tabletop exercise is a training activity rather than a review artifact.

$19

Get all 534 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full CS0-003 study guide →