CS0-003 Practice Test

CS0-003 Practice Test practice questions, page 12 of 26, with answer review and explanations.

Question 56

A systems administrator is reviewing after-hours traffic flows from data center servers and sees regular, outgoing HTTPS connections from one of the servers to a public IP address. The server should not be making outgoing connections after hours. Looking closer, the administrator sees this traffic pattern around the clock during work hours as well. Which of the following is the most likely explanation?

  1. Command-and-control beaconing activity
  2. Data exfiltration
  3. Anomalous activity on unexpected ports
  4. Network host IP address scanning
  5. A rogue network device

Question 57

New employees in an organization have been consistently plugging in personal webcams despite the company policy prohibiting use of personal devices. The SOC manager discovers that new employees are not aware of the company policy. Which of the following will the SOC manager most likely recommend to help ensure new employees are accountable for following the company policy?

  1. Human resources must email a copy of a user agreement to all new employees
  2. Supervisors must get verbal confirmation from new employees indicating they have read the user agreement
  3. All new employees must take a test about the company security policy during the onboardmg process
  4. All new employees must sign a user agreement to acknowledge the company security policy

Question 58

An analyst has been asked to validate the potential risk of a new ransomware campaign that the Chief Financial Officer read about in the newspaper. The company is a manufacturer of a very small spring used in the newest fighter jet and is a critical piece of the supply chain for this aircraft. Which of the following would be the best threat intelligence source to learn about this new campaign?

  1. Information sharing organization
  2. Blogs/forums
  3. Cybersecurity incident response team
  4. Deep/dark web

Question 59

An incident response team finished responding to a significant security incident. The management team has asked the lead analyst to provide an after-action report that includes lessons learned. Which of the following is the most likely reason to include lessons learned?

  1. To satisfy regulatory requirements for incident reporting
  2. To hold other departments accountable
  3. To identify areas of improvement in the incident response process
  4. To highlight the notable practices of the organization's incident response team

Question 60

A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities: Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system?

  1. InLoud: Cobain: Yes Grohl: No Novo: Yes Smear: Yes Channing: No
  2. TSpirit: Cobain: Yes Grohl: Yes Novo: Yes Smear: No Channing: No
  3. ENameless: Cobain: Yes Grohl: No Novo: Yes Smear: No Channing: No
  4. PBleach: Cobain: Yes Grohl: No Novo: No Smear: No Channing: Yes