CS0-003 Practice Test

CS0-003 Practice Test practice questions, page 19 of 26, with answer review and explanations.

Question 91

A managed security service provider is having difficulty retaining talent due to an increasing workload caused by a client doubling the number of devices connected to the network. Which of the following would best aid in decreasing the workload without increasing staff?

  1. SIEM
  2. XDR
  3. SOAR
  4. EDR

Question 92

An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

  1. Disable the user’s network account and access to web resources.
  2. Make a copy of the files as a backup on the server.
  3. Place a legal hold on the device and the user’s network share.
  4. Make a forensic image of the device and create a SHA-1 hash.

Question 93

An analyst receives threat intelligence regarding potential attacks from an actor with seemingly unlimited time and resources. Which of the following best describes the threat actor attributed to the malicious activity?

  1. Insider threat
  2. Ransomware group
  3. Nation-state
  4. Organized crime

Question 94

A systems analyst is limiting user access to system configuration keys and values in a Windows environment. Which of the following describes where the analyst can find these configuration items?

  1. config.ini
  2. ntds.dit
  3. Master boot record
  4. Registry

Question 95

While reviewing web server logs, a security analyst found the following line: Which of the following malicious activities was attempted?

  1. Command injection
  2. XML injection
  3. Server-side request forgery
  4. Cross-site scripting