CS0-003 Practice Test

CS0-003 Practice Test practice questions, page 21 of 26, with answer review and explanations.

Question 101

An analyst is examining events in multiple systems but is having difficulty correlating data points. Which of the following is most likely the issue with the system?

  1. Access rights
  2. Network segmentation
  3. Time synchronization
  4. Invalid playbook

Question 102

An analyst recommends that an EDR agent collect the source IP address, make a connection to the firewall, and create a policy to block the malicious source IP address across the entire network automatically. Which of the following is the best option to help the analyst implement this recommendation?

  1. SOAR
  2. SIEM
  3. SLA
  4. IoC

Question 103

An end-of-life date was announced for a widely used OS. A business-critical function is performed by some machinery that is controlled by a PC, which is utilizing the OS that is approaching the end-of-life date. Which of the following best describes a security analyst’s concern?

  1. Any discovered vulnerabilities will not be remediated.
  2. An outage of machinery would cost the organization money.
  3. Support will not be available for the critical machinery.
  4. There are no compensating controls in place for the OS.

Question 104

Which of the following describes the best reason for conducting a root cause analysis?

  1. The root cause analysis ensures that proper timelines were documented.
  2. The root cause analysis allows the incident to be properly documented for reporting.
  3. The root cause analysis develops recommendations to improve the process.
  4. The root cause analysis identifies the contributing items that facilitated the event.

Question 105

Which of the following concepts is using an API to insert bulk access requests from a file into an identity management system an example of?

  1. Command and control
  2. Data enrichment
  3. Automation
  4. Single sign-on