CS0-003 Practice Test practice questions, page 23 of 26, with answer review and explanations.
Question 111
A systems administrator receives reports of an internet-accessible Linux server that is running very sluggishly. The administrator examines the server, sees a high amount of memory utilization, and suspects a DoS attack related to half-open TCP sessions consuming memory. Which of the following tools would best help to prove whether this server was experiencing this behavior?
Nmap
TCPDump
SIEM
EDR
Question 112
A security analyst is validating a particular finding that was reported in a web application vulnerability scan to make sure it is not a false positive. The security analyst uses the snippet below: Which of the following vulnerability types is the security analyst validating?
Directory traversal
XSS
XXE
SSRF
Question 113
Which of the following is the most important factor to ensure accurate incident response reporting?
A well-defined timeline of the events
A guideline for regulatory reporting
Logs from the impacted system
A well-developed executive summary
Question 114
A security analyst is trying to detect connections to a suspicious IP address by collecting the packet captures from the gateway. Which of the following commands should the security analyst consider running?
grep [IP address] packets.pcap
cat packets.pcap | grep [IP Address]
tcpdump -n -r packets.pcap host [IP address]
strings packets.pcap | grep [IP Address]
Question 115
A security analyst reviews the latest vulnerability scans and observes there are vulnerabilities with similar CVSSv3 scores but different base score metrics. Which of the following attack vectors should the analyst remediate first?