CS0-003 Practice Test

CS0-003 Practice Test practice questions, page 24 of 26, with answer review and explanations.

Question 116

A security analyst must review a suspicious email to determine its legitimacy. Which of the following should be performed? (Choose two.)

  1. Evaluate scoring fields, such as Spam Confidence Level and Bulk Complaint Level
  2. Review the headers from the forwarded email
  3. Examine the recipient address field
  4. Review the Content-Type header
  5. Evaluate the HELO or EHLO string of the connecting email server
  6. Examine the SPF, DKIM, and DMARC fields from the original email

Question 117

A vulnerability analyst received a list of system vulnerabilities and needs to evaluate the relevant impact of the exploits on the business. Given the constraints of the current sprint, only three can be remediated. Which of the following represents the least impactful risk, given the CVSS3.1 base scores?

  1. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L - Base Score 6.0
  2. AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L - Base Score 7.2
  3. AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Base Score 6.4
  4. AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Base Score 6.5

Question 118

A recent vulnerability scan resulted in an abnormally large number of critical and high findings that require patching. The SLA requires that the findings be remediated within a specific amount of time. Which of the following is the best approach to ensure all vulnerabilities are patched in accordance with the SLA?

  1. Integrate an IT service delivery ticketing system to track remediation and closure
  2. Create a compensating control item until the system can be fully patched
  3. Accept the risk and decommission current assets as end of life
  4. Request an exception and manually patch each system

Question 119

Which of the following would help an analyst to quickly find out whether the IP address in a SIEM alert is a known-malicious IP address?

  1. Join an information sharing and analysis center specific to the company's industry
  2. Upload threat intelligence to the IPS in STIX/TAXII format
  3. Add data enrichment for IPs in the ingestion pipeline
  4. Review threat feeds after viewing the SIEM alert

Question 120

An organization was compromised, and the usernames and passwords of all employees were leaked online. Which of the following best describes the remediation that could reduce the impact of this situation?

  1. Multifactor authentication
  2. Password changes
  3. System hardening
  4. Password encryption