Free CompTIA CyberSecurity Analyst CySA+ Certification Exam CS0-003 Exam Practice Test

A SOC analyst determined that a significant number of the reported alarms could be closed after removing the duplicates. Which of the following could help the analyst reduce the number of alarms with the least effort?

• SOAR
• API
• XDR
• REST

After completing a review of network activity. the threat hunting team discovers a device on the network that sends an outbound email via a mail client to a non-company email address dailyat 10:00 p.m. Which of the following is potentially occurring?

• Irregular peer-to-peer communication
• Rogue device on the network
• Abnormal OS process behavior
• Data exfiltration

A list of loCs released by a government security organization contains the SHA-256 hash for a Microsoft-signed legitimate binary, svchost. exe. Which of the following best describes the result if security teams add this indicator to their detection signatures?

• This indicator would fire on the majority of Windows devices.
• Malicious files with a matching hash would be detected.
• Security teams would detect rogue svchost. exe processes in their environment.
• Security teams would detect event entries detailing execution of known-malicious svchost. exe processes.

A security analyst needs to ensure that systems across the organization are protected based on the sensitivity of the content each system hosts. The analyst is working with the respective systemowners to help determine the best methodology that seeks to promote confidentiality, availability, and integrity of the data being hosted. Which of the following should the security analyst perform first tocategorize and prioritize the respective systems?

• Interview the users who access these systems,
• Scan the systems to see which vulnerabilities currently exist.
• Configure alerts for vendor-specific zero-day exploits.
• Determine the asset value of each system.

A company is in the process of implementing a vulnerability management program. no-lich of the following scanning methods should be implemented to minimize the risk of OT/ICS devices malfunctioning due to the vulnerability identification process?

• Non-credentialed scanning
• Passive scanning
• Agent-based scanning
• Credentialed scanning

An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

• Proprietary systems
• Legacy systems
• Unsupported operating systems
• Lack of maintenance windows

A systems analyst is limiting user access to system configuration keys and values in a Windows environment. Which of the following describes where the analyst can find these configuration items?

• config. ini
• ntds.dit
• Master boot record
• Registry

Which of the following is often used to keep the number of alerts to a manageable level when establishing a process to track and analyze violations?

• Log retention
• Log rotation
• Maximum log size
• Threshold value

A vulnerability scan of a web server that is exposed to the internet was recently completed. A security analyst is reviewing the resulting vector strings:Vulnerability 1: CVSS: 3.0/AV:N/AC: L/PR: N/UI : N/S: U/C: H/I : L/A:LVulnerability 2: CVSS: 3.0/AV: L/AC: H/PR:N/UI : N/S: U/C: L/I : L/A: HVulnerability 3: CVSS: 3.0/AV:A/AC: H/PR: L/UI : R/S: U/C: L/I : H/A:LVulnerability 4: CVSS: 3.0/AV: P/AC: L/PR: H/UI : N/S: U/C: H/I:N/A:LWhich of the following vulnerabilities should be patched first?

• Vulnerability 1
• Vulnerability 2
• Vulnerability 3
• Vulnerability 4

During an incident, analysts need to rapidly investigate by the investigation and leadership teams. Which of the following best describes how PII should be safeguarded during an incident?

• Implement data encryption and close the data so only the company has access.
• Ensure permissions are limited in the investigation team and encrypt the data.
• Implement data encryption and create a standardized procedure for deleting data that is no longer needed.
• Ensure that permissions are open only to the company.