CS0-003 Practice Questions

A cybersecurity analyst is doing triage in a SIEM and notices that the time stamps between the firewall and the host under investigation are off by 43 minutes. Which of the following is the most likely scenario occurring with the time stamps?

Which of the following entities must receive reports in a timely fashion according to data breach notification laws related to personally identifiable information?

A security analyst reviews the following Arachni scan results for a web application that stores PII data:

Which of the following should be remediated first?

A security operations center receives the following alerts related to an organization's cloud tenant:

Which of the following should an analyst do first to identify the initial compromise?

After conducting a cybersecurity risk assessment for a new software request, a Chief Information Security Officer (CISO) decided the risk score would be too high. The CISO refused the software request. Which of the following risk management principles did the CISO select?

After completing a review of network activity. the threat hunting team discovers a device on the network that sends an outbound email via a mail client to a non-company email address daily

at 10:00 p.m. Which of the following is potentially occurring?

A security operations center analyst is using the command line to display specific traffic. The analyst uses the following command:

tshark -r file.pcap -Y "http or udp"

Which of the following will the command line display?

A company recently experienced a security incident. The security team has determined

a user clicked on a link embedded in a phishing email that was sent to the entire company. The link resulted in a malware download, which was subsequently installed and run.

INSTRUCTIONS

Part 1

Review the artifacts associated with the security incident. Identify the name of the malware, the malicious IP address, and the date and time when the malware executable entered the organization.

Part 2

Review the kill chain items and select an appropriate control for each that would improve the security posture of the organization and would have helped to prevent this incident from occurring. Each

control may only be used once, and not all controls will be used.

Firewall log:

File integrity Monitoring Report:

Malware domain list:

Vulnerability Scan Report:

Phishing Email:

An organization has tracked several incidents that are listed in the following table:

Which of the following is the organization's MTTD?

An analyst is evaluating the following vulnerability report:

Which of the following vulnerability report sections provides information about the level of impact on data confidentiality if a successful exploitation occurs?