CompTIA CS0-003 Exam Practice Questions (P. 1)
- Full Access (473 questions)
- Six months of Premium Access
- Access to one million comments
- Seamless ChatGPT Integration
- Ability to download PDF files
- Anki Flashcard files for revision
- No Captcha & No AdSense
- Advanced Exam Configuration
Question #1
A recent zero-day vulnerability is being actively exploited, requires no user interaction or privilege escalation, and has a significant impact to confidentiality and integrity but not to availability. Which of the following CVE metrics would be most accurate for this zero-day threat?
- ACVSS:31/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:K/A:L
- BCVSS:31/AV:K/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
- CCVSS:31/AV:N/AC:L/PR:N/UI:H/S:U/C:L/I:N/A:H
- DCVSS:31/AV:L/AC:L/PR:R/UI:R/S:U/C:H/I:L/A:H
send
light_mode
delete
Question #2
Which of the following tools would work best to prevent the exposure of PII outside of an organization?
send
light_mode
delete
Question #3
An organization conducted a web application vulnerability assessment against the corporate website, and the following output was observed:

Which of the following tuning recommendations should the security analyst share?

Which of the following tuning recommendations should the security analyst share?
- ASet an HttpOnly flag to force communication by HTTPS
- BBlock requests without an X-Frame-Options header
- CConfigure an Access-Control-Allow-Origin header to authorized domains
- DDisable the cross-origin resource sharing header
send
light_mode
delete
Question #4
Which of the following items should be included in a vulnerability scan report? (Choose two.)
- ALessons learned
- BService-level agreement
- CPlaybook
- DAffected hosts
- ERisk score
- FEducation plan
send
light_mode
delete
Question #5
The Chief Executive Officer of an organization recently heard that exploitation of new attacks in the industry was happening approximately 45 days after a patch was released. Which of the following would best protect this organization?
- AA mean time to remediate of 30 days
- BA mean time to detect of 45 days
- CA mean time to respond of 15 days
- DThird-party application testing
send
light_mode
delete
Question #6
A security analyst recently joined the team and is trying to determine which scripting language is being used in a production script to determine if it is malicious. Given the following script:

Which of the following scripting languages was used in the script?

Which of the following scripting languages was used in the script?
send
light_mode
delete
Question #7
A company's user accounts have been compromised. Users are also reporting that the company's internal portal is sometimes only accessible through HTTP, other times; it is accessible through HTTPS. Which of the following most likely describes the observed activity?
- AThere is an issue with the SSL certificate causing port 443 to become unavailable for HTTPS access
- BAn on-path attack is being performed by someone with internal access that forces users into port 80
- CThe web server cannot handle an increasing amount of HTTPS requests so it forwards users to port 80
- DAn error was caused by BGP due to new rules applied over the company's internal routers
send
light_mode
delete
Question #8
A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:
Security Policy 1006: Vulnerability Management
1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.
2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.
3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.
According to the security policy, which of the following vulnerabilities should be the highest priority to patch?
Security Policy 1006: Vulnerability Management
1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.
2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.
3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.
According to the security policy, which of the following vulnerabilities should be the highest priority to patch?
- AName: THOR.HAMMER -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Internal System - BName: CAP.SHIELD -
CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
External System - CName: LOKI.DAGGER -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
External System - DName: THANOS.GAUNTLET -
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Internal System
send
light_mode
delete
Question #9
Which of the following will most likely ensure that mission-critical services are available in the event of an incident?
- ABusiness continuity plan
- BVulnerability management plan
- CDisaster recovery plan
- DAsset management plan
send
light_mode
delete
Question #10
The Chief Information Security Officer wants to eliminate and reduce shadow IT in the enterprise. Several high-risk cloud applications are used that increase the risk to the organization. Which of the following solutions will assist in reducing the risk?
- ADeploy a CASB and enable policy enforcement
- BConfigure MFA with strict access
- CDeploy an API gateway
- DEnable SSO to the cloud applications
send
light_mode
delete
All Pages