Online Access Free CS0-003 Exam Questions

A security analyst has received an incident case regarding malware spreading out of control on a customer ' s network. The analyst is unsure how to respond. The configured EDR has automatically obtained a sample of the malware and its signature. Which of the following should the analyst perform next to determine the type of malware, based on its telemetry?

• A.Log in to the affected systems and run necstat.
• B.Configure the EDR to perform a full scan.
• C.Cross-reference the signature with open-source threat intelligence.
• D.Transfer the malware to a sandbox environment.

A security team is concerned about recent Layer 4 DDoS attacks against the company website. Which of the following controls would best mitigate the attacks?

• A.Deploy an IPS in the perimeter network.
• B.Implement a load balancer.
• C.Roll out a CDN.
• D.Block the attacks using firewall rules.

A healthcare organization must develop an action plan based on the findings from a risk assessment. The action plan must consist of risk categorization and prioritization.
INSTRUCTIONS
-
Click on the audit report and risk matrix to review their contents.
Assign a categorization to each risk and determine the order in which the findings must be prioritized for remediation according to the risk rating score.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Correct Answer:

Explanation:
3 High (10-25) - actual score was 15
8 Low (0-4) - actual score was 2
2 High (10-25) - actual score was 20
6 Low (0-4) - actual score was 4
7 Low (0-4) - actual score was 3
1 High (10-25) - actual score was 25
4 Medium (5-9) - actual score was 9
5 Medium (5-9) - actual score was 6

A security analyst reviews a packet capture and identifies the following output as anomalous:
13:49:57.553161 TP10.203.10.17.45701 > 10.203.10.22.12930:Flags[FPU],seq108331482,win1024,urg0, length0
13:49:57.553162 IP10.203.10.17.45701 > 10.203.10.22.48968:Flags[FPU],seq108331482,win1024,urg0, length0
...
Which of the following activities explains the output?

• A.Angry IP Scanner output
• B.Nmap Xmas scan
• C.Socat ' s proxying traffic using the urgent flag
• D.Nikto ' s web scan

An employee accessed a website that caused a device to become infected with invasive malware. The incident response analyst has:
* created the initial evidence log.
* disabled the wireless adapter on the device.
* interviewed the employee, who was unable to identify the website that was accessed
* reviewed the web proxy traffic logs.
Which of the following should the analyst do to remediate the infected device?

• A.Configure the system to use a proxy server for Internet access.
• B.Install an additional malware scanner that will send email alerts to the analyst.
• C.Delete the user profile and restore data from backup.
• D.Update the system firmware and reimage the hardware.