While reviewing web server logs, a security analyst found the following line: <IMG SRC='vbscript:msgbox("test")'> Which of the following malicious activities was attempted?
Correct Answer: D
XSS is a type of web application attack that exploits the vulnerability of a web server or browser to execute malicious scripts or commands on the client-side. XSS attackers inject malicious code, such as JavaScript, VBScript, HTML, or CSS, into a web page or application that is viewed by other users. The malicious code can then access or manipulate the user's session, cookies, browser history, or personal information, or perform actions on behalf of the user, such as stealing credentials, redirecting to phishing sites, or installing malware12 The line in the web server log shows an example of an XSS attack using VBScript. The attacker tried to insert an <IMG> tag with a malicious SRC attribute that contains a VBScript code. The VBScript code is intended to display a message box with the text "test" when the user views the web page or application. This is a simple and harmless example of XSS, but it could be used to test the vulnerability of the web server or browser, or to launch more sophisticated and harmful attacks3
CS0-003 Exam Question 42
Which of the following best describes root cause analysis ?
Correct Answer: B
Root cause analysis (RCA) is a post-incident activity focused on identifying the underlying cause of an incident/problem so the organization can fix the real cause (not just symptoms) and prevent recurrence . That matches Option B , which describes tracing the origin and eliminating it permanently. The Sybex CySA+ Study Guide defines RCA in exactly this way: Exact extract (Sybex Study Guide): "The process of root cause analysis (RCA) is used to identify why a problem, incident, or issue occurred. Root cause analysis is performed to allow organizations to understand what they need to focus on to prevent future problems..." The Secbay Press guide also defines RCA as uncovering underlying causes to prevent recurrence: Exact extract (Secbay Press): "Root Cause Analysis (RCA)... is a systematic investigation process aimed at identifying the fundamental factors that led to a security incident. It goes beyond addressing symptoms and seeks to uncover the underlying causes to prevent recurrence." Why the other options are wrong * A (TTPs): That describes attacker behavior frameworks (e.g., MITRE ATT & CK), not RCA. * C (who/what/when/where/why): That's an incident reporting structure, not the RCA process. * D (ongoing activities report): That resembles status reporting/incident updates, not root cause determination. References (CompTIA CySA+ CS0-003 documents / study guides used): * Mike Chapple & David Seidl, CompTIA CySA+ Study Guide (CS0-003) : RCA identifies why an incident occurred and helps prevent recurrence * Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003) : RCA goes beyond symptoms to uncover underlying causes and prevent recurrence * Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003) : "who/what/when/where/why" belongs to incident reporting context
CS0-003 Exam Question 43
During an incident, a security analyst discovers a large amount of Pll has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee's personal email. Which of the following should the analyst recommend be done first?
Correct Answer: A
Placing a legal hold on the employee's mailbox is the best action to perform first, as it preserves all mailbox content, including deleted items and original versions of modified items, for potential legal or forensic purposes. A legal hold is a feature that allows an administrator to retain mailbox data for a user indefinitely or for a specified period, regardless of the user's actions or retention policies. A legal hold can be applied to a mailbox using Litigation Hold or In-Place Hold in Exchange Server or Exchange Online. A legal hold can help to ensure that evidence of data exfiltration or other malicious activities is not lost or tampered with, and that the organization can comply with any legal or regulatory obligations. The other actions are not as urgent or effective as placing a legal hold on the employee's mailbox, as they do not address the immediate threat of data loss or compromise. Enabling filtering on the web proxy may help to prevent some types of data exfiltration or malicious traffic, but it does not help to recover or preserve the data that has already been emailed externally. Disabling the public email access with CASB (Cloud Access Security Broker) may help to block or monitor the use of public email services by employees, but it does not help to recover or preserve the data that has already been emailed externally. Configuring a deny rule on the firewall may help to block or monitor the network traffic from the employee's laptop, but it does not help to recover or preserve the data that has already been emailed externally.
CS0-003 Exam Question 44
While reviewing the web server logs a security analyst notices the following snippet ..\../..\../boot.ini Which of the following is being attempted?
Correct Answer: A
The log entry "......\boot.ini" is indicative of a directory traversal attack, where an attacker attempts to access files and directories that are stored outside the web root folder. The log snippet "......\boot.ini" is indicative of a directory traversal attack. This type of attack aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with "../" (dot-dot-slash), the attacker may be able to access arbitrary files and directories stored on the file system.
CS0-003 Exam Question 45
A security analyst is viewing a recorded session that captured suspicious activity: scanning 192.168.10.10... scan timing: about 10% done... ... scan completed (4 host up); scanned 4 hosts in 1348 sec. HOSt Port State Service 192.168.10.10 1 closed unknown 192.168.10.20 1 closed unknown 192.168.10.30 1 closed unknown 192.168.10.40 1 closed unknown Which of the following best describes the activity shown?
Correct Answer: D
The scan output where ports are marked as "closed" suggests the use of ahalf-open or SYN scan. In a SYN scan, the scanner sends only the initial SYN packet and does not complete the TCP handshake. If a SYN- ACK is received, the port is open; if a RST is received, it is closed. This scanning method is also referred to as astealth scanand is frequently used to avoid detection. Reference: Mike Chapple, David Seidl,CompTIA CySA+ Practice Tests(Sybex, 2023), p. 376, Question 15: "This image shows a SYN-based port scan..."
