Question 1

An analyst is reviewing a vulnerability report and must make recommendations to the executive team. The analyst finds that most systems can be upgraded with a reboot resulting in a single downtime window. However, two of the critical systems cannot be upgraded due to a vendor appliance that the company does not have access to. Which of the following inhibitors to remediation do these systems and associated vulnerabilities best represent?

Options :

A : Proprietary systems

B : Legacy systems

C : Unsupported operating systems

D : Lack of maintenance windows

Answer: B

Question 2

During a recent site survey. an analyst discovered a rogue wireless access point on the network. Which of the following actions should be taken first to protect the network while preserving evidence?

Options :

A : Run a packet sniffer to monitor traffic to and from the access point.

B : Connect to the access point and examine its log files.

C : Identify who is connected to the access point and attempt to find the attacker.

D : Disconnect the access point from the network

Answer: D

Question 3

An analyst has received an IPS event notification from the SIEM stating an IP address, which is known to be malicious, has attempted to exploit a zero-day vulnerability on several web servers. The exploit contained the following snippet: /wp-json/trx_addons/V2/get/sc_layout?sc=wp_insert_user&role=administrator Which of the following controls would work best to mitigate the attack represented by this snippet?

Options :

A : Limit user creation to administrators only.

B : Limit layout creation to administrators only.

C : Set the directory trx_addons to read only for all users.

D : Set the directory v2 to read only for all users.

Answer: A

Question 4

Which of the following best describes the goal of a tabletop exercise?

Options :

A : To test possible incident scenarios and how to react properly

B : To perform attack exercises to check response effectiveness

C : To understand existing threat actors and how to replicate their techniques

D : To check the effectiveness of the business continuity plan

Answer: A

Question 5

Which of the following is an important aspect that should be included in the lessons-learned step after an incident?

Options :

A : Identify any improvements or changes in the incident response plan or procedures

B : Determine if an internal mistake was made and who did it so they do not repeat the error

C : Present all legal evidence collected and turn it over to iaw enforcement

D : Discuss the financial impact of the incident to determine if security controls are well spent

Answer: A

Smartly Prepare Exam with Free Online CS0-003 Practice Test

Buying Options: