Pass CompTIA CySA+ CS0-003 in Just 3 Days – Stress-Free, No Study Needed!
Have questions? Contact us directly on WhatsApp for quick support!
An organization is required to be able to consume multiple threat feeds simultaneously and to provide actionable intelligence to various teams. The organization would also like to be able to leverage the intelligence to enrich security event data. Which of the following functions would most likely help the security analyst meet the organization’s requirements?
- A. Vulnerability management
- B. Risk management
- C. Detection and monitoring
- D. Incident response
A manager asks a security analyst to provide the web-browsing history of an employee. Which of the following should the analyst do first?
- A. Obtain permission to perform the search.
- B. Obtain the web-browsing history from the proxy.
- C. Obtain the employee’s network ID to form the query.
- D. Download the browsing history, encrypt it, and hash it.
A security analyst responds to a series of events surrounding sporadic bandwidth consumption from an endpoint device. The security analyst then identifies the following additional details:
• Bursts of network utilization occur approximately every seven days.
• The content being transferred appears to be encrypted or obfuscated.
• A separate but persistent outbound TCP connection from the host to infrastructure in a third-party cloud is in place.
• The HDD utilization on the device grows by 10GB to 12GB over the course of every seven days.
• Single file sizes are 10GB.
Which of the following describes the most likely cause of the issue?
- A. Memory consumption
- B. Non-standard port usage
- C. Data exfiltration
- D. System update
- E. Botnet participant
Which of the following are important reasons for performing proactive threat-hunting activities? (Choose two.)
- A. To ensure all alerts are fully investigated
- B. To test incident response capabilities
- C. To uncover unknown threats
- D. To allow alerting rules to be more specific
- E. To create a new security baseline
- F. To improve user awareness about security threats
Which of the following are the most likely reasons to include reporting processes when updating an incident response plan after a breach? (Choose two.)
- A. To use the SLA to determine when to deliver the report
- B. To meet regulatory requirements for timely reporting
- C. To limit reputation damage caused by the breach
- D. To remediate vulnerabilities that led to the breach
- E. To isolate potential insider threats
- F. To provide secure network design changes