Online Access Free CS0-003 Practice Test

While a security analyst for an organization was reviewing logs from web servers. the analyst found several successful attempts to downgrade HTTPS sessions to use cipher modes of operation susceptible to padding oracle attacks. Which of the following combinations of configuration changes should the organization make to remediate this issue? (Select two).

• A.Configure the server to require HSTS.
• B.Configure the server to prefer TLS 1.3.
• C.Configure the server to prefer ephemeral modes for key exchange.
• D.Require client browsers to present a user certificate for mutual authentication.
• E.Remove cipher suites that use CBC.
• F.Remove cipher suites that use GCM.

An analyst is reviewing processes running on a Windows host. The analyst reviews the following information:

Which of the following processes should the analyst review first?

• A.768
• B.1100
• C.740
• D.533

A security analyst performs a vulnerability scan on the corporate assets and finds the following vulnerabilities:
System | Vulnerability | CVSS Severity Score
System A | Buffer overflow | 9.5
System B | Remote code execution | 9.8
System C | DDoS | 8.2
System D | XSS | 8.6
The vulnerability manager reviews the analyst's recommendations and asks the analyst to add more information in order to confirm prioritization. Which of the following best explains the reason the manager requests more information?

• A.Existing KPIs were not measured.
• B.Host criticality is unknown.
• C.SLA information is missing.
• D.Zero-day vulnerabilities were excluded.

A security analyst needs to develop a solution to protect a high-value asset from an exploit like a recent zero- day attack. Which of the following best describes this risk management strategy?

• A.Accept
• B.Mitigate
• C.Transfer
• D.Avoid

Which of the following entities must receive reports in a timely fashion according to data breach notification laws related to personally identifiable information?

• A.Service providers and business associates
• B.Law enforcement and the media
• C.Regulators and affected customers
• D.Computer emergency response teams and industry associations