Free Practice Questions for CompTIA CS0-003 Exam

Vulnerability 2 should be prioritized as it is exploitable, has high exploit activity, and is exposed externally according to the SMITTEN metric. References: Vulnerability Management Metrics: 5 Metrics to Start Measuring in Your Program, Section: Vulnerability Severity.

The correct answer is A because CVSS scores alone do not fully determine remediation priority. A vulnerability with a slightly lower CVSS score on a mission-critical system may need to be remediated before a higher-scoring vulnerability on a low-value or isolated system. The missing information is the criticality of the affected hosts/assets.

Exact supporting extract: the CySA+ All-in-One guide states that analysts should consider exploitability, whether a vulnerability is weaponized, patch availability, and asset value and criticality when determining remediation priority. It also explains that analysts must consider the impact to business operations when taking an asset offline for remediation.

The Secbay CySA+ guide also explains that vulnerability prioritization should evaluate severity, exploitability, and the criticality of affected systems. It specifically states that organizations should identify and prioritize vulnerabilities based on the criticality of the assets they affect and consider business operations, data sensitivity, and regulatory compliance.

Why the other options are incorrect:

A is correct because host criticality is required to confirm which vulnerability should be remediated first.

B is incorrect because SLAs define remediation timelines after prioritization, but the question asks what information is needed to confirm prioritization.

C is incorrect because KPIs measure program performance; they do not determine which vulnerable host is most critical.

D is incorrect because nothing in the question indicates these are zero-day vulnerabilities or that zero-days were excluded.

Time synchronization issues can cause severe problems with authentication and logging. If system clocks are not properly synchronized, it can lead to discrepancies in log timestamps, making it difficult to correlate events across different systems. Additionally, time-related discrepancies can affect authentication mechanisms that rely on time-based tokens, such as those used in multifactor authentication, leading to failures and security gaps.

A CASB (Cloud Access Security Broker) is a security solution that acts as an intermediary between cloud users and cloud providers, and monitors and enforces security policies for cloud access and usage. A CASB can help organizations protect their data and applications in the cloud from unauthorized or malicious access, as well as comply with regulatory standards and best practices. A CASB can also provide visibility, control, and analytics for cloud activity, and identify and mitigate potential threats12

The other options are not correct. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that helps email domain owners prevent spoofing and phishing attacks by verifying the sender’s identity and instructing the receiver how to handle unauthenticated messages34 SIEM (Security Information and Event Management) is a security solution that collects, aggregates, and analyzes log data from various sources across an organization’s network, such as applications, devices, servers, and users, and provides real-time alerts, dashboards, reports, and incident response capabilities to help security teams identify and mitigate cyberattacks56 PAM (Privileged Access Management) is a security solution that helps organizations manage and protect the access and permissions of users, accounts, processes, and systems that have elevated or administrative privileges. PAM can help prevent credential theft, data breaches, insider threats, and compliance violations by monitoring, detecting, and preventing unauthorized privileged access to critical resources78

Automatingthe generation of NIDS (Network Intrusion Detection System) rulesbased onStructured Threat Information eXpression (STIX) messagesis apractical use of automationin security operations​.

Option B (Privileged access requests)should involve human oversight due to thehigh risk of unauthorized access.

Option C (PKI identity verification)requires manualdocument verificationandhuman approval.

Option D (Malware analysis)often requiressandboxing and behavioral analysis, which benefit from human expertise.

Thus,A is the correct answer, asautomating threat intelligence ingestion and rule creation enhances efficiency in intrusion detection​.

The lessons learned process is the final stage of the incident management life cycle, where the incident team reviews the incident and evaluates the effectiveness of the response and the plans in place. The lessons learned report should include the who-what-when information and any recommendations for improvement123 References: 1: What is incident management? Steps, tips, and best practices 2: 5 Steps of the Incident Management Lifecycle | RSI Security 3: Navigating the Incident Response Life Cycle: A Comprehensive Guide

The formal incident declaration is crucial to identify and document the staff who have the authority to declare an incident, ensuring that incidents are handled by authorized personnel. References: CompTIA CySA+ Study Guide: Exam CS0-003, 3rd Edition, Chapter 5: Incident Response, page 197.

This command uses a Wireshark display filter (-Y) to show packets that match either HTTP or UDP:

http matches HTTP protocol traffic, which is unencrypted web traffic (i.e., not HTTPS/TLS). To view encrypted web requests (HTTPS), you would need SSL/TLS decryption support and a proper setup (keys, etc.). The All-in-One guide explicitly notes Wireshark/TShark support for SSL/TLS decryption to view encrypted traffic, implying encrypted web traffic isn’t simply “http” unless decrypted and dissected accordingly.

udp matches all UDP traffic, and DNS commonly uses UDP/53, so DNS packets will be included as part of UDP traffic.

Supporting extracts from the All-in-One guide about filtering and web ports (HTTP/HTTPS) and TLS decryption capabilities:

Exact extract (All-in-One Exam Guide):

“Port filters… Example: tcp port 80 or tcp port 443”

Exact extract (All-in-One Exam Guide):

“Support for SSL/TLS decryption to view encrypted traffic”

Therefore: The filter shows unencrypted web (HTTP) traffic and UDP traffic (which includes DNS), making B the best match.

A tabletop exercise is the most likely action that an analyst would perform after an incident has been investigated. A tabletop exercise is a simulation of a potential incident scenario that involves the key stakeholders and decision-makers of the organization. The purpose of a tabletop exercise is to evaluate the effectiveness of the incident response plan, identify the gaps and weaknesses in the plan, and improve the communication and coordination among the incident response team and other parties. A tabletop exercise can help the analyst to learn from the incident investigation, test the assumptions and recommendations made during the investigation, and enhance the preparedness and resilience of the organization for future incidents12. Risk assessment, root cause analysis, and incident response plan are all actions that an analyst would perform before or during an incident investigation, not after. Risk assessment is the process of identifying, analyzing, and evaluating the risks that may affect the organization. Root cause analysis is the method of finding the underlying or fundamental causes of an incident. Incident response plan is the document that defines the roles, responsibilities, procedures, and resources for responding to an incident345. References: Tabletop Exercises: Six Scenarios to Help Prepare Your Cybersecurity Team, Tabletop Exercises for Incident Response - SANS Institute, Risk Assessment - NIST, Root Cause Analysis - OWASP, Incident Response Plan | Ready.gov

The most likely vulnerability in this system is hard-coded credential. Hard-coded credential is a practice of embedding or storing a username, password, or other sensitive information in the source code or configuration file of a system or application. Hard-coded credential can pose a serious security risk, as it can expose the system or application to unauthorized access, data theft, or compromise if the credential is discovered or leaked by an attacker. Hard-coded credential can also make it difficult to change or update the credential if needed, as it may require modifying the code or file and redeploying the system or application.