Question 1

Due to an incident involving company devices, an incident responder needs to take a mobile phone to the lab for further investigation. Which of the following tools should be used to maintain the integrity of the mobile phone while it is transported? (Select two)

Options :

A : Signal-shielded bag

B : Tamper-evident seal

C : Thumb drive

D : Crime scene tape

E : Write blocker

F : Drive duplicator

Answer: A,B

Question 2

Which of the following entities should an incident manager work with to ensure correct processes are adhered to when communicating incident reporting to the general public, as a best practice? (Select two).

Options :

A : Law enforcement

B : Governance

C : Legal

D : Manager

E : Public relations

F : Human resources

Answer: C,E

Question 3

A SIEM alert is triggered based on execution of a suspicious one-liner on two workstations in the organization's environment. An analyst views the details of these events below:

Which of the following statements best describes the intent of the attacker, based on this one-liner?

Options :

A : Attacker is escalating privileges via JavaScript.

B : Attacker is utilizing custom malware to download an additional script.

C : Attacker is executing PowerShell script "AccessToken.psr.

D : Attacker is attempting to install persistence mechanisms on the target machine.

Answer: B

Question 4

The security analyst received the monthly vulnerability report. The following findings were included in the

report

• Five of the systems only required a reboot to finalize the patch application.

• Two of the servers are running outdated operating systems and cannot be patched

The analyst determines that the only way to ensure these servers cannot be compromised is to isolate them.

Which of the following approaches will best minimize the risk of the outdated servers being compromised?

Options :

A : Compensating controls

B : Due diligence

C : Maintenance windows

D : Passive discovery

Answer: A

Question 5

A penetration tester submitted data to a form in a web application, which enabled the penetration tester to retrieve user credentials. Which of the following should be recommended for remediation of this application vulnerability?

Options :

A : Implementing multifactor authentication on the server OS

B : Hashing user passwords on the web application

C : Performing input validation before allowing submission

D : Segmenting the network between the users and the web server

Answer: C

Higher Test Marks with Free Online CS0-003 Exam Practice

Buying Options: