최신 CS0-003 무료덤프 - CompTIA Cybersecurity Analyst (CySA+) Certification
Which of the following best explains the importance of the implementation of a secure software development life cycle in a company with an internal development team?
정답: D
설명: (DumpTOP 회원만 볼 수 있음)
A security analyst must assist the IT department with creating a phased plan for vulnerability patching that meets established SLAs.
Which of the following vulnerability management elements will best assist with prioritizing a successful plan?
Which of the following vulnerability management elements will best assist with prioritizing a successful plan?
정답: A
설명: (DumpTOP 회원만 볼 수 있음)
An employee downloads a freeware program to change the desktop to the classic look of legacy Windows.
Shortly after the employee installs the program, a high volume of random DNS queries begin to originate from the system. An investigation on the system reveals the following:
Add-MpPreference -ExclusionPath ' %Program Filest\ksysconfig '
Which of the following is possibly occurring?
Shortly after the employee installs the program, a high volume of random DNS queries begin to originate from the system. An investigation on the system reveals the following:
Add-MpPreference -ExclusionPath ' %Program Filest\ksysconfig '
Which of the following is possibly occurring?
정답: C
설명: (DumpTOP 회원만 볼 수 있음)
A new SOC manager reviewed findings regarding the strengths and weaknesses of the last tabletop exercise in order to make improvements. Which of the following should the SOC manager utilize to improve the process?
정답: B
설명: (DumpTOP 회원만 볼 수 있음)
Which of the following should be updated after a lessons-learned review?
정답: A
설명: (DumpTOP 회원만 볼 수 있음)
During an incident, a security analyst discovers a large amount of Pll has been emailed externally from an employee to a public email address. The analyst finds that the external email is the employee ' s personal email. Which of the following should the analyst recommend be done first?
정답: D
설명: (DumpTOP 회원만 볼 수 있음)
A security analyst identifies a device on which different malware was detected multiple times, even after the systems were scanned and cleaned several times. Which of the following actions would be most effective to ensure the device does not have residual malware?
정답: B
설명: (DumpTOP 회원만 볼 수 있음)
Several reports with sensitive information are being disclosed via file sharing services. The company would like to improve its security posture against this threat. Which of the following security controls would best support the company in this scenario?
정답: B
설명: (DumpTOP 회원만 볼 수 있음)
A systems analyst is limiting user access to system configuration keys and values in a Windows environment.
Which of the following describes where the analyst can find these configuration items?
Which of the following describes where the analyst can find these configuration items?
정답: C
설명: (DumpTOP 회원만 볼 수 있음)
A security analyst is performing an investigation involving multiple targeted Windows malware binaries. The analyst wants to gather intelligence without disclosing information to the attackers. Which of the following actions would allow the analyst to achieve the objective?
정답: A
설명: (DumpTOP 회원만 볼 수 있음)
A web vulnerability scanner has identified many instances of poorly written code that allow for path traversal.
Which of the following is the best option for rewriting the code?
Which of the following is the best option for rewriting the code?
정답: C
설명: (DumpTOP 회원만 볼 수 있음)
An organization has noticed large amounts of data are being sent out of its network. An analyst is identifying the cause of the data exfiltration.
INSTRUCTIONS
Select the command that generated the output in tabs 1 and 2.
Review the output text in all tabs and identify the file responsible for the malicious behavior.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
INSTRUCTIONS
Select the command that generated the output in tabs 1 and 2.
Review the output text in all tabs and identify the file responsible for the malicious behavior.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
정답:
Explanation:
Select the command that generated the output in tab 1:
* netstat -bo
Select the command that generated the output in tab 2:
* tasklist
Identify the file responsible for the malicious behavior:
* cmd.exe
Select the command that generated the output in tab 1: The output in tab 1 displays active network connections, which can be generated using the netstat command with options to display the owning process ID.
Select the command that generated the output in tab 1:
* netstat -bo
Select the command that generated the output in tab 2: The output in tab 2 lists the running processes with their PIDs and memory usage, which can be generated using the tasklist command.
Select the command that generated the output in tab 2:
* tasklist
Identify the file responsible for the malicious behavior: To identify the malicious file, we compare the hashes of the current files against the baseline hashes. From the provided data:
* The hash for cmd.exe in the current state (tab 3) is 372ab227fd5ea779c211a1451881d1e1.
* The baseline hash for cmd.exe (tab 4) is a2cdef1c445d3890cc3456789058cd21.
Since these hashes do not match, cmd.exe is the file responsible for the malicious behavior.