uC CS0-003 Q1

An incident response report discovers a virus introduced through a remote host connected to corporate resources. A cybersecurity analyst has been asked for a

" recommendation to solve this issue. Which of the following should the cybersecurity analyst apply in the given scenario?

• VPN

• SIEM

• NAC

• MAC

Answer explanation

NAC

Which of the following are the major categories of security event indicators described by NIST 800-61?

Each correct answer represents a complete solution. Choose all that apply.

• Internal and external sources

• Alerts from IDS, IPS, SIEM, AV, and other security systems

• Logs generated by systems, services, and applications

• Exploit developers

Answer explanation

NIST

Which incident response metric measures the time from detection to assessing the event as an incident and activating the process?

• Mean time to respond

• Mean time to detect

• Mean time to remediate

• None of these

Jack received an unknown call from a girl saying she was a customer executive calling from an XYZ bank. She informed Jack that he had won a prize of $2000, and the same amount would be transferred to his account as he is one of the prime customers of this bank. She requested that Jack confirm his debit card details for this amount transfer. In the given scenario, the girl is playing which threat actor role?

• Hacktivist

• Organized crime

• Nation-state

• Insider threat

Joe, an investigator, wants to scan a hard drive to view the deleted communication. Which of the following tools should Joe use to accomplish the given task?

• EnCase

• Helix3

• Wireshark

• FTK

Jordan, a white hat hacker, observes an inaccurate alert triggered by an intrusion prevention system (IPS). Which type of event has occurred in the scenario?

• True negative

• True positive

• False negative

• False positive

Olivia has requested that her development team run their web application security testing tools against their web applications, despite the fact that they just installed the most recent patches. What is this type of testing called?

• Patch validation

• Regression testing

• HTTP checking

• WAV testing

Sasha, the project manager of a computer networking project, is monitoring the performance of her project. She decides to change the project plan to eliminate risks to protect the objectives of the project. Which of the following strategies is she using to tackle the risk in the given scenario?

• Risk avoidance

• Risk transference

• Risk mitigation

• Risk acceptance

What information does a CVSS score provide that will influence administrator's prioritization of patch installation timeframes?

• Risk information

• Patch availability

• A zero-day score

• A MOU analysis

Answer explanation

CVSS Base Scores are a key element of the Common Vulnerability Scoring System (CVSS), providing a standardized measure of a vulnerability’s severity. These scores quantify the inherent traits of a vulnerability, such as how easily it can be exploited and its potential impact. CVSS Base Scores remain constant over time, making them crucial for consistent risk assessment and prioritization in vulnerability management.

A security administrator is constructing a development environment and places three virtual servers in a new virtual network to isolate them from the production network. Which of the following describes the environment that the administrator is building in the given scenario?

• Sandbox

• Snapshot

• Jump box

• Honeypot