Free Access to CuramSoftware.CS0-003.v2024-01-19.q203 with Valid Practice Test (Page 28)

Question 131

A new prototype for a company's flagship product was leaked on the internet As a result, the management team has locked out all USB drives Optical drive writers are not present on company computers The sales team has been granted an exception to share sales presentation files with third parties Which of the following would allow the IT team to determine which devices are USB enabled?

A.Asset tagging
B.Device encryption
C.Data loss prevention
D.SIEMIogs

Question 132

An organization recently changed its BC and DR plans. Which of the following would best allow for the incident response team to test the changes without any impact to the business?

A.Perform a tabletop drill based on previously identified incident scenarios.
B.Simulate an incident by shutting down power to the primary data center.
C.Migrate active workloads from the primary data center to the secondary location.
D.Compare the current plan to lessons learned from previous incidents.

Correct Answer: A

Performing a tabletop drill based on previously identified incident scenarios is the best way to test the changes to the BC and DR plans without any impact to the business, as it is a low-cost and low-risk method of exercising the plans and identifying any gaps or issues. A tabletop drill is a type of BC/DR exercise that involves gathering key personnel from different departments and roles and discussing how they would respond to a hypothetical incident scenario. A tabletop drill does not involve any actual simulation or disruption of the systems or processes, but rather relies on verbal communication and documentation review. A tabletop drill can help to ensure that everyone is familiar with the BC/DR plans, that the plans reflect the current state of the organization, and that the plans are consistent and coordinated across different functions. The other options are not as suitable as performing a tabletop drill, as they involve more cost, risk, or impact to the business. Simulating an incident by shutting down power to the primary data center is a type of BC/DR exercise that involves creating an actual disruption or outage of a critical system or process, and observing how the organization responds and recovers. This type of exercise can provide a realistic assessment of the BC/DR capabilities, but it can also cause significant impact to the business operations, customers, and reputation. Migrating active workloads from the primary data center to the secondary location is a type of BC/DR exercise that involves switching over from one system or site to another, and verifying that the backup system or site can support the normal operations. This type of exercise can help to validate the functionality and performance of the backup system or site, but it can also incur high costs, complexity, and potential errors or failures. Comparing the current plan to lessons learned from previous incidents is a type of BC/DR activity that involves reviewing past experiences and outcomes, and identifying best practices or improvement opportunities. This activity can help to update and refine the BC/DR plans, but it does not test or validate them in a simulated or actual scenario

Question 133

Which of the following security operations tasks are ideal for automation?

A.Security application user errors:
Search the error logs for signs of users having trouble with the security application Look up the user's phone number Call the user to help with any questions about using the application
B.Firewall IoC block actions:
Examine the firewall logs for IoCs from the most recently published zero-day exploit Take mitigating actions in the firewall to block the behavior found in the logs Follow up on any false positives that were caused by the block rules
C.Suspicious file analysis:
D.Email header analysis:
Check the email header for a phishing confidence metric greater than or equal to five Add the domain of sender to the block list Move the email to quarantine

Question 134

A technician is analyzing output from a popular network mapping tool for a PCI audit:

Which of the following best describes the output?

A.The host is not up or responding.
B.The host is running excessive cipher suites.
C.The host is allowing insecure cipher suites.
D.The Secure Shell port on this host is closed

Question 135

An analyst discovers unusual outbound connections to an IP that was previously blocked at the web proxy and firewall. Upon further investigation, it appears that the proxy and firewall rules that were in place were removed by a service account that is not recognized. Which of the following parts of the Cyber Kill Chain does this describe?

A.Delivery
B.Command and control
C.Reconnaissance
D.Weaporization

Question 131

Question 132

Question 133

Question 134

Question 135

Download PDF File