A Linux server is suspected of being compromised. The security analyst needs to identify which processes are running, which users are logged in, and what network connections are active. Which commands should the analyst use?

Use 'top', 'df', and 'free' to monitor system resources.

Use 'chmod', 'chown', and 'passwd' to manage permissions and passwords.

Use 'ls', 'cat', and 'grep' to inspect files and logs.

Use 'ps', 'who', and 'netstat' to gather the required information.

A security operations center (SOC) is overwhelmed by the volume of logs from multiple sources. They need to prioritize analysis of the most critical events. Which approach is most effective?

Increase the log retention period to ensure all data is available for future analysis.

Assign a single analyst to manually review all logs in chronological order.

Disable logging for low-priority systems to reduce the volume of data.

Implement a log management platform that correlates events and uses alerting rules to highlight high-risk activities.

A security analyst is reviewing network traffic and notices that a workstation is communicating with an external IP address on port 4444. The analyst suspects a reverse shell. Which action should the analyst take first?

Send a test packet to the external IP to confirm it is responding.

Disable the workstation's network adapter and wait for the user to report issues.

Run a full antivirus scan on the workstation to detect and remove malware.

Block the external IP address at the firewall and isolate the workstation from the network.

CompTIACySA+

Domain 1Objective 1

System and Network Architecture CS0-003 Practice Questions (Page 7)

Part of the Security operations domain, which accounts for 33% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~21–36 in this domain), expect 4–7 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

33%of the exam

Questions 31–33

31application · medium
A Linux server is suspected of being compromised. The security analyst needs to identify which processes are running, which users are logged in, and what network connections are active. Which commands should the analyst use?
Select an answer first
32application · medium
A security operations center (SOC) is overwhelmed by the volume of logs from multiple sources. They need to prioritize analysis of the most critical events. Which approach is most effective?
Select an answer first
33application · medium
A security analyst is reviewing network traffic and notices that a workstation is communicating with an external IP address on port 4444. The analyst suspects a reverse shell. Which action should the analyst take first?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.

System and Network Architecture CS0-003 Practice Questions (Page 7)

Questions 31–33

A Linux server is suspected of being compromised. The security analyst needs to identify which processes are running, which users are logged in, and what network connections are active. Which commands should the analyst use?

A security operations center (SOC) is overwhelmed by the volume of logs from multiple sources. They need to prioritize analysis of the most critical events. Which approach is most effective?

A security analyst is reviewing network traffic and notices that a workstation is communicating with an external IP address on port 4444. The analyst suspects a reverse shell. Which action should the analyst take first?

Keep studying — Security operations