A security analyst is monitoring network traffic and notices a series of DNS queries for random subdomains under a single domain. The queries are occurring at a high frequency and from multiple internal hosts. The analyst suspects DNS tunneling. Which pattern recognition technique would best confirm this suspicion?

Check the SIEM for alerts related to the domain.

Compare the DNS query frequency to the number of internal hosts.

Analyze the entropy of the subdomain labels and the volume of DNS queries per host.

Use Wireshark to capture the DNS traffic and look for large TXT records.

An analyst is investigating a phishing email that contains an attachment. The analyst wants to determine if the attachment is malicious without opening it. Which action should the analyst take?

Submit the attachment to VirusTotal and review the detection ratio.

Open the attachment in a text editor to view its contents.

Use the SIEM to check if other users have received the same attachment.

Use Wireshark to capture traffic to the sender's domain.

CompTIACySA+

Domain 1Objective 3

Tools and Techniques CS0-003 Practice Questions (Page 2)

Part of the Security operations domain, which accounts for 33% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~21–36 in this domain), expect 4–7 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

33%of the exam

Questions 6–10

6foundation · easy
A security analyst is writing a Python script to parse a log file and extract IP addresses. Which Python module is most appropriate for this task?
Select an answer first
7expert · hard
A security analyst is monitoring network traffic and notices a series of DNS queries for random subdomains under a single domain. The queries are occurring at a high frequency and from multiple internal hosts. The analyst suspects DNS tunneling. Which pattern recognition technique would best confirm this suspicion?
Select an answer first
8foundation · easy
An analyst is analyzing a suspicious email and wants to check if the sender's domain is legitimate. Which email header field is most important to examine for this purpose?
Select an answer first
9application · easy
An analyst is investigating a phishing email that contains an attachment. The analyst wants to determine if the attachment is malicious without opening it. Which action should the analyst take?
Select an answer first
10foundation · easy
A security analyst wants to use PowerShell to retrieve a list of all running processes on a Windows system to check for suspicious activity. Which PowerShell cmdlet should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.

Tools and Techniques CS0-003 Practice Questions (Page 2)

Questions 6–10

A security analyst is writing a Python script to parse a log file and extract IP addresses. Which Python module is most appropriate for this task?

An analyst is analyzing a suspicious email and wants to check if the sender's domain is legitimate. Which email header field is most important to examine for this purpose?

An analyst is investigating a phishing email that contains an attachment. The analyst wants to determine if the attachment is malicious without opening it. Which action should the analyst take?

A security analyst wants to use PowerShell to retrieve a list of all running processes on a Windows system to check for suspicious activity. Which PowerShell cmdlet should the analyst use?

Keep studying — Security operations