A security operations center (SOC) uses a SIEM platform to monitor network activity. What is the primary purpose of the SIEM's log aggregation capability?

To collect logs from multiple sources into a central repository

To generate real-time alerts for all security events

To store logs for compliance only

To replace the need for individual log analysis

A network analyst is using Wireshark to investigate a potential ARP spoofing attack. The analyst notices multiple ARP replies for the same IP address from different MAC addresses. Which Wireshark feature should the analyst use to quickly identify the source of the spoofing?

Use Statistics > Endpoints to see all MAC addresses and their associated IPs.

Use the Follow TCP Stream feature to see the ARP payload.

Apply a display filter for `arp.duplicate-address-detected` to highlight duplicate IP-to-MAC mappings.

Use Statistics > Conversations to view ARP traffic between hosts.

CompTIACySA+

Domain 1Objective 3

Tools and Techniques CS0-003 Practice Questions (Page 4)

Part of the Security operations domain, which accounts for 33% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~21–36 in this domain), expect 4–7 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

33%of the exam

Questions 16–20

16foundation · easy
A security analyst is using Wireshark to investigate a suspected malware infection. Which Wireshark feature is specifically designed to help the analyst quickly identify suspicious traffic patterns, such as repeated connection attempts or large data transfers?
Select an answer first
17foundation · easy
A security operations center (SOC) uses a SIEM platform to monitor network activity. What is the primary purpose of the SIEM's log aggregation capability?
Select an answer first
18foundation · easy
An analyst is examining network traffic and notices that a specific user account is logging in from a different geographic location at the same time. Which pattern recognition technique is most useful for detecting this potential account compromise?
Select an answer first
19foundation · easy
A security analyst is examining an email that appears to be a phishing attempt. Which part of the email header should the analyst examine to determine the actual originating IP address of the sender?
Select an answer first
20application · medium
A network analyst is using Wireshark to investigate a potential ARP spoofing attack. The analyst notices multiple ARP replies for the same IP address from different MAC addresses. Which Wireshark feature should the analyst use to quickly identify the source of the spoofing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.

Tools and Techniques CS0-003 Practice Questions (Page 4)

Questions 16–20

A security analyst is using Wireshark to investigate a suspected malware infection. Which Wireshark feature is specifically designed to help the analyst quickly identify suspicious traffic patterns, such as repeated connection attempts or large data transfers?

A security operations center (SOC) uses a SIEM platform to monitor network activity. What is the primary purpose of the SIEM's log aggregation capability?

An analyst is examining network traffic and notices that a specific user account is logging in from a different geographic location at the same time. Which pattern recognition technique is most useful for detecting this potential account compromise?

A security analyst is examining an email that appears to be a phishing attempt. Which part of the email header should the analyst examine to determine the actual originating IP address of the sender?

A network analyst is using Wireshark to investigate a potential ARP spoofing attack. The analyst notices multiple ARP replies for the same IP address from different MAC addresses. Which Wireshark feature should the analyst use to quickly identify the source of the spoofing?

Keep studying — Security operations