A security analyst is reviewing SIEM logs and notices that a single user has logged in from a new geographic location, accessed a large number of files, and then downloaded a database backup. Which pattern recognition technique would best identify this as a potential insider threat?

Clustering analysis to group all users by their login times and file access counts.

Anomaly detection using a static threshold for all users' login frequency.

Signature-based detection matching the user's actions against known attack patterns.

Baseline deviation analysis comparing the user's current activity to their historical behavior.

A SOC analyst is reviewing SIEM alerts and notices that a legitimate internal application is generating a high volume of alerts due to a misconfiguration. The analyst wants to reduce the noise without disabling the rule entirely. Which approach is most effective?

Write a Python script to delete the alerts from the SIEM database.

Create a suppression rule that filters out alerts from the specific application's source IP or hostname.

Disable the SIEM rule until the application is fixed.

Increase the severity of the alerts so they are more noticeable.

An analyst is examining an email that claims to be from a shipping company. The email contains an attachment named 'tracking.zip' and a link to a website. The analyst wants to determine if the email is malicious. Which combination of actions would provide the most comprehensive analysis?

Reply to the sender to ask if the email is legitimate.

Use Wireshark to capture traffic to the link's domain.

Open the attachment to see what it contains.

Analyze the email headers for spoofing indicators and submit the attachment and URL to VirusTotal.

A SOC manager needs to reduce the number of false positives in the SIEM. The current rule triggers on any single failed login followed by a successful login within 5 minutes. The manager wants to reduce noise while still detecting brute-force attacks. Which change to the rule would best achieve this?

Reduce the time window from 5 minutes to 1 minute.

Remove the successful login condition and trigger on any failed login.

Increase the threshold to require at least 10 failed logins from the same source IP before triggering.

Use a Python script to manually review all alerts and delete false positives.

An analyst receives a suspicious email with an attachment named 'invoice.pdf.exe'. The analyst wants to determine if this file is known malware without executing it on the corporate network. Which action should the analyst take?

Upload the file to VirusTotal and review the detection ratio and vendor signatures.

Check the email header to see if the sender's domain is legitimate.

Run the file on the analyst's workstation to see what it does.

Open the file in a sandboxed virtual machine to observe its behavior.

CompTIACySA+

Domain 1Objective 3

Tools and Techniques CS0-003 Practice Questions (Page 5)

Part of the Security operations domain, which accounts for 33% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~21–36 in this domain), expect 4–7 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

33%of the exam

Questions 21–25

21application · medium
A security analyst is reviewing SIEM logs and notices that a single user has logged in from a new geographic location, accessed a large number of files, and then downloaded a database backup. Which pattern recognition technique would best identify this as a potential insider threat?
Select an answer first
22expert · hard
A SOC analyst is reviewing SIEM alerts and notices that a legitimate internal application is generating a high volume of alerts due to a misconfiguration. The analyst wants to reduce the noise without disabling the rule entirely. Which approach is most effective?
Select an answer first
23application · medium
An analyst is examining an email that claims to be from a shipping company. The email contains an attachment named 'tracking.zip' and a link to a website. The analyst wants to determine if the email is malicious. Which combination of actions would provide the most comprehensive analysis?
Select an answer first
24expert · hard
A SOC manager needs to reduce the number of false positives in the SIEM. The current rule triggers on any single failed login followed by a successful login within 5 minutes. The manager wants to reduce noise while still detecting brute-force attacks. Which change to the rule would best achieve this?
Select an answer first
25application · easy
An analyst receives a suspicious email with an attachment named 'invoice.pdf.exe'. The analyst wants to determine if this file is known malware without executing it on the corporate network. Which action should the analyst take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.