Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

CompTIA CS0-003 Exam - Topic 3 Question 5 Discussion

During the forensic analysis of a compromised machine, a security analyst discovers some binaries that are exhibiting abnormal behaviors. After extracting the strings, the analyst finds unexpected content. Which of the following is the next step the analyst should take?
A) Validate the binaries' hashes from a trusted source.
B) Use file integrity monitoring to validate the digital signature
C) Run an antivirus against the binaries to check for malware.
D) Only allow binaries on the approve list to execute.

CompTIA CS0-003 Exam - Topic 3 Question 5 Discussion

Actual exam question for CompTIA's CS0-003 exam
Question #: 5
Topic #: 3
[All CS0-003 Questions]

During the forensic analysis of a compromised machine, a security analyst discovers some binaries that are exhibiting abnormal behaviors. After extracting the strings, the analyst finds unexpected content. Which of the following is the next step the analyst should take?

Show Suggested Answer Hide Answer
Suggested Answer: A

Validating the binaries' hashes from a trusted source is the next step the analyst should take after discovering some binaries that are exhibiting abnormal behaviors and finding unexpected content in their strings. A hash is a fixed-length value that uniquely represents the contents of a file or message. By comparing the hashes of the binaries on the compromised machine with the hashes of the original or legitimate binaries from a trusted source, such as the software vendor or repository, the analyst can determine whether the binaries have been modified or replaced by malicious code. If the hashes do not match, it indicates that the binaries have been tampered with and may contain malware.


by Alesia at Jul 28, 2023, 11:16 PM

Limited Time Offer

25%

Off

Get Premium CS0-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Irma
10 months ago
Not sure about these options, feels like there's more to it.
upvoted 0 times
...
Jeanice
10 months ago
Surprised no one mentioned D, whitelisting is super effective!
upvoted 0 times
...
Evangelina
10 months ago
C seems like a quick fix, but it might miss some threats.
upvoted 0 times
...
Leonardo
11 months ago
I think B is better, checking digital signatures is key.
upvoted 0 times
...
Van
11 months ago
Definitely A, validating hashes is crucial.
upvoted 0 times
...
Dante
11 months ago
I vaguely recall something about only allowing approved binaries to execute, but that seems more like a preventive measure than a response to this situation.
upvoted 0 times
...
Georgene
11 months ago
Running an antivirus seems like a good idea, but I feel like we should confirm the binaries' legitimacy first.
upvoted 0 times
...
Yvette
11 months ago
I remember a practice question where we had to check digital signatures first, so maybe option B is the right choice here.
upvoted 0 times
...
Ma
11 months ago
I think validating the binaries' hashes is important, but I'm not sure if that's the immediate next step.
upvoted 0 times
...
Scot
12 months ago
This seems like a straightforward configuration task, but I want to double-check the details to make sure I don't miss anything important.
upvoted 0 times
...
Emerson
12 months ago
Based on my understanding, if the ports aren't responding, that means they're in a closed state, not filtered. The XMAS scan should be able to detect closed ports. I'll double-check that, but I think the answer is C.
upvoted 0 times
...
Gwenn
12 months ago
I remember reading about how consensus algorithms like Proof of Work contribute to security, but I can't recall how they relate to anonymity specifically.
upvoted 0 times
...

Save Cancel