CS0-003 Practice Test 10 — 10 Questions

Question 1

A company is implementing a patch management process. Which of the following steps should be performed FIRST after a vendor releases a security patch for a critical vulnerability?

Accepted Answer

Test the patch in a staging environment that mirrors production. Patches should be tested in a staging environment to ensure they do not break critical business functions before deployment.

Answer

Schedule the patch for the next maintenance window

Answer

Deploy the patch to all production servers immediately

Answer

Create a patch compliance report

Question 2

Which of the following is the primary audience for a strategic threat intelligence report?

Accepted Answer

Executive leadership. Strategic intelligence is high-level and intended for executive leadership to inform business decisions.

Answer

System administrators

Answer

SOC analysts

Answer

Incident responders

Question 3

A vulnerability scanner reports a finding with a CVSS v3.1 base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. What does this indicate about the vulnerability?

Accepted Answer

It has high impact on availability. The vector shows high impact to availability (A:H) and no impact to confidentiality or integrity, so the vulnerability primarily affects availability.

Answer

It has high impact on integrity

Answer

It requires authentication to exploit

Answer

It has high impact on confidentiality

Question 4

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Accepted Answer

Overall risk posture summary. The executive summary should provide a high-level overview, including the overall risk posture and key findings that require management attention. Detailed technical descriptions are better left for the main body.

Answer

Raw CVSS scores for all vulnerabilities

Answer

Detailed technical description of each vulnerability

Answer

Network topology diagrams

Question 5

During a forensic investigation, an analyst needs to acquire disk images from multiple suspect drives. Which THREE practices ensure forensic soundness? (Select THREE)

Accepted Answer

Documenting the chain of custody for each drive. Forensic soundness requires maintaining evidence integrity. Using a verified write blocker prevents alteration. Hashing the original and copy ensures integrity. Documenting the chain of custody maintains accountability.

Answer

Using the fastest available imaging method without verification

Answer

Acquiring the image while the system is running (live acquisition)

Question 6

An organization is experiencing a distributed denial-of-service (DDoS) attack targeting its web servers. The incident response team is implementing containment strategies. Which TWO actions are appropriate for short-term containment of a DDoS attack? (Choose TWO.)

Accepted Answer

Rerouting traffic through a DDoS mitigation service or scrubbing center. Short-term containment for DDoS includes blocking attack traffic at the network perimeter and diverting traffic via a scrubbing center. Patching servers does not stop the attack, and rebuilding is recovery.

Answer

Disabling the accounts of the attackers

Answer

Applying a security patch to the web server software

Answer

Rebuilding the web servers from clean images

Question 7

A security analyst is reviewing the output of a vulnerability scan and sees a finding for a web application that uses a known vulnerable version of Apache Struts. Which TWO of the following actions should the analyst prioritize?

Accepted Answer

Update Apache Struts to the latest patched version. Updating the component to a patched version is the primary remediation. If a patch is not immediately available, a WAF rule can provide temporary protection.

Answer

Remove the Apache Struts component entirely

Answer

Reboot the web server to clear memory

Answer

Disable the web application until further notice

Question 8

A threat intelligence analyst has produced a report containing specific Indicators of Compromise (IoCs) such as IP addresses, domain names, and file hashes. Which TWO audiences are most appropriate for this type of intelligence? (Select TWO.)

Accepted Answer

SOC analysts. Tactical intelligence (IoCs) is most useful for the SOC team and incident responders who can use them for detection and response. Executives need strategic intelligence, and network engineers need operational intelligence.

Answer

Board of directors

Answer

Executive leadership

Answer

Network engineers

Question 9

A security analyst is reviewing IOCs from a threat intelligence feed. The analyst wants to enrich the IOCs using open-source tools. Which THREE tools are commonly used for IOC enrichment? (Select three.)

Accepted Answer

WHOIS. VirusTotal provides file and URL reputation. Shodan gives information about exposed services. WHOIS reveals domain registration details. These are standard enrichment sources.

Answer

Wireshark

Answer

Nmap

Question 10

An analyst is configuring correlation rules in a SIEM. Which TWO data sources are essential for detecting lateral movement using pass-the-hash attacks?

Accepted Answer

Authentication logs (e.g., Windows Event ID 4624). Pass-the-hash involves using NTLM hashes to authenticate. Authentication logs show logon events, and endpoint logs show process creation (e.g., wmic, psexec). Firewall logs may show network connections but are not specific to PtH.

Answer

Firewall logs

Answer

DNS logs

Answer

Vulnerability scan results