CS0-003 Practice Test 10 — 10 Questions

Question 1

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. Option C is correct because the alert indicates a potential account compromise (impossible travel from London to Singapore in 12 minutes) followed by a suspicious mailbox rule creation. The clearest next triage step is to examine sign-in logs for authentication source IPs and timestamps, MFA result to verify if the second factor was passed, device details to check for known or managed devices, and mailbox audit events to confirm who created the forwarding rule and when. This combination directly validates whether the user's credentials were used from two geographically impossible locations and whether the mailbox rule was created by the legitimate user or an attacker.

Answer

Only the user's browser cache

Answer

The organisation's public DNS zone file

Answer

Only DHCP logs from the London office

Question 2

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Office document spawning a script interpreter from a user context. The correct detection logic is 'Office document spawning a script interpreter from a user context' because the scenario describes a classic malware execution chain: a user opens an invoice document (likely a malicious Office file with embedded macros or exploits), which then launches wscript.exe (a Windows Script Host interpreter) from the user's profile. This behavior is a strong indicator of a script-based attack, such as a macro virus or a downloader, and is directly relevant to detection engineering for endpoint security.

Answer

Successful DHCP renewal

Answer

High CPU usage on the print server

Answer

A password expiry warning

Question 3

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

MFA fatigue or push-bombing attack. B is correct because the scenario describes MFA fatigue (also known as push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This is a social engineering technique that exploits human behavior rather than a technical vulnerability in the MFA system itself. The analyst should classify this as an MFA fatigue attack because the user eventually approved a request they did not initiate, which is the hallmark of this attack vector.

Answer

DNS tunnelling

Answer

Password spraying only

Answer

SSL certificate expiry

Question 4

A vulnerability manager wants accurate Linux package findings. Which scan conditions are important? (Choose two.)

Accepted Answer

Authenticated access to inspect installed packages. For accurate Linux package findings, the vulnerability scanner must have authenticated access (e.g., via SSH with valid credentials) to inspect installed packages directly from the package manager database (e.g., RPM or dpkg). Without authentication, the scanner can only perform unauthenticated network-based checks, which cannot reliably determine installed software versions or patch levels. Authenticated access ensures the scanner can execute commands like 'rpm -qa' or 'dpkg -l' to enumerate packages with high accuracy.

Answer

Only scanning ICMP echo replies

Answer

Changing server hostnames randomly

Question 5

A vulnerability dashboard for executives should avoid raw technical overload. Which views are useful? (Choose two.)

Accepted Answer

Critical exposure trend by business service. Option C is correct because executive dashboards must communicate risk in business terms, not technical raw data. A trend of critical exposures by business service translates vulnerability severity into operational impact, enabling prioritization of remediation resources without requiring technical expertise. This aligns with the Reporting and Communication domain's emphasis on tailoring information to the audience.

Answer

A list of scanner process IDs

Answer

Unfiltered plugin-output text

Question 6

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. Option B is correct because the vulnerability is a critical unauthenticated remote-code-execution (RCE) flaw on an internet-facing VPN appliance that is actively exploited in the wild. According to the CVSS scoring system, such a flaw (typically CVSS 9.0–10.0) poses an immediate and severe risk to the organization's perimeter, and remediation must be prioritized over all internal-only medium vulnerabilities. The principle of risk-based prioritization dictates that externally exploitable, actively weaponized vulnerabilities must be patched or mitigated first to prevent a likely breach.

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Start with the oldest medium vulnerability

Answer

Defer all remediation until the monthly patch window

Question 7

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The VPN appliance with a critical unauthenticated remote-code-execution flaw that is actively exploited in the wild represents an immediate and severe risk to the organization's security posture. An internet-facing device with such a vulnerability can be compromised by any attacker on the internet without authentication, leading to full system compromise and potential lateral movement into the internal network. Prioritizing remediation of this flaw over internal-only medium vulnerabilities aligns with risk-based vulnerability management principles, as the likelihood and impact of exploitation are far higher.

Answer

Defer all remediation until the monthly patch window

Answer

Start with the oldest medium vulnerability

Answer

Remediate only low-risk internal findings to improve closure rate

Question 8

After a high-priority SOC escalation, a web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Option C is correct because web-shell activity requires correlating multiple evidence sources: web access logs show the initial malicious request (e.g., a POST to a PHP file with a query parameter like `?cmd=whoami`), file timestamps confirm when the shell was created, process execution logs (e.g., Sysmon Event ID 1) reveal the spawned child processes (e.g., cmd.exe, powershell.exe), and outbound connections from the web service account (e.g., netstat or firewall logs) indicate command-and-control (C2) or data exfiltration. This multi-source correlation aligns with the NIST SP 800-61 incident-response methodology for validating a compromise.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata

Question 9

After a high-priority SOC escalation, a server suspected of running fileless malware is still powered on. Which evidence should be captured first if it is safe to do so? During detection and analysis, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Volatile memory and active network/process state. Volatile memory (RAM) and active network/process state must be captured first because fileless malware resides only in memory and leaves no persistent artifacts on disk. If the system is powered off, this evidence is lost forever. Capturing memory with tools like FTK Imager or LiME and recording network connections (netstat -ano) and running processes (tasklist /v) preserves the malware's execution context for analysis.

Answer

Marketing screenshots

Answer

Archived monthly reports

Answer

The office seating plan

Question 10

A web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Option C is correct because web-shell activity is confirmed by correlating multiple evidence sources: web access logs show the initial exploit request with a query parameter (e.g., ?cmd=whoami), file timestamps reveal the creation of the malicious file, process execution logs (e.g., Sysmon Event ID 1) show cmd.exe or PowerShell spawned by the web service account, and outbound connections from that account indicate command-and-control (C2) traffic. This multi-source correlation is essential to distinguish a web shell from legitimate administrative activity.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata