CS0-003 Practice Test 2 — 10 Questions

Question 1

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Correlating DNS query logs with endpoint process and network connection telemetry (Option D) provides direct evidence of command-and-control (C2) beaconing by linking the algorithmically generated domain (AGD) queries to a specific process initiating outbound connections. This cross-referencing validates whether the DNS activity is part of a malware's C2 channel, as legitimate applications rarely generate hundreds of NXDOMAIN responses at fixed intervals. The SOC analyst can confirm the detection by identifying the parent process (e.g., a suspicious executable) and matching its network connections to the queried domains.

Answer

Search only for successful HTTP 200 responses

Answer

Delete the host from the SIEM asset inventory

Answer

Block all DNS traffic from the subnet

Question 2

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts. Option D is correct because it aligns with the SOAR playbook's goal of reducing analyst workload through automated enrichment and triage without taking destructive action. Enriching URLs and detonating attachments in a sandbox provides threat intelligence, while collecting mailbox search counts helps quantify the incident's scope. This non-destructive evidence gathering allows analysts to make informed decisions before any containment or remediation steps.

Answer

Close all similar alerts as duplicates

Answer

Disable the reporting user's account immediately

Answer

Automatically delete all messages from the sender across all mailboxes

Question 3

A phishing detection rule looks only for known malicious URLs and misses newly registered lookalike domains. Which improvements help? (Choose two.)

Accepted Answer

Add domain age and lookalike/typosquatting checks. Option A is correct because phishing detection rules that rely solely on static URL blacklists cannot catch newly registered lookalike domains. By incorporating domain age checks (e.g., domains registered less than 30 days ago are suspicious) and lookalike/typosquatting detection (e.g., using Levenshtein distance or homoglyph analysis), the rule can proactively identify malicious domains that have not yet been reported or blacklisted.

Answer

Allow all newly registered domains

Answer

Trust emails with company logos automatically

Question 4

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans only enumerate open ports and services visible without credentials, missing OS-level patch data such as missing KBs, registry settings, or file versions. Authenticated scans using least-privilege credentials allow the scanner to query the Windows registry, WMI, or WinRM to retrieve the actual installed patch level, providing accurate vulnerability results. For stakeholder management, formal approval (e.g., a signed authorization from system owners or change control board) is required to document the use of privileged credentials, ensuring the program remains defensible in audits.

Answer

Trust the unauthenticated result as complete

Answer

Increase only the port range

Answer

Disable host firewalls permanently

Question 5

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Option A is correct because correlating DNS query logs with endpoint process and network connection telemetry directly validates command-and-control (C2) beaconing. The algorithmically generated domains (AGDs) and NXDOMAIN responses are classic indicators of a domain generation algorithm (DGA) attempting to resolve a C2 server that may be offline or blocked. By linking the DNS queries to specific processes and network connections on the endpoint, the analyst can confirm whether the workstation is executing malicious code that generates these queries, rather than benign software or a false positive.

Answer

Search only for successful HTTP 200 responses

Answer

Block all DNS traffic from the subnet

Answer

Delete the host from the SIEM asset inventory

Question 6

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts. Option B is correct because it describes non-destructive, automated enrichment actions that gather evidence (URL reputation, sandbox analysis, mailbox search counts) without altering systems. This aligns with SOAR best practices for the initial triage phase, where the goal is to reduce analyst workload by providing contextual data while avoiding destructive actions until confirmation of a true positive.

Answer

Disable the reporting user's account immediately

Answer

Close all similar alerts as duplicates

Answer

Automatically delete all messages from the sender across all mailboxes

Question 7

During a post-compromise review, a company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible? which action should be prioritized before closure?

Accepted Answer

Tabletop exercise using a realistic ransomware scenario. A tabletop exercise is the correct choice because it simulates a realistic ransomware scenario in a discussion-based format, allowing legal, PR, IT, and executives to validate their incident response roles and decision-making processes without impacting production systems. This aligns with NIST SP 800-61 Rev. 2 guidance on testing communication and coordination during incident response, ensuring stakeholders understand their responsibilities before a real event.

Answer

Purchasing a new SIEM without testing procedures

Answer

Annual password reset only

Answer

Full destructive malware detonation in production

Question 8

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. Option A is correct because an SLA compliance report by severity, asset owner, and business unit directly maps to the requirement of showing whether critical findings are fixed within policy timelines. This report allows the vulnerability program to track remediation against defined service-level agreements (SLAs), and the breakdown by business unit and asset owner provides the business service owner with actionable, ownership-specific data to drive accountability and resource allocation.

Answer

A report sorted only by scanner plugin ID

Answer

A vendor price comparison

Answer

A list of all closed tickets with no dates

Question 9

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

A software bill of materials. A Software Bill of Materials (SBOM) is a formal, machine-readable inventory (often in SPDX or CycloneDX format) that lists all third-party libraries, their versions, and dependencies. In a regulated environment, this provides the security team with the visibility needed to assess vulnerabilities (e.g., Log4Shell) and ensure compliance with standards like NIST SP 800-53 or FDA cybersecurity guidance. Requesting an SBOM is the standard practice for supply chain risk management.

Answer

A building floor plan

Answer

A password complexity screenshot only

Answer

A DNS MX record report

Question 10

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Office document spawning a script interpreter from a user context. Option D is correct because the scenario describes a classic phishing attack where a malicious macro or embedded script in an Office document (the invoice) executes wscript.exe, a Windows Script Host interpreter, from the user's profile. This detection logic directly correlates the initial vector (Office document) with the suspicious process execution (script interpreter) in the user context, which is a key indicator of malware or unauthorized script activity.

Answer

High CPU usage on the print server

Answer

A password expiry warning

Answer

Successful DHCP renewal