CS0-003 Practice Test 12 — 15 Questions

Question 1

Which metric would best indicate the effectiveness of an organization's patch management program?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage directly measures whether patches were applied within the organization's defined remediation windows (for example, critical patches within 14 days), which is the clearest indicator that the patch management program is working as designed. It ties patch deployment outcomes to policy requirements, making it the most direct effectiveness metric.

Answer

Phishing simulation click rates

Answer

Open vulnerability counts by severity

Answer

Mean time to detect (MTTD)

Question 2

During a security incident, a SOC analyst identifies that customer PII has been exfiltrated. The company operates in multiple states and processes EU residents' data. Which of the following is the MOST critical immediate communication requirement?

Accepted Answer

Notify the relevant data protection authority within 72 hours. Notifying the relevant data protection authority within 72 hours is the most critical immediate communication requirement because the GDPR mandates that organizations report personal data breaches to the supervisory authority within 72 hours of becoming aware of the breach, especially when EU residents' data is involved. This is a legal obligation with strict timelines. Other notifications may be required but are not as immediately critical or universally mandated within that timeframe.

Answer

Notify law enforcement within 24 hours

Answer

Notify affected customers within 48 hours

Answer

Issue a press release within 24 hours

Question 3

Which of the following is a key performance indicator (KPI) for measuring the efficiency of patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance % directly measures how efficiently the patch management process meets its defined service-level targets — the percentage of patches applied within the agreed remediation window. This is a process-efficiency KPI because it evaluates the speed and consistency of the patching workflow against a defined benchmark. MTTR measures incident response, not patch throughput, and open vulnerability count reflects exposure rather than process efficiency.

Answer

Mean time to respond (MTTR)

Answer

Number of open vulnerabilities

Answer

Phishing simulation click rate

Question 4

An analyst suspects DNS tunnelling but wants to avoid over-escalating normal CDN behaviour. Which comparisons help? (Choose two.)

Accepted Answer

Baseline query length, entropy, and subdomain uniqueness for the host. DNS tunnelling encodes non-DNS data (e.g., file exfiltration or C2 commands) into DNS queries, often producing abnormally long, high-entropy subdomains. Comparing current query length, entropy, and subdomain uniqueness against a baseline for the same host helps distinguish tunnelling from legitimate CDN traffic, which typically uses short, predictable subdomains. This approach focuses on the structural characteristics of the queries themselves, avoiding false positives from normal CDN behaviour.

Answer

Check whether the user likes the website

Answer

Count the number of icons on the desktop

Question 5

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. The most reliable way to validate whether TLS 1.0 is truly disabled is to perform an active, negotiated test using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to connect using only TLS 1.0. This bypasses any potential misconfiguration in the scanner's service detection or version negotiation logic, and directly confirms whether the server accepts a TLS 1.0 handshake. Relying solely on the scanner's banner grab or the owner's assertion can miss cases where the server still supports the protocol on certain ports or under specific cipher suites.

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Answer

Close the finding because the owner disagrees

Question 6

A SOC analyst is reviewing logs from a web server and sees the following request: GET /../../etc/passwd HTTP/1.1. Which type of web attack is this?

Accepted Answer

Directory traversal. The request GET /../../etc/passwd HTTP/1.1 uses '../' sequences to traverse directories outside the web root, attempting to read the /etc/passwd file. This is the classic signature of a directory traversal (path traversal) attack, which exploits insufficient input validation to access unauthorized files on the server.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)

Question 7

A vulnerability report is going to system owners. Which elements make it actionable? (Choose three.)

Accepted Answer

Affected assets and owners. Identifying affected assets and their owners is essential for accountability and remediation. Without this information, system owners cannot determine which systems require patching or configuration changes, making the report non-actionable. This aligns with the NIST SP 800-40 Rev. 4 guidance on vulnerability management, which emphasizes asset ownership as a prerequisite for response.

Answer

Only a generic statement that risk exists

Question 8

During an active incident, a security analyst discovers that the attacker has exfiltrated data. The analyst must communicate this to the incident response team. Which method of communication is MOST appropriate?

Accepted Answer

Use a predefined secure messaging channel or phone call to escalate. During an active incident, speed and security are critical. A predefined secure messaging channel or phone call ensures immediate, confidential communication without the delays or exposure risks of email or ticketing systems. This aligns with NIST SP 800-61 incident response guidelines, which prioritize real-time, out-of-band communication for sensitive updates.

Answer

Update the incident ticket and wait for the team to review

Answer

Send a detailed email to the incident response team

Answer

Post the information on a public forum for awareness

Question 9

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from an internal IP address. The username used does not exist in Active Directory. The analyst checks the source IP and finds it belongs to a known vulnerability scanner. What classification should the analyst assign to this alert?

Accepted Answer

False positive. A false positive is an alert that fires but does not represent a genuine security incident. Here, the 'failed login' is benign because the source is an authorized vulnerability scanner and the username does not exist — there is no real attacker or compromised account, so the SIEM rule matched on activity that is expected and non-malicious.

Answer

False negative

Answer

True positive

Answer

True negative

Question 10

Which TWO methods help ensure the accuracy of security metrics reported to management?

Accepted Answer

Periodic validation of data against original logs. Periodic validation of security metrics against original logs (e.g., firewall logs, IDS/IPS alerts, or authentication logs) ensures data integrity by detecting discrepancies introduced during aggregation or transformation. This practice aligns with the principle of 'trust but verify,' where raw log sources serve as the authoritative baseline for metric accuracy, preventing reporting of corrupted or incomplete data.

Answer

Using colorful charts to impress stakeholders

Answer

Reporting only positive metrics to maintain confidence

Answer

Manual entry of data from multiple spreadsheets

Question 11

During a vulnerability assessment of a Kubernetes cluster, a security analyst finds that a container is running with privileged mode enabled and has a hostPath mount that grants write access to the host's /var/log directory. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Potential for container escape and host node compromise. A container running in privileged mode with a hostPath mount that grants write access to the host's /var/log directory poses a significant risk of container escape and host node compromise. Privileged mode gives the container almost all capabilities of the host, and the hostPath mount allows direct write access to host files, enabling an attacker to modify system logs, plant malware, or escalate privileges to the host.

Answer

Data leakage through unrestricted storage access

Answer

Excessive network permissions allowing lateral movement

Answer

Increased attack surface due to unnecessary services running in the container

Question 12

A security analyst is creating a Sigma rule to detect suspicious usage of 'schtasks.exe' to create a scheduled task that runs an encoded PowerShell command. Which log source is most appropriate for this rule?

Accepted Answer

Sysmon Event ID 1 (Process creation). Sysmon Event ID 1 captures process creation with rich metadata including the full command line, parent process, hashes, and user context — exactly what's needed to detect 'schtasks.exe' spawning with an encoded PowerShell payload. Sigma rules map to log sources that expose these fields, and Sysmon EID 1 is the canonical source for process-creation-based detections. This lets the rule match on Image, CommandLine, and ParentImage to catch the suspicious pattern.

Answer

Windows Security Event Log (Event ID 4624)

Answer

DNS server log

Answer

Windows PowerShell operational log

Question 13

A security analyst is reviewing a SIEM alert that triggered on a known malicious IP address communicating with an internal server. The analyst checks the threat intelligence feed and confirms the IP is associated with a command-and-control server. What type of alert is this?

Accepted Answer

True positive. A true positive means the alert correctly identified a real malicious event. Here the SIEM flagged communication with a known C2 IP, threat intel confirmed the IP is malicious, and the internal server is genuinely talking to it — so the detection is accurate and the incident is real. This is the textbook definition of a true positive in alert triage.

Answer

False negative

Answer

False positive

Answer

True negative

Question 14

During a memory analysis of a potentially compromised host, a security analyst finds a process with an executable image that is not present on disk. Which technique is most likely being observed?

Accepted Answer

Process hollowing. Process hollowing (a form of process replacement) involves creating a legitimate process in a suspended state, unmapping its original executable image from memory, and writing malicious code into that address space before resuming it. The result is a running process whose in-memory image does not correspond to any executable on disk — exactly the artifact described. This is a classic malware evasion technique used by families such as TrickBot and Emotet.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection

Question 15

Which of the following log sources would be most useful for detecting DNS tunneling?

Accepted Answer

DNS logs. DNS tunneling encodes data inside DNS queries and responses (often in subdomain labels or TXT records), so the authoritative DNS server logs and recursive resolver query logs are the only place where the full query strings are visible. Analyzing DNS logs for high-entropy subdomains, unusual query volume, or long TXT responses is the primary detection method. Firewall, auth, and EDR logs lack the DNS payload detail needed to spot the tunnel.

Answer

Firewall logs

Answer

Authentication logs

Answer

Endpoint EDR logs