CS0-003 Practice Test 12 — 15 Questions

Question 1

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. When a business unit formally accepts the risk of delaying a patch, the risk register must be updated with the owner, justification, expiry date, and compensating controls. This documentation ensures the decision is defensible during audits or incidents, as it captures the explicit risk acceptance and the temporary controls in place until the patch is applied.

Answer

The firewall vendor invoice

Answer

The incident containment playbook only

Answer

The phishing training completion list

Question 2

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant?

Accepted Answer

Office document spawning a script interpreter from a user context. The correct detection logic is 'Office document spawning a script interpreter from a user context' because the scenario describes a classic phishing attack where a malicious macro or embedded script in an invoice document launches wscript.exe (a Windows Script Host interpreter) from the user's profile directory. This behavior is a strong indicator of script-based malware execution, as legitimate Office documents rarely spawn script interpreters directly from user-writable paths. The detection logic specifically targets the parent-child process relationship between an Office application (e.g., WINWORD.EXE, EXCEL.EXE) and wscript.exe, which is a common technique used by attackers to bypass application whitelisting and execute arbitrary code.

Answer

A password expiry warning

Answer

High CPU usage on the print server

Answer

Successful DHCP renewal

Question 3

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Environmental scoring and compensating-control review. Option C is correct because CVSS base scores (like 9.8) do not account for network context or existing security controls. Environmental scoring (CVSS Environmental Metrics) adjusts the base score based on factors like asset criticality and network placement, while a compensating-controls review determines whether firewalls, ACLs, or network segmentation already mitigate the risk. This combined analysis provides the true residual risk for business prioritization.

Answer

Ignore the vulnerability because it is internal

Answer

Change all findings to low severity

Answer

Use only the vendor marketing page

Question 4

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option C is correct because the immediate priority is to restrict public read access to the storage bucket to stop any ongoing unauthorized data exposure. The team must then determine whether sensitive data was accessed by reviewing access logs (e.g., AWS CloudTrail or S3 server access logs) to assess the scope of the breach. This aligns with incident response best practices: contain the threat first, then investigate.

Answer

Delete all audit logs to reduce liability

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Question 5

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. Option C is correct because SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) can break credentialed scans if the scanner's account lacks proper permissions or uses an unsupported authentication method. The best next step is to verify that the scanner's SSH key or password is accepted, that the account has sudo privileges for required commands (e.g., `sudo -n` for non-interactive execution), and that no `sudoers` restrictions block the scanner's commands. This directly addresses the root cause without compromising security.

Answer

Disable SSH on all servers

Answer

Assume the hosts have no vulnerabilities

Answer

Run only unauthenticated scans forever

Question 6

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Environmental scoring and compensating-control review. Option B is correct because CVSS base scores assume a default environment, but an internal service restricted to a trusted admin subnet may have a lower actual risk. Environmental scoring (CVSS v3.1 environmental metrics) adjusts the base score for factors like modified attack vector and modified confidentiality/integrity/availability requirements, while a compensating-control review verifies whether existing controls (e.g., network ACLs, host-based firewalls, VPNs) effectively mitigate the vulnerability. This combined analysis determines if the finding can be downgraded or closed without introducing residual risk.

Answer

Use only the vendor marketing page

Answer

Change all findings to low severity

Answer

Ignore the vulnerability because it is internal

Question 7

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. A deception credential is a deliberately planted fake credential (e.g., a honey token) that no legitimate user should ever use. When it is used to authenticate to a server, it indicates that an attacker has discovered the credential and is attempting to use it for lateral movement or credential access. This is a high-fidelity alert that warrants immediate investigation because it directly signals unauthorized activity.

Answer

The file share requires more storage capacity

Answer

A scheduled password rotation completed successfully

Answer

The SIEM parser is always broken

Question 8

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option A is correct because the immediate priority is to stop the data leak by restricting public read access to the storage bucket, then investigate whether sensitive data was actually accessed. This aligns with the incident response principle of containment before analysis. In cloud environments like AWS S3 or Azure Blob Storage, a bucket with public read access exposes all objects to the internet, and the first step is to apply a bucket policy or ACL to deny public access.

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Answer

Delete all audit logs to reduce liability

Question 9

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Suricata or Snort in IDS mode on a monitored network tap or SPAN port. Suricata or Snort in IDS mode on a monitored network tap or SPAN port is correct because it passively inspects packet payloads against signatures without affecting traffic flow, meeting the requirement to detect exploit traffic and generate alerts without blocking. IDS mode ensures no inline packet drops, while a tap or SPAN port provides full packet visibility for signature matching.

Answer

A vulnerability scanner run once per quarter

Answer

Host-based file integrity monitoring only

Answer

Inline IPS mode with drop rules for all signatures

Question 10

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Container runtime events (e.g., `docker events` or CRI-O logs) capture the unexpected shell execution and host filesystem mount. Kubernetes audit logs record the API calls that initiated the pod, revealing the attacker's initial access vector. Network flow logs from the pod (e.g., via Calico or Cilium) show the outbound connections to the unknown IP, linking the lateral movement to the compromised container. Together, these three telemetry sources provide the complete chain of events needed for root-cause analysis.

Answer

Only user password age reports

Answer

Only physical datacenter access logs

Answer

Only monthly vulnerability scan summaries

Question 11

A Kubernetes audit alert shows a service account creating privileged pods. Which checks are most relevant? (Choose two.)

Accepted Answer

Pod spec fields such as privileged mode, hostPath, and hostNetwork. Option C is correct because privileged pods can bypass container security boundaries, and hostPath or hostNetwork access can lead to host-level compromise. The audit alert specifically flags a service account creating such pods, which violates the principle of least privilege and indicates a potential security incident that requires immediate investigation of the pod spec fields.

Answer

The number of comments in application code

Answer

User profile pictures in the HR system

Question 12

A phishing incident led to credential theft. Which containment actions are appropriate? (Choose two.)

Accepted Answer

Reset affected credentials and revoke active sessions. Option A is correct because immediately resetting compromised credentials and revoking active sessions (e.g., via Azure AD 'Revoke-AzureADUserAllRefreshToken' or Active Directory 'Reset-ADAccountPassword' combined with 'Revoke-AuthenticationTokens') invalidates the attacker's access tokens and session cookies, preventing further lateral movement or data exfiltration. This aligns with the NIST SP 800-61 containment phase, which prioritizes cutting off attacker access while preserving forensic evidence.

Answer

Delete all user mailboxes

Answer

Disable DNS for the entire company indefinitely

Question 13

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option C is correct because the executive summary for legal/privacy stakeholders must focus on business risk, customer impact, remediation status, and remaining exposure. Since no exploitation was found, the summary should communicate the potential regulatory and privacy implications (e.g., GDPR, CCPA) and the steps taken to close the vulnerability, not technical details. This aligns with the CS0-003 objective of tailoring communication to the audience's need for risk-based, non-technical summaries.

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Answer

Raw packet captures from the scan

Question 14

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners require authenticated sessions to crawl and test pages behind login forms. Without session handling (e.g., cookies, tokens), the scanner only sees public content. Configuring authenticated scanning with a test account and proper session management (e.g., OWASP ZAP's session handling rules or Burp Suite's authentication pre-script) allows the scanner to maintain state and reach restricted pages, enabling full coverage of the application's attack surface.

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Answer

Disable all application authentication

Question 15

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. A deception credential that no legitimate user should know being used to authenticate to a server is a classic indicator of credential theft and lateral movement. In the alert triage phase, this finding warrants high-priority investigation because it suggests an attacker has successfully extracted the credential from the file share and is using it to move laterally within the network, which is a critical security incident.

Answer

The SIEM parser is always broken

Answer

A scheduled password rotation completed successfully

Answer

The file share requires more storage capacity