CS0-003 Practice Test 12 — 15 Questions

Question 1

A security analyst is conducting a dynamic application security testing (DAST) scan of a REST API. The scanner reports a potential Server-Side Request Forgery (SSRF) vulnerability. The analyst needs to confirm the finding manually. Which TWO of the following techniques are most appropriate for validating SSRF?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Submit a payload that triggers the server to send a request to an attacker-controlled external server (e.g., Burp Collaborator). SSRF can be confirmed by making requests to internal resources (e.g., localhost) and observing responses, or by using an external collaborator service to detect out-of-band callbacks.

Answer

Inject malicious SQL queries into input fields to see if they are executed

Answer

Attempt to upload a malicious file to the server

Answer

Modify HTTP headers to test for cross-site scripting

Question 2

A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)

Accepted Answer

Recent access review reports. Access review reports and user account audit logs directly demonstrate access control implementation.

Answer

A network topology diagram

Answer

A list of all employees

Answer

The company's password policy

Question 3

A security analyst is collecting evidence for an upcoming compliance audit. Which three types of evidence are typically required? (Select THREE.)

Accepted Answer

Access review documentation. Auditors typically require log exports, vulnerability scan reports, and access reviews to verify controls.

Answer

Employee training attendance records

Answer

Marketing brochures

Question 4

Which three of the following are effective techniques for prioritizing vulnerabilities for remediation in a vulnerability management program? (Choose three.)

Accepted Answer

Correlating vulnerabilities with active exploit campaigns and threat intelligence feeds. Correlating vulnerabilities with active exploit campaigns and threat intelligence feeds is effective because it prioritizes vulnerabilities that are currently being exploited in the wild, which directly reduces the risk of a breach. This approach aligns remediation with real-world attacker behavior rather than theoretical severity.

Answer

Prioritizing vulnerabilities based solely on the age of the CVE

Answer

Focusing remediation efforts exclusively on vulnerabilities with a CVSS score of 9.0 or higher

Answer

Applying the Common Vulnerability Scoring System (CVSS) base score as the sole prioritization metric

Question 5

An analyst is creating a YARA rule to detect a specific malware family that uses the string 'evil' in its PE file. Which of the following rule structures is correct?

Accepted Answer

rule detect_malware { strings: $a = "evil" condition: $a }. The standard YARA rule structure includes rule name, meta section, strings section, and condition section. The condition must reference the string.

Answer

rule detect_malware { strings: "evil" condition: $a }

Answer

rule detect_malware { condition: $a = "evil" }

Answer

if "evil" in file then alert

Question 6

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Accepted Answer

Explain the potential financial loss and reputational damage.. Boards care about business impact, not technical details. Quantifying financial exposure helps them understand urgency.

Answer

Show the CVSS score and exploit complexity.

Answer

Recommend immediate patching without details.

Answer

Describe the vulnerability in technical terms.

Question 7

Match each regulatory framework to its focus.

Accepted Answer

GDPR: Protecting personal data of EU citizens. Correct matches: GDPR with data protection, HIPAA with health info, PCI DSS with credit card security, SOX with financial reporting. Common confusions include swapping HIPAA and PCI DSS due to both involving 'security', and confusing GDPR with SOX.

Answer

HIPAA: Securing credit card transactions

Answer

GDPR: Regulating financial disclosures

Question 8

A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?

Accepted Answer

Scope is changed, high impact on confidentiality only. The scope is Changed (S:C), meaning the vulnerable component impacts resources beyond its security scope. The impact is High on confidentiality (C:H), but none on integrity or availability.

Answer

Scope is unchanged, high impact on confidentiality only

Answer

Scope is changed, high impact on integrity only

Answer

Scope is unchanged, high impact on confidentiality and integrity

Question 9

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of awareness.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 10

An organization needs to report a data breach involving personal data of EU residents. Under GDPR, what is the maximum time allowed for notifying the supervisory authority after becoming aware of the breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a personal data breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 11

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Level 1 benchmarks are intended to provide a clear security benefit without significantly impacting functionality or performance. Level 2 benchmarks provide more stringent security but may reduce functionality or require additional operational effort.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.

Question 12

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic intelligence reports provide high-level analysis of threats, trends, and risks for decision-makers.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence

Question 13

When performing digital forensics, which of the following represents the correct order of volatility from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs, archived media. The order of volatility dictates that evidence should be collected from most volatile to least volatile to avoid losing transient data. CPU registers are the most volatile, followed by RAM, swap, disk, logs, and archived media.

Answer

RAM, CPU registers, disk, swap, logs, archived media

Answer

Swap, RAM, CPU registers, disk, logs, archived media

Answer

Archived media, logs, disk, swap, RAM, CPU registers

Question 14

A security analyst is creating a YARA rule to detect a specific malware strain that uses a unique string in its code section and has a characteristic import table. The analyst wants to minimize false positives. Which THREE YARA rule elements should the analyst include?

Accepted Answer

File size condition. Including file size limits, a specific string, and the import table condition reduces false positives by narrowing the scope.

Answer

Hash condition

Answer

Module condition (e.g., pe)

Question 15

Which of the following is the FIRST step in the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation. The NIST SP 800-61 lifecycle begins with Preparation, which includes establishing policies, tools, and training before an incident occurs.

Answer

Detection and Analysis

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery