CS0-003 Practice Test 13 — 15 Questions

Question 1

During an incident response, the SOC team identifies a data breach involving customer PII. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a personal data breach.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 2

During a security incident, which of the following should be the FIRST communication to internal stakeholders?

Accepted Answer

Internal escalation to the incident response team. Internal escalation procedures dictate notifying the incident response team and relevant management first.

Answer

Notification to law enforcement

Answer

Press release to customers

Answer

Update to the risk register

Question 3

A threat hunter is using Velociraptor to search for signs of lateral movement across multiple endpoints. The hunter wants to identify instances where a user logged into multiple systems using the same credentials within a short time frame. Which THREE artifacts should the hunter collect from each endpoint?

Accepted Answer

Network connections (netstat). Security Event Logs (Event ID 4624) show logon sessions, network connections show remote access, and WMI Activity logs can indicate lateral movement via WMI.

Answer

File system for malicious executables

Answer

Registry hives for persistence

Question 4

A security analyst is creating a compliance dashboard for a PCI DSS audit. Which THREE metrics should be included to demonstrate compliance with access control requirements? (Select THREE.)

Accepted Answer

Number of active user accounts with privileged access. PCI DSS requires strict access controls, including unique IDs, timely deactivation, and periodic reviews. Failed login attempts and vulnerability scan results are not direct access control metrics.

Answer

Number of failed login attempts in the last 24 hours

Answer

Number of critical vulnerabilities in network devices

Question 5

A security analyst is prioritizing vulnerabilities for a critical internet-facing application server. The analyst has CVSS scores, EPSS scores, and access to the CISA KEV catalog. Which TWO factors should the analyst consider as the most important for determining remediation priority? (Select TWO)

Accepted Answer

Asset criticality and business context. Asset criticality and business context are crucial because the server is critical and internet-facing. KEV indicates known exploitation, which is also important. However, the question asks for two. The best two are asset criticality (since it's critical) and known exploitation (KEV). CVSS alone doesn't account for exploitability context.

Answer

CVSS base score

Answer

Number of plugins detecting the vulnerability

Answer

EPSS score

Question 6

An incident responder is documenting the root cause of a data breach. Which THREE components are essential to include in the root cause analysis section of the incident report? (Select THREE.)

Accepted Answer

The technical vulnerability exploited. Root cause analysis should identify the underlying causes, not just the symptoms. It should include the technical failure, the process failure, and the human or organizational factors that contributed.

Answer

The number of records affected

Answer

The name of the employee who clicked the phishing email

Question 7

A SOC analyst is triaging a SIEM alert that indicates a possible DNS tunneling attack. The alert was generated based on a correlation rule that looks for unusually high DNS query volume from a single host. Which TWO additional data sources should the analyst correlate to confirm the attack?

Accepted Answer

DNS server logs. DNS logs can show query patterns and payload sizes. NetFlow can show data transfer volumes. Both help confirm tunneling.

Answer

Firewall logs

Answer

Endpoint registry logs

Answer

Authentication logs

Question 8

A security analyst is reviewing a vulnerability scan report and sees a critical finding with a CVSS v3.1 base score of 9.8. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector component (AV:N)?

Accepted Answer

The attacker can exploit the vulnerability over a network from a remote system. AV:N means the vulnerability can be exploited over a network, such as the internet, without requiring physical or local access.

Answer

The attacker must be on the same physical network segment

Answer

The attacker requires local access to the target system

Answer

The attacker must be physically present at the device

Question 9

Which of the following best describes the purpose of a threat intelligence report at the operational level?

Accepted Answer

Offer detailed analysis of threat actor TTPs for specific campaigns. Operational intelligence focuses on specific campaigns, tools, and techniques to inform defenders' actions.

Answer

Deliver technical indicators like IoCs to SOC analysts

Answer

Provide high-level trends to executive leadership

Answer

Summarize geopolitical risks affecting the organization

Question 10

During a threat hunt, an analyst is looking for signs of lateral movement using pass-the-hash. Which three of the following log sources would be most useful for detecting this technique?

Accepted Answer

Sysmon Event ID 3 (network connection). Pass-the-hash involves using NTLM hashes to authenticate. Windows Event ID 4624 (successful logon) can show logon type 3 (network) with unusual source IPs. Sysmon Event ID 3 (network connection) can show outbound connections. Authentication logs on domain controllers show NTLM authentication attempts.

Answer

DNS query logs

Answer

Sysmon Event ID 1 (process creation)

Question 11

After a phishing incident, the security team wants to improve detection of similar attacks in the future. Which THREE actions should the team take as part of post-incident activity? (Choose THREE.)

Accepted Answer

Updating email filtering rules and detection signatures. Post-incident activities include updating detection rules, sharing IOCs, and conducting lessons learned to improve processes. Reimaging is recovery, and disabling accounts is containment.

Answer

Disabling user accounts that clicked the phishing link

Answer

Reimaging all affected workstations

Question 12

A CSIRT is investigating a ransomware incident that encrypted files on multiple servers. The team needs to determine the initial infection vector. Which THREE pieces of evidence should the team prioritize collecting? (Select three.)

Accepted Answer

Email gateway logs for the week prior to the incident. Email logs can reveal phishing attachments or links. Endpoint logs may show process execution or downloads. Network logs can identify C2 communication or lateral movement. These three together help trace the initial entry.

Answer

Physical access logs to the data center

Answer

Firewall configuration backups

Question 13

Match each attack type to its description.

Accepted Answer

Phishing: A mass email attack targeting many users. Correct matches: Phishing (mass email), Spear phishing (targeted email), Whaling (targeting executives). Common confusions: Vishing is voice, Smishing is SMS.

Answer

Vishing: Phishing through social media messages

Answer

Smishing: Voice phishing using phone calls

Question 14

A threat hunter is using osquery to look for persistence mechanisms on a set of Windows endpoints. Which THREE registry keys or scheduled tasks should the hunter check for common persistence?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Run keys, scheduled tasks, and services are common persistence locations. Startup folder is also common, but osquery can check Run keys directly. AppInit_DLLs is less common.

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

User's Startup folder

Question 15

A security analyst is investigating a potential data exfiltration incident. The analyst captures memory from a Windows system and finds a process that is injecting code into other processes. Which THREE indicators from the memory analysis would MOST strongly suggest malicious activity? (Select THREE.)

Accepted Answer

The process has memory regions with RWX permissions.. Suspicious memory regions (like RWX), unusual API calls (e.g., WriteProcessMemory), and hidden processes are strong indicators of malware or code injection.

Answer

The process name is a known Windows system process.

Answer

The process has a valid digital signature.