CS0-003 Practice Test 13 — 15 Questions

Question 1

Which metric in the CVSS v3.1 base score indicates the level of access an attacker needs to exploit a vulnerability?

Accepted Answer

Privileges Required (PR). Privileges Required (PR) indicates the level of privileges an attacker must have before successfully exploiting the vulnerability.

Answer

Attack Vector (AV)

Answer

Attack Complexity (AC)

Answer

User Interaction (UI)

Question 2

An incident responder is classifying an incident. The incident involves ransomware encrypting files on multiple workstations, causing significant business disruption. Which severity level should be assigned to this incident?

Accepted Answer

High. Ransomware affecting multiple workstations causes high impact and likely critical business disruption, so it should be classified as high or critical severity. The highest typical level is 'Critical' (or similar).

Answer

Medium

Answer

Informational

Answer

Low

Question 3

An organization wants to prioritize vulnerabilities based on the likelihood of exploitation. Which of the following sources provides a data-driven probability score for exploitation?

Accepted Answer

EPSS. EPSS uses real-world data to predict the probability of exploitation, aiding in prioritization.

Answer

CVSS v3.1

Answer

CIS Benchmarks

Answer

OWASP Top 10

Question 4

During a post-incident review, the CSIRT identifies that the mean time to detect (MTTD) is significantly higher than the industry benchmark. Which initiative would MOST likely reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors. Improving detection capabilities through enhanced monitoring and alerting reduces detection time.

Answer

Conducting more frequent tabletop exercises

Answer

Rotating credentials for all service accounts

Answer

Implementing a new patch management process

Question 5

A vulnerability report for a critical application shows that a high-risk vulnerability has been accepted by the business owner. What should the analyst include in the report to document this decision?

Accepted Answer

A formal risk acceptance form signed by the business owner with a justification. Proper risk acceptance documentation requires a formal sign-off by the risk owner, typically including a justification and acceptance date.

Answer

The technical details of the vulnerability only

Answer

An automatic closure of the vulnerability ticket

Answer

A note that the vulnerability is low priority

Question 6

A security analyst is configuring a container image scanning tool to identify vulnerabilities in a Docker image before deployment. Which of the following tools is commonly used for container image scanning?

Accepted Answer

Trivy. Trivy is a popular open-source container image vulnerability scanner. It is widely used for scanning Docker images for known vulnerabilities.

Answer

Metasploit

Answer

Nmap

Answer

Wireshark

Question 7

A CASB alert indicates that a user downloaded a file containing sensitive data from a cloud app to an unmanaged device. Which action should the analyst take first?

Accepted Answer

Investigate the alert to confirm the data exfiltration. The first step is to verify the alert is a true positive by checking the user's activity and the file's sensitivity. Prematurely blocking or reporting may be incorrect if the alert is a false positive.

Answer

Report the incident to law enforcement

Answer

Reset the user's password

Answer

Block the user's cloud app access

Question 8

An organization is preparing for an audit to demonstrate compliance with GDPR. The compliance officer needs to provide evidence of data protection controls. Which of the following would be the BEST evidence to include?

Accepted Answer

Copies of recent vulnerability scan reports and access review logs. Log exports, configuration reports, vulnerability scans, and access reviews are typical evidence for GDPR audits.

Answer

The organization's risk register

Answer

Email communications about security incidents

Answer

A summary of security policies and procedures

Question 9

During a web application security assessment using OWASP ZAP, a tester identifies that the application reflects user input in HTTP responses without proper encoding. Which OWASP Top 10 vulnerability category does this finding most likely belong to?

Accepted Answer

Injection. Reflected user input in responses without encoding is a classic sign of Cross-Site Scripting (XSS), which falls under injection in OWASP Top 10 (though XSS is specifically listed as a separate category in some versions, but in 2021 it is under injection).

Answer

Broken Access Control

Answer

Cryptographic Failures

Answer

Security Misconfiguration

Question 10

A security analyst notices repeated alerts for 'DNS query to known malicious domain' from multiple internal hosts. Upon investigation, the analyst finds that the domain is legitimate and used by a third-party service. What should the analyst do to reduce false positives?

Accepted Answer

Add the domain to a whitelist in the SIEM. Adding the domain to a whitelist ensures that legitimate traffic is not flagged, reducing false positives without disabling the rule entirely.

Answer

Disable the alert rule for DNS queries

Answer

Increase the severity of the alert

Answer

Block the domain on the firewall

Question 11

During an incident, the security team discovers that customer personally identifiable information (PII) was exfiltrated. Which of the following notifications must be made according to GDPR?

Accepted Answer

Notify the supervisory authority within 72 hours and affected individuals without undue delay if high risk. Under GDPR, if a breach is likely to result in a high risk to individuals, the organization must notify the affected data subjects without undue delay.

Answer

Notify law enforcement within 48 hours

Answer

Notify all customers within 24 hours

Answer

Notify the data protection officer only

Question 12

A security analyst needs to verify that a critical patch was successfully applied to all endpoints in the organization after an emergency patch deployment. Which phase of the vulnerability lifecycle is the analyst performing?

Accepted Answer

Verification. Verification ensures that remediation (patch application) was effective. It occurs after the fix is applied.

Answer

Remediation

Answer

Prioritization

Answer

Discovery

Question 13

A Security Operations Center (SOC) analyst is tuning a SIEM rule to reduce false positives. Which three of the following are valid approaches to improve the signal-to-noise ratio of a detection rule? (Choose three.)

Accepted Answer

Adding a whitelist for known benign source IP addresses or user accounts.. Adding a whitelist for known benign source IP addresses or user accounts is a valid approach because it directly reduces false positives by excluding traffic that is known to be safe from triggering the rule. This improves the signal-to-noise ratio by ensuring that only truly suspicious activity generates alerts, without altering the detection logic itself.

Answer

Removing the rule entirely to eliminate all associated noise.

Answer

Increasing the severity level of the alert to ensure faster response.

Answer

Adding additional event sources to broaden the scope of detection.

Question 14

A SOC is onboarding endpoint logs into a SIEM. Which fields are most important for process-chain investigations? (Choose three.)

Accepted Answer

Parent process name and command line. Parent process name and command line are critical for process-chain investigations because they establish the lineage of an execution event. In a SIEM, these fields allow analysts to trace how a process was spawned, identifying whether it originated from a legitimate application (e.g., explorer.exe) or a suspicious parent (e.g., wscript.exe launching cmd.exe). Without this context, it is impossible to reconstruct the attack kill chain from initial execution to lateral movement or privilege escalation.

Answer

Monitor refresh rate

Question 15

A security analyst is prioritizing vulnerabilities for remediation. The following vulnerabilities have been identified:

Vulnerability A: CVSS v3.1 Base Score 9.8 (Critical), no known exploit, affects internet-facing web server.
Vulnerability B: CVSS v3.1 Base Score 7.5 (High), exploit available, affects internal database server.
Vulnerability C: CVSS v3.1 Base Score 6.1 (Medium), exploit available, affects internal file server.
Vulnerability D: CVSS v3.1 Base Score 4.0 (Medium), no known exploit, affects internal workstation.

Which vulnerability should be remediated FIRST?

Accepted Answer

Vulnerability A. Vulnerability A has a CVSS v3.1 Base Score of 9.8 (Critical) and affects an internet-facing web server, which is directly exposed to external threats. Even though no known exploit exists, the high severity and exposure mean that a zero-day or future exploit could cause severe impact, making it the highest priority for remediation according to risk-based prioritization frameworks like CVSS and NIST SP 800-40.

Answer

Vulnerability D

Answer

Vulnerability C

Answer

Vulnerability B