CS0-003 Practice Test 14 — 15 Questions

Question 1

A security analyst is investigating a potential malware infection on a Windows workstation. The analyst needs to collect evidence while preserving the order of volatility. Which TWO pieces of data should the analyst collect FIRST? (Select TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Contents of RAM. According to the order of volatility, the most volatile data should be collected first. CPU registers and cache are at the top of the order, followed by routing table, ARP cache, process table, kernel statistics, and then memory. However, among the options, running processes (memory) and network connections are among the most volatile. Typically, memory (RAM) is collected before disk data.

Answer

System event logs

Answer

Contents of the hard drive

Answer

Registry hives

Question 2

A company uses a patch management tool to track compliance across its server fleet. The security team needs to prioritize vulnerabilities for patching. Which THREE factors should be considered when prioritizing?

Accepted Answer

EPSS probability score. CVSS score indicates severity, EPSS estimates exploitation likelihood, and asset criticality reflects business impact. Patch availability is more about remediation capability than prioritization.

Answer

Availability of a patch from the vendor

Answer

Number of plugins that detected the vulnerability

Question 3

An incident response team is conducting post-incident activities after containing a malware outbreak. Which TWO activities should be included in the lessons learned phase? (Choose TWO.)

Accepted Answer

Conducting a root cause analysis.. Lessons learned involves analyzing the incident to improve future response. Updating detection rules based on IOCs and conducting a root cause analysis are key activities.

Answer

Deleting all logs from the incident.

Answer

Rewriting the organization's security policy from scratch.

Answer

Patching all systems immediately.

Question 4

A SOC team is evaluating cloud-native security monitoring tools. Which TWO of the following are AWS services specifically designed for threat detection and security monitoring?

Accepted Answer

AWS GuardDuty. AWS GuardDuty is a threat detection service, and Security Hub aggregates security findings. Other services like CloudTrail are for logging, not primarily detection.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS VPC Flow Logs

Question 5

A vulnerability management team is prioritizing vulnerabilities for remediation. They have a list of vulnerabilities with different characteristics. According to best practices, which TWO factors should be considered when prioritizing vulnerabilities? (Select TWO.)

Accepted Answer

The asset's criticality to the business. Asset criticality (business context) and the presence of known exploits (e.g., KEV) are key prioritization factors. CVSS base score is a factor but not as dynamic. Patch availability is important but secondary to exploitability and business impact.

Answer

The CVSS base score

Answer

The availability of a patch

Answer

The number of open ports on the asset

Question 6

An organization is implementing security hardening for Kubernetes clusters. Which THREE of the following are common Kubernetes misconfigurations that should be addressed? (Select THREE)

Accepted Answer

Using hostPath mounts without restrictions. Privileged containers, hostPath mounts, and overly permissive RBAC are common Kubernetes security issues. Using namespaces is good practice, not a misconfiguration. Network policies are recommended for segmentation.

Answer

Using namespaces to isolate workloads

Answer

Implementing network policies

Question 7

A security analyst is investigating a potential data exfiltration using DNS. Which TWO indicators are most consistent with DNS tunneling?

Accepted Answer

DNS responses with unusually large payload sizes. DNS tunneling often uses high query volume and large response sizes to encode data. Unusual TLDs are less common; frequent NXDOMAIN may indicate DGA, not tunneling.

Answer

Frequent NXDOMAIN responses

Answer

Queries for domains with unusual top-level domains (e.g., .tk)

Answer

Multiple queries from different hosts to the same legitimate domain

Question 8

A security analyst is performing forensic analysis of a compromised system. The analyst needs to acquire disk evidence in a forensically sound manner. Which TWO actions should the analyst take to ensure the integrity of the evidence? (Choose TWO.)

Accepted Answer

Calculate a hash of the original drive before imaging. Using a write blocker prevents alteration of the original disk, and computing a hash verifies that the acquired image is an exact copy.

Answer

Disable the write blocker to speed up the imaging process

Answer

Power on the system and run a full antivirus scan before imaging

Answer

Reboot the system to clear any temporary files

Question 9

During a security incident, which THREE elements are critical to include in the incident report for a compliance review?

Accepted Answer

Impact assessment. Timeline, impact assessment, and root cause are essential for understanding the incident and meeting compliance requirements. Lessons learned are important for improvement but not always mandatory for compliance; remediation timeline may be separate.

Answer

Lessons learned

Answer

Remediation timeline

Question 10

A security analyst is selecting Key Performance Indicators (KPIs) for a security operations dashboard. Which THREE metrics are most relevant for measuring incident response effectiveness? (Select THREE.)

Accepted Answer

Mean time to detect (MTTD). MTTR measures response time, MTTD measures detection time, and MTTRem measures remediation time. These are key incident response metrics.

Answer

Number of employees

Answer

Revenue growth

Question 11

A security analyst needs to provide threat intelligence to different audiences. Which TWO of the following are appropriate dissemination approaches?

Accepted Answer

Sending tactical intelligence with IoCs to the SOC team. Strategic intelligence for executives helps them understand the threat landscape, while tactical intelligence for SOC teams provides IoCs for detection.

Answer

Publishing operational intelligence on the company intranet

Answer

Discussing classified threat data in public forums

Answer

Sharing raw intelligence feeds with all employees

Question 12

During a threat hunt, an analyst uses Velociraptor to collect forensic artifacts from endpoints. Which THREE of the following artifacts are most useful for detecting persistence mechanisms?

Accepted Answer

Scheduled tasks. Scheduled tasks, registry Run keys, and service configurations are common persistence locations monitored by attackers.

Answer

List of installed updates

Answer

ARP cache

Question 13

A security analyst is performing a web application security assessment and identifies a potential cross-site scripting (XSS) vulnerability. The application is critical to business operations. Which TWO of the following are appropriate immediate actions?

Accepted Answer

Implement a web application firewall (WAF) rule to block XSS payloads. Reporting the vulnerability to the development team ensures awareness, and implementing a WAF rule can provide temporary protection while a fix is developed.

Answer

Take the application offline immediately

Answer

Ignore the finding because XSS is low risk

Answer

Notify law enforcement immediately

Question 14

An incident responder is performing containment of a ransomware incident that has encrypted files on several file servers. Which THREE actions are appropriate for long-term containment and recovery? (Select THREE)

Accepted Answer

Patching the vulnerability exploited by the ransomware. Long-term containment aims to prevent recurrence and restore normal operations. Rebuilding systems from clean backups ensures removal of malware. Rotating credentials prevents attacker re-entry. Patching vulnerabilities closes the initial attack vector.

Answer

Blocking the ransomware's command-and-control IP at the firewall

Answer

Isolating the affected network segment

Question 15

A security analyst is using osquery to hunt for persistence mechanisms on a Windows endpoint. Which THREE Windows artifacts should the analyst query to identify common persistence locations? (Select THREE.)

Accepted Answer

Scheduled tasks in the Task Scheduler. Registry Run keys (T1547.001), scheduled tasks (T1053.005), and services (T1543.003) are common persistence mechanisms. Startup folders are also common but are not listed as a separate option here; the three listed are correct.

Answer

Windows Event Logs for login events

Answer

Network connections from the endpoint