CS0-003 Practice Test 14 — 15 Questions

Question 1

A large e-commerce site is under a DDoS attack targeting its web servers. The incident response team is activated. Which goal should receive the HIGHEST priority during the response?

Accepted Answer

Maintain availability of the service.. During a DDoS attack targeting web servers, the highest priority is maintaining availability of the service because the primary goal of incident response in this scenario is to preserve business continuity and minimize disruption to legitimate users. The incident response team must first focus on mitigating the attack (e.g., rate-limiting, blackholing traffic, or scaling resources) before any forensic or attribution steps, as service downtime directly impacts revenue and customer trust.

Answer

Implement attribution.

Answer

Identify the attacker's identity.

Answer

Quantify the financial loss.

Question 2

A SIEM receives endpoint, firewall, identity, and cloud logs for the same incident, but timestamps do not align across sources. Which actions should the analyst take before finalizing the timeline? (Choose two.)

Accepted Answer

Verify time synchronization and timezone parsing for each source. Without verifying time synchronization (e.g., NTP configuration) and timezone parsing for each log source, the analyst cannot trust the chronological order of events. A SIEM relies on accurate timestamps to correlate logs from endpoints, firewalls, identity systems, and cloud platforms; misaligned timestamps can lead to incorrect incident reconstruction.

Answer

Assume the latest arriving event happened last

Answer

Discard every source except the firewall

Question 3

An analyst examines a memory dump from a compromised host and finds that 'svchost.exe' is executing code from a memory region that is not backed by any executable file. What technique is most likely being used?

Accepted Answer

Process hollowing. Process hollowing involves creating a legitimate process (often svchost.exe) in a suspended state, unmapping its original executable image from memory, and replacing it with malicious code. The result is a process whose in-memory code is not backed by any executable file on disk, which is exactly what the memory dump shows. Reflective DLL injection and classic DLL injection leave the host image intact and load a DLL into it.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection

Question 4

Which items belong in a vulnerability exception request? (Choose three.)

Accepted Answer

Business justification for delayed remediation. A vulnerability exception request is a formal process to accept the risk of not remediating a vulnerability within the standard timeframe. A business justification for delayed remediation is a core component because it documents the operational, financial, or technical reasons why the fix cannot be applied immediately, which is required for risk acceptance by management. Without this justification, the exception lacks the necessary context for approval and audit compliance.

Answer

A request to remove the asset from inventory

Question 5

A regulator asks for incident evidence after a data exposure. Which items should be coordinated before disclosure? (Choose two.)

Accepted Answer

Evidence package with timeline, scope, and affected data categories. A coordinated evidence package ensures that the disclosure to the regulator includes a verified timeline, scope, and affected data categories, which is essential for demonstrating due diligence and compliance with breach notification laws. Without this coordination, the evidence may be incomplete or inconsistent, potentially leading to regulatory penalties or loss of trust.

Answer

Unreviewed analyst speculation

Answer

Passwords for all production systems

Question 6

During a post-incident review, the team identifies that the incident response plan was not followed correctly due to unclear communication channels. Which recommendation BEST addresses this issue?

Accepted Answer

Update the incident response plan to define specific communication channels and escalation paths. The root cause identified in the post-incident review is unclear communication channels, which directly violates the communication and escalation procedures defined in the incident response plan. Updating the plan to specify exact communication channels (e.g., dedicated Slack channel, email distribution list, or phone tree) and escalation paths (e.g., tier-1 analyst → SOC manager → CISO) ensures that all team members know how and when to communicate during an incident, preventing delays and miscoordination.

Answer

Implement multi-factor authentication for all accounts

Answer

Replace the current SIEM tool with a faster one

Answer

Conduct more frequent vulnerability scans

Question 7

During a forensic investigation, an analyst finds a suspicious registry key that runs a program at startup. What is the best way to determine if the program is malicious?

Accepted Answer

Compute the hash of the executable and query threat intelligence. Computing the hash of the executable and querying threat intelligence (e.g., VirusTotal, AlienVault OTX) provides a definitive, objective indicator of known maliciousness by comparing the file's cryptographic fingerprint against global threat databases. This is the fastest and most reliable method to determine if the program is malicious without risking execution or relying on circumstantial evidence.

Answer

Search the startup folder for the file

Answer

Execute the program in a sandbox and observe behavior

Answer

Check the file's last modified timestamp

Question 8

A remediation report shows repeated SLA breaches by one business unit. Which recommendations are appropriate? (Choose two.)

Accepted Answer

Review ownership, resourcing, and change-window constraints. Reviewing ownership, resourcing, and change-window constraints directly addresses the root causes of repeated SLA breaches. SLA breaches often stem from inadequate staffing, misaligned change windows, or unclear ownership of remediation tasks, not from technical failures alone. This recommendation aligns with the reporting and communication domain's emphasis on actionable, root-cause analysis rather than superficial fixes.

Answer

Automatically accept all future risk permanently

Answer

Hide the business unit from future reports

Question 9

Which items help make a post-incident report useful for technical teams? (Choose two.)

Accepted Answer

Root cause and exploited control gaps. A post-incident report must include the root cause and exploited control gaps to enable technical teams to implement targeted remediation. Without identifying the specific vulnerability (e.g., unpatched CVE, misconfigured firewall rule, weak authentication mechanism) and the control failure that allowed the exploit, the report lacks actionable intelligence for hardening defenses.

Answer

Generic motivational slogans

Answer

Unrelated financial forecasts

Question 10

An application has a high CVSS vulnerability, but a WAF rule blocks known exploit payloads. What should the team still do? (Choose two.)

Accepted Answer

Validate the WAF rule against bypass and false-positive risk. A WAF rule blocking known exploit payloads does not guarantee complete protection, as attackers can craft bypass techniques such as encoding, parameter pollution, or using different HTTP methods. Validating the rule against bypass and false-positive risks ensures the WAF is effective without disrupting legitimate traffic, which is critical for maintaining both security and availability.

Answer

Remove the application from vulnerability scans

Answer

Mark the vulnerability as permanently remediated

Question 11

When briefing legal and privacy teams after a suspected data exposure, which details matter? (Choose two.)

Accepted Answer

Data types and jurisdictions potentially affected. Data types (e.g., PII, PHI, PCI) and affected jurisdictions determine legal notification obligations under regulations like GDPR, HIPAA, or CCPA. Jurisdictions dictate breach notification timelines and penalties, making this information critical for legal and privacy teams to assess risk and compliance. Without this detail, the response cannot be properly scoped or legally defensible.

Answer

A complete list of unrelated server patches

Answer

Speculation about attacker identity without evidence

Question 12

A vulnerability manager wants accurate Linux package findings. Which scan conditions are important? (Choose two.)

Accepted Answer

Authenticated access to inspect installed packages. For accurate Linux package findings, the vulnerability scanner must have authenticated access (e.g., via SSH with valid credentials) to inspect installed packages directly from the package manager database (e.g., RPM or dpkg). Without authentication, the scanner can only perform unauthenticated network-based checks, which cannot reliably determine installed software versions or patch levels. Authenticated access ensures the scanner can execute commands like 'rpm -qa' or 'dpkg -l' to enumerate packages with high accuracy.

Answer

Only scanning ICMP echo replies

Answer

Changing server hostnames randomly

Question 13

Which of the following vulnerability lifecycle phases involves verifying that a remediation has been successfully applied and that the vulnerability no longer exists?

Accepted Answer

Verification. Verification is the phase where after remediation, the system is rescanned or checked to confirm the vulnerability is mitigated.

Answer

Discovery

Answer

Prioritization

Answer

Remediation

Question 14

An analyst is reviewing a vulnerability scan report for a containerized application. The scan identifies a critical vulnerability in a base image used by multiple containers. The application is deployed in a Kubernetes cluster with network policies restricting ingress. The vulnerability has a CVSS v3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). However, the EPSS score is 0.001 (0.1%). Which of the following should the analyst prioritize?

Accepted Answer

Schedule the patch for the next maintenance window because of low EPSS and network controls. Despite high CVSS, the EPSS score indicates extremely low likelihood of exploitation in the wild. The business context and compensating controls (network policies) reduce risk. Therefore, remediation can be scheduled in normal patch cycle.

Answer

Apply a virtual patch via a web application firewall (WAF)

Answer

Ignore the vulnerability because it is in a container image

Answer

Immediately patch the vulnerability within 24 hours due to the high CVSS score

Question 15

A security team is implementing a patch management process for a large enterprise. They must ensure that patches are tested before deployment to production. The team has a staging environment that mirrors production. During patch testing, they discover that a critical security patch for a database server causes a performance degradation of 30% in a key application. What should the team do next?

Accepted Answer

Contact the vendor for a fix or workaround, and implement compensating controls in the meantime.. The patch is critical but causes performance issues. The best approach is to work with the vendor for a resolution or apply compensating controls until a fix is available. Applying the patch blindly may disrupt operations, while skipping it leaves the vulnerability unaddressed.

Answer

Skip the patch and rely on existing security controls.

Answer

Apply the patch to production immediately because it fixes a critical vulnerability.

Answer

Deploy the patch to a subset of production servers to test performance.