CS0-003 Practice Test 15 — 15 Questions

Question 1

A security analyst is creating metrics for a security dashboard aimed at executive leadership. Which THREE metrics are most appropriate for this audience? (Select THREE.)

Accepted Answer

Phishing simulation click rates. Executives prefer high-level metrics that show overall security posture, trends, and business impact.

Answer

Vulnerability scan details for individual hosts

Answer

Firewall rule change request logs

Question 2

An analyst is investigating a potential data exfiltration incident. The analyst observes repeated HTTPS connections to a cloud storage provider from a server that does not normally use that service. Which three additional artifacts would strengthen the case for exfiltration?

Accepted Answer

The data transfer volume is significantly higher than normal for that server. Large outbound data volume, connections outside business hours, and use of non-standard ports (e.g., 443 for https but custom port for tunneling) are classic exfiltration indicators.

Answer

The connections are made to a known malicious IP

Answer

The connections occur during business hours only

Question 3

During a forensic investigation, an analyst must preserve evidence in accordance with forensic sound procedures. Which THREE of the following practices should the analyst follow? (Select THREE.)

Accepted Answer

Document all actions taken in a chain of custody form. Forensic sound procedures include using write blockers to prevent alteration, verifying integrity with hashes, and documenting the chain of custody. Running a live scan would alter data.

Answer

Run a full antivirus scan on the target drive

Answer

Boot the system to ensure it is operational

Question 4

A security analyst is performing a vulnerability assessment and needs to identify potential misconfigurations in a Kubernetes cluster. Which TWO of the following are common Kubernetes misconfigurations that should be checked? (Select TWO.)

Accepted Answer

Privileged containers. Privileged containers and hostPath mounts are well-known security risks in Kubernetes. The other options are not typical misconfigurations.

Answer

Using network policies

Answer

Running containers as non-root user

Answer

Using ConfigMaps for non-sensitive data

Question 5

A security analyst is using OpenVAS to scan a network. The scan identifies several vulnerabilities. Which TWO of the following are valid components of a CVSS v3.1 base score? (Select the two correct answers.)

Accepted Answer

Scope (S). Attack Vector and Scope are both part of the CVSS v3.1 base score.

Answer

Exploitability (E)

Answer

Confidence (C)

Answer

Remediation Level (RL)

Question 6

An organization is preparing evidence for an audit of access controls. Which THREE types of evidence should be collected? (Select THREE.)

Accepted Answer

Access review documentation. Audit evidence for access controls includes log exports (showing access events), access reviews (certifying user permissions), and vulnerability scan reports (identifying misconfigurations). Incident reports are not directly relevant.

Answer

Network flow data

Answer

Incident response reports

Question 7

A vulnerability management analyst is prioritizing vulnerabilities for remediation. The analyst has the following information for three vulnerabilities: CVE-2023-1: CVSS 9.8, EPSS 0.9, asset criticality high; CVE-2023-2: CVSS 7.5, EPSS 0.01, asset criticality low; CVE-2023-3: CVSS 5.0, EPSS 0.8, asset criticality medium. According to best practices, which THREE factors should the analyst consider when prioritizing? (Select THREE)

Accepted Answer

CVSS score. Prioritization should consider severity (CVSS), likelihood of exploitation (EPSS), and asset criticality. KEV is not mentioned in the data. Patch complexity and vendor reputation are secondary considerations but not primary factors in this context.

Answer

CVE publication date

Answer

Number of vendors affected

Question 8

A security analyst is prioritizing vulnerabilities for remediation. Which THREE factors from the CISA Known Exploited Vulnerabilities (KEV) catalog should the analyst consider? (Select THREE.)

Accepted Answer

Date the vulnerability was added to the catalog. The KEV catalog lists vulnerabilities known to be exploited in the wild, including the date added, vendor name, and a brief description.

Answer

EPSS probability score

Answer

CVSS base score

Question 9

A security analyst is tuning a SIEM rule that generates alerts for every failed login attempt. The rule is causing alert fatigue. Which TWO actions would reduce false positives while maintaining security visibility?

Accepted Answer

Aggregate alerts by source IP and time window. Aggregating alerts by source IP reduces noise from individual attempts. Whitelisting known service accounts performing repeated failed logins (due to misconfigured services) also reduces false positives.

Answer

Disable the rule entirely

Answer

Increase the alert severity threshold

Answer

Increase the log retention period

Question 10

An incident response team is analyzing indicators of compromise (IOCs) from a phishing campaign. Which THREE of the following are commonly used IOC types? (Select THREE.)

Accepted Answer

IP addresses. Common IOC types include IP addresses, file hashes, domains, URLs, and email indicators. Software versions are not typically IOCs.

Answer

CPU registers

Answer

Software version numbers

Question 11

Match each security tool to its primary purpose.

Accepted Answer

Nmap: Network scanning and discovery. Nmap is for network scanning, Wireshark for protocol analysis, Metasploit for penetration testing, and Burp Suite for web application testing. Common confusions include misattributing these roles.

Answer

Nmap: Web application security testing

Answer

Wireshark: Penetration testing framework

Question 12

A security analyst is investigating a reported vulnerability in a web application. The team uses Burp Suite for DAST scanning. Which TWO of the following findings would be classified as injection vulnerabilities according to OWASP Top 10?

Accepted Answer

Stored XSS in the comment section. SQL injection and Stored XSS are both injection flaws. SQL injection is classic injection, and XSS is also a form of injection.

Answer

Use of a component with known vulnerabilities

Answer

Broken access control allowing privilege escalation

Answer

Security misconfiguration exposing directory listing

Question 13

An analyst is preparing a vulnerability report for management. Which THREE sections should be included to effectively communicate findings and remediation? (Select THREE.)

Accepted Answer

Executive summary. A vulnerability report typically includes an executive summary for leadership, findings by severity to prioritize, and a remediation timeline for action. Risk acceptance may be part of findings but not always a separate section; here the three essential sections are those listed.

Answer

Incident response procedures

Answer

Network topology diagram

Question 14

A security analyst is investigating a potential data breach. The analyst needs to collect digital evidence while preserving its integrity. Which TWO actions should the analyst take? (Choose TWO.)

Accepted Answer

Verify the hash of the acquired image against the original.. Write blockers prevent modification of the original media during acquisition, and hash verification ensures the integrity of the acquired image by comparing hashes.

Answer

Run a full antivirus scan on the system.

Answer

Delete any malicious files found during the investigation.

Answer

Connect the suspect drive to a forensic workstation without a write blocker.

Question 15

A company has experienced a ransomware attack that encrypted critical servers. The incident response team is in the containment, eradication, and recovery phase. Which THREE actions are part of long-term containment? (Choose three.)

Accepted Answer

Apply security patches to vulnerable systems. Long-term containment involves actions to prevent recurrence, such as patching, rebuilding systems, and rotating credentials.

Answer

Isolate the infected systems from the network

Answer

Block the ransomware's C2 domain at the firewall