CS0-003 Practice Test 15 — 15 Questions

Question 1

A SOC analyst is investigating an alert from Azure Sentinel indicating a user account logged in from an unfamiliar location. The analyst wants to determine if this is a true positive. Which TWO additional log sources should the analyst correlate to make an informed decision?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Activity Logs. Microsoft Entra ID sign-in logs provide authentication details, and Azure Activity Logs provide management plane activity. Correlating these can reveal if the sign-in was part of administrative actions or other anomalies.

Answer

Azure Security Center alerts

Answer

Azure Network Watcher flow logs

Answer

Azure Key Vault logs

Question 2

An analyst is reviewing a memory dump of a compromised system and notices that the memory of a legitimate process (e.g., notepad.exe) contains a PE header and executable code that is not part of the original binary. Which technique is most likely being used?

Accepted Answer

Process hollowing. Process hollowing involves replacing the legitimate code of a running process with malicious code, but the PE header and executable code in memory indicate code injection, specifically hollowing.

Answer

A reflective DLL loader

Answer

DLL injection

Answer

API hooking

Question 3

Which TWO of the following are best practices for secure log management? (Choose TWO)

Accepted Answer

Enable log encryption in transit and at rest. Encrypting logs in transit (e.g., using TLS/SSL for syslog over TCP 6514) and at rest (e.g., AES-256 encryption on the storage volume) ensures confidentiality and integrity, preventing unauthorized access or tampering. This aligns with security frameworks like NIST SP 800-92 and PCI DSS requirements for protecting log data.

Answer

Disable logging on non-critical systems to save space

Answer

Store logs on the same server for easy access

Answer

Use a common log format for all sources

Question 4

An organization is implementing configuration management and decides to use CIS Benchmarks to harden their servers. They choose Level 1 benchmarks for most servers but Level 2 for highly sensitive systems. What is the key difference between Level 1 and Level 2 CIS benchmarks?

Accepted Answer

Level 2 guidelines are more restrictive and may impact system functionality. CIS Level 1 benchmarks are basic security recommendations that can be implemented with minimal impact, while Level 2 includes more restrictive controls that may affect system functionality but provide higher security.

Answer

Level 1 is more restrictive and secure than Level 2

Answer

Level 1 is for cloud systems, Level 2 for on-premises

Answer

Level 2 is only for DoD environments

Question 5

A security analyst is reviewing an alert from Azure Sentinel that indicates a possible privilege escalation attempt. The alert is based on a correlation rule that detects unusual usage of the 'Add-AzKeyVaultKey' cmdlet by a user who has never used it before. The analyst needs to validate the alert and determine if the activity is malicious. Which THREE actions should the analyst take?

Accepted Answer

Check the user's role assignments and permissions. Checking Microsoft Entra ID logs for the authentication context, reviewing the user's recent activity history, and examining the Key Vault audit logs for any subsequent access are all relevant steps.

Answer

Run a vulnerability scan on the user's workstation

Answer

Disable the user account immediately

Question 6

Match each security control to its category.

Accepted Answer

Firewall: Preventive. Security controls are categorized by function: preventive (e.g., firewalls), detective (e.g., IDS), and corrective (e.g., backup). Common confusions arise from misassigning preventive and detective roles.

Answer

Firewall: Detective

Answer

Intrusion Detection System (IDS): Preventive

Question 7

Which metric measures the average time it takes to identify a security incident from the moment it occurs?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) measures the average time to detect an incident.

Answer

MTTRem

Answer

MTTR

Answer

SLA compliance

Question 8

An analyst is creating a compliance dashboard for management. Which of the following is the most relevant metric to include regarding patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance percentage directly measures how well the organization meets patch deadlines, which is a key compliance metric.

Answer

Number of antivirus alerts

Answer

Phishing simulation click rate

Answer

Mean time to detect incidents

Question 9

A security analyst is reviewing a vulnerability scan report and notices a plugin that identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which attack vector is indicated?

Accepted Answer

Network. AV:N indicates network attack vector, meaning the vulnerability can be exploited remotely over the network without any physical or local access.

Answer

Adjacent network

Answer

Local

Answer

Physical

Question 10

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the average time to detect an incident.

Answer

Mean Time to Resolve (MTTR)

Answer

Patch SLA compliance percentage

Answer

Mean Time to Remediate (MTTRem)

Question 11

An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)

Accepted Answer

Blocking outbound communication from infected hosts at the firewall.. Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.

Answer

Creating a forensic image of the infected systems for later analysis.

Answer

Identifying and patching the vulnerability exploited by the malware.

Answer

Notifying law enforcement agencies about the incident.

Question 12

A vulnerability management team is evaluating whether to apply a patch immediately or implement a compensating control. The patch is for a vulnerability in a legacy system that cannot be taken offline during business hours. The compensating control would involve restricting network access to the system. Which decision is MOST appropriate?

Accepted Answer

Implement a compensating control and schedule patching during a maintenance window. If the system cannot be patched immediately, implementing a compensating control (network restriction) reduces risk while waiting for a maintenance window.

Answer

Ignore the vulnerability since it affects a legacy system

Answer

Remove the system from the network

Answer

Apply the patch immediately despite the outage risk

Question 13

A company is implementing a patch management process. Which of the following steps should be performed FIRST after a vendor releases a security patch for a critical vulnerability?

Accepted Answer

Test the patch in a staging environment that mirrors production. Patches should be tested in a staging environment to ensure they do not break critical business functions before deployment.

Answer

Schedule the patch for the next maintenance window

Answer

Deploy the patch to all production servers immediately

Answer

Create a patch compliance report

Question 14

Which of the following is the primary audience for a strategic threat intelligence report?

Accepted Answer

Executive leadership. Strategic intelligence is high-level and intended for executive leadership to inform business decisions.

Answer

System administrators

Answer

SOC analysts

Answer

Incident responders

Question 15

A vulnerability scanner reports a finding with a CVSS v3.1 base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. What does this indicate about the vulnerability?

Accepted Answer

It has high impact on availability. The vector shows high impact to availability (A:H) and no impact to confidentiality or integrity, so the vulnerability primarily affects availability.

Answer

It has high impact on integrity

Answer

It requires authentication to exploit

Answer

It has high impact on confidentiality