CS0-003 Practice Test 16 — 15 Questions

Question 1

A security analyst is performing incident response for a suspected malware outbreak. Which TWO actions are examples of long-term containment? (Select TWO.)

Accepted Answer

Apply security patches to all systems. Long-term containment includes actions that permanently remediate the threat, such as patching vulnerabilities and rebuilding systems. Isolating the network is short-term.

Answer

Isolate the affected network segment

Answer

Disable compromised user accounts

Answer

Block malicious IPs at the firewall

Question 2

A security analyst is preparing an incident report after a ransomware attack. Which two components must be included in the report? (Select TWO.)

Accepted Answer

Root cause analysis. An incident report should include a timeline of events, impact assessment, root cause, lessons learned, and recommendations. Timeline and root cause are essential.

Answer

Resume of the incident responder

Answer

Marketing department's budget

Answer

Software license keys

Question 3

A security analyst is investigating a phishing incident that resulted in credential theft. Which TWO actions should the analyst take as part of short-term containment? (Choose two.)

Accepted Answer

Block the phishing domain at the email gateway. Short-term containment aims to stop the immediate threat. Disabling accounts and blocking malicious domains are quick containment actions.

Answer

Rebuild the affected workstations from a clean image

Answer

Conduct a full vulnerability scan of the network

Answer

Change all user passwords in the domain

Question 4

During dynamic analysis of a suspicious file in a sandbox environment, which THREE behaviors are considered indicators of compromise (IOCs) that suggest malicious activity? (Choose THREE.)

Accepted Answer

Creating a registry run key to achieve persistence.. Dynamic analysis monitors behavior. Outbound connections to known bad IPs, creation of suspicious registry keys, and dropping files in startup folders are common malicious behaviors.

Answer

The file reading its own content.

Answer

Opening a text file that was already present.

Question 5

A security analyst is using a vulnerability scanner to identify missing patches on Windows servers. The scanner uses plugins that reference Common Vulnerabilities and Exposures (CVE) identifiers. Which THREE of the following are components of a CVSS v3.1 base score vector?

Accepted Answer

Attack Vector (AV). Attack Vector (AV), Privileges Required (PR), and Confidentiality (C) are all part of the CVSS v3.1 base metric group.

Answer

Remediation Level (RL)

Answer

Exploitability (E)

Question 6

During a security incident, a cybersecurity analyst must communicate with various stakeholders. Which TWO are appropriate internal escalation paths? (Select TWO.)

Accepted Answer

Legal and compliance department. Internal escalation typically goes to the incident response team for technical handling and to legal/compliance for regulatory and liability issues. Law enforcement is external, and customers are external as well.

Answer

Law enforcement

Answer

Customers

Answer

Media

Question 7

Match each incident response phase to its activity.

Accepted Answer

Preparation: Developing and maintaining incident response policies, procedures, and tools.. The incident response phases are correctly matched as: Preparation with developing policies, Detection and Analysis with identifying incidents, Containment, Eradication, and Recovery with limiting damage and restoring operations, and Post-Incident Activity with lessons learned. Common confusions include swapping Preparation and Detection activities.

Answer

Preparation: Identifying and analyzing potential security incidents.

Answer

Detection and Analysis: Developing incident response policies and procedures.

Question 8

Match each network protocol to its well-known port number.

Accepted Answer

HTTP: 80. These are standard well-known port assignments as defined by IANA. Common confusions include swapping HTTP/HTTPS ports or mixing SSH with Telnet.

Answer

SSH: 23

Answer

DNS: 80

Answer

SMTP: 53

Question 9

Match each threat intelligence source to its description.

Accepted Answer

OSINT: Threat intelligence from openly available sources such as websites, social media, and government reports.. The correct matches are: OSINT with open-source intelligence, ISAC with sector-specific sharing, TAXII with protocol, STIX with language. Common confusion occurs between TAXII and STIX, and between OSINT and ISAC.

Answer

OSINT: A sector-specific organization that facilitates sharing of threat intelligence among members.

Answer

ISAC: A standardized protocol for automating the exchange of cyber threat intelligence.

Question 10

Match each analysis technique to its description.

Accepted Answer

Behavioral Analysis: Monitors and analyzes the behavior of entities (users, systems) to detect deviations from normal patterns.. Behavioral analysis monitors entity behavior; signature-based uses known patterns; anomaly-based uses baselines; heuristic uses rules. Common confusions include swapping behavioral and anomaly definitions or misassigning signature analysis.

Answer

Behavioral Analysis: Establishes a baseline of normal activity and flags any significant deviations.

Answer

Signature-Based Analysis: Monitors and analyzes the behavior of entities to detect deviations.

Question 11

Which three metrics are commonly used to measure the effectiveness of a security operations center (SOC)? (Select THREE.)

Accepted Answer

Mean Time to Respond (MTTR). MTTD, MTTR, and MTTRem are standard SOC metrics to measure detection and response effectiveness.

Answer

Number of firewall rules

Answer

Number of employees in the SOC

Question 12

Which of the following metrics measures the average time it takes to identify a security incident after it occurs?

Accepted Answer

Mean time to detect (MTTD). MTTD is specifically defined as the average time to detect an incident.

Answer

Patch SLA compliance percentage

Answer

Mean time to remediate (MTTRem)

Answer

Mean time to respond (MTTR)

Question 13

A security analyst is prioritizing vulnerabilities discovered during a scan. Which TWO factors should the analyst consider as part of business context to determine remediation priority? (Select TWO.)

Accepted Answer

Asset exposure. Asset criticality (how important the asset is to the business) and exposure (whether the asset is internet-facing or accessible to attackers) are key business context factors.

Answer

CVSS base score

Answer

Patch availability

Answer

Exploit availability

Question 14

A cybersecurity analyst is building a compliance dashboard for an upcoming audit. Which TWO metrics are most relevant for demonstrating effective patch management? (Select TWO.)

Accepted Answer

Open vulnerability counts by severity. Patch SLA compliance % shows adherence to patching timelines, and open vulnerability counts by severity show the current risk posture. Mean time to remediate is also relevant but not listed as an option; here the two best are patch SLA compliance and open vulnerabilities.

Answer

Security incidents by category

Answer

Mean time to detect (MTTD)

Answer

Phishing simulation click rates

Question 15

A security analyst is investigating a potential advanced persistent threat (APT) that uses living off the land binaries (LOLBins). The EDR has flagged several processes. Which THREE process behaviors are most indicative of LOLBin abuse? (Choose THREE.)

Accepted Answer

mshta.exe executing JavaScript from a remote URL. LOLBin abuse often involves using native tools in unusual ways: wmic for remote execution, mshta for executing malicious scripts, and certutil for downloading payloads. Bitsadmin is also used, but it's less common.

Answer

explorer.exe opening the Start menu

Answer

notepad.exe opening a .txt file in the user's Documents folder