CS0-003 Practice Test 16 — 15 Questions

Question 1

A security analyst is reviewing IOCs from a threat intelligence feed. The analyst wants to enrich the IOCs using open-source tools. Which THREE tools are commonly used for IOC enrichment? (Select three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

WHOIS. WHOIS (A) is correct because it enriches domain and IP IOCs with registration data such as registrar, creation/expiration dates, name servers, and registrant contact details, which help attribute infrastructure to threat actors. VirusTotal (C) is correct because it aggregates results from dozens of antivirus engines, URL/domain scanners, and sandboxes to provide reputation, detection ratios, and behavioral context for hashes, URLs, domains, and IPs. Shodan (D) is correct because it enriches IP and service IOCs with internet-facing banner data, open ports, service versions, TLS certificates, and geolocation, revealing exposed infrastructure tied to an indicator. Wireshark (B) is a packet capture and protocol analysis tool used for live traffic inspection, not for querying external reputation or registration data about IOCs. Nmap (E) is a network scanning and host-discovery utility used to probe systems directly, not an open-source enrichment service that correlates IOCs against third-party intelligence.

Answer

Wireshark

Answer

Nmap

Question 2

Which three of the following are key considerations when implementing a vulnerability management lifecycle in an enterprise environment? (Choose three.)

Accepted Answer

Integrating threat intelligence feeds to contextualize vulnerabilities and focus on active threats. Establishing a remediation prioritization framework based on asset criticality and exploitability is correct because it ensures that vulnerabilities posing the greatest risk to the business are addressed first. This aligns with risk-based vulnerability management, where not all vulnerabilities are equal; prioritizing by asset value and exploitability (e.g., CVSS exploitability metrics or active exploitation evidence) optimizes resource allocation and reduces overall risk exposure.

Answer

Scanning all assets with the highest possible scan intensity to ensure no vulnerability is missed

Answer

Performing vulnerability scans only during off-peak hours to minimize network disruption

Answer

Using default scan credentials from the vulnerability scanner vendor for consistency

Question 3

During a security incident, a digital forensics investigator must preserve evidence according to best practices. Which three of the following actions align with proper forensic procedures? (Choose three.)

Accepted Answer

Use a write blocker when creating disk images.. Calculating and documenting cryptographic hashes (e.g., SHA-256) of acquired images ensures data integrity by providing a verifiable fingerprint that can prove the image has not been altered since acquisition. Maintaining a documented chain of custody tracks every person who handled the evidence, preserving its admissibility in legal proceedings. Using a write blocker when creating disk images prevents any accidental writes to the original media, which is critical to avoid altering the evidence.

Answer

Store original evidence on the same network as the investigation.

Answer

Reinstall the operating system before imaging to ensure stability.

Answer

Boot the suspect system to check for running processes.

Question 4

A security analyst is configuring a vulnerability scanner for an internal network. Which two settings are most important for reducing false positives during the scan? (Choose two.)

Accepted Answer

Disabling unnecessary plug-ins. Option A is correct because disabling unnecessary plug-ins prevents the scanner from running checks that do not apply to the target hosts, such as Windows-specific or web-application tests against systems that do not use those technologies, which otherwise produce misleading findings. Option B is correct because credentialed scanning lets the scanner authenticate to hosts and read local configuration, patch levels, and installed software directly, so it can confirm whether a vulnerability actually exists instead of inferring it from ambiguous banner or version data, which is the single most effective way to cut false positives. Option C is wrong because raising scan intensity only makes the scan more aggressive and can increase false positives and network disruption rather than reduce them. Option D is wrong because scanning from multiple source IP addresses does not improve accuracy and may complicate firewall or IDS behavior. Option E is wrong because restricting the scan window to business hours affects availability and timing, not the accuracy of the results.

Answer

Using a higher scan intensity

Answer

Scanning from multiple IP addresses

Answer

Scanning only during business hours

Question 5

Which three of the following are effective techniques for prioritizing vulnerabilities for remediation in a vulnerability management program? (Choose three.)

Accepted Answer

Incorporating compensating controls that may reduce the effective risk of a vulnerability. Correlating vulnerabilities with active exploit campaigns and threat intelligence feeds is effective because it prioritizes vulnerabilities that are currently being exploited in the wild, which directly reduces the risk of a breach. This approach aligns remediation with real-world attacker behavior rather than theoretical severity.

Answer

Applying the Common Vulnerability Scoring System (CVSS) base score as the sole prioritization metric

Answer

Focusing remediation efforts exclusively on vulnerabilities with a CVSS score of 9.0 or higher

Answer

Prioritizing vulnerabilities based solely on the age of the CVE

Question 6

Match each regulatory framework to its focus.

Accepted Answer

GDPR: Protecting personal data of EU citizens. Correct matches: GDPR with data protection, HIPAA with health info, PCI DSS with credit card security, SOX with financial reporting. Common confusions include swapping HIPAA and PCI DSS due to both involving 'security', and confusing GDPR with SOX.

Answer

HIPAA: Securing credit card transactions

Answer

GDPR: Regulating financial disclosures

Question 7

Match each attack type to its description.

Accepted Answer

Phishing: A mass email attack targeting many users. Correct matches: Phishing (mass email), Spear phishing (targeted email), Whaling (targeting executives). Common confusions: Vishing is voice, Smishing is SMS.

Answer

Vishing: Phishing through social media messages

Answer

Smishing: Voice phishing using phone calls

Question 8

Match each security tool to its primary purpose.

Accepted Answer

Nmap: Network scanning and discovery. Nmap is for network scanning, Wireshark for protocol analysis, Metasploit for penetration testing, and Burp Suite for web application testing. Common confusions include misattributing these roles.

Answer

Nmap: Web application security testing

Answer

Wireshark: Penetration testing framework

Question 9

During dynamic analysis of a suspicious file in a sandbox environment, which THREE behaviors are considered indicators of compromise (IOCs) that suggest malicious activity? (Choose THREE.)

Accepted Answer

Creating a registry run key to achieve persistence.. Option A is correct because creating a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\...\Run) is a classic persistence mechanism that causes malware to execute automatically at user logon or system startup, making it a strong IOC. Option B is correct because outbound network connections to a known malicious IP indicate command-and-control (C2) communication, data exfiltration, or payload retrieval, which are hallmark malicious behaviors observed during sandbox dynamic analysis. Option D is correct because dropping an executable into the Startup folder (e.g., %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup) establishes persistence by launching the file automatically at user logon, another well-known IOC. Option C is not an IOC because a file reading its own content is common benign behavior (e.g., self-verification, configuration parsing) and does not by itself indicate malicious activity. Option E is not an IOC because opening a pre-existing text file is normal, expected behavior for many legitimate applications and lacks the persistence, network, or payload-dropping characteristics of malicious activity.

Answer

The file reading its own content.

Answer

Opening a text file that was already present.

Question 10

Match each incident response phase to its activity.

Accepted Answer

Preparation: Developing and maintaining incident response policies, procedures, and tools.. The incident response phases are correctly matched as: Preparation with developing policies, Detection and Analysis with identifying incidents, Containment, Eradication, and Recovery with limiting damage and restoring operations, and Post-Incident Activity with lessons learned. Common confusions include swapping Preparation and Detection activities.

Answer

Preparation: Identifying and analyzing potential security incidents.

Answer

Detection and Analysis: Developing incident response policies and procedures.

Question 11

Match each network protocol to its well-known port number.

Accepted Answer

HTTP: 80. These are standard well-known port assignments as defined by IANA. Common confusions include swapping HTTP/HTTPS ports or mixing SSH with Telnet.

Answer

SSH: 23

Answer

DNS: 80

Answer

SMTP: 53

Question 12

Match each threat intelligence source to its description.

Accepted Answer

OSINT: Threat intelligence from openly available sources such as websites, social media, and government reports.. The correct matches are: OSINT with open-source intelligence, ISAC with sector-specific sharing, TAXII with protocol, STIX with language. Common confusion occurs between TAXII and STIX, and between OSINT and ISAC.

Answer

OSINT: A sector-specific organization that facilitates sharing of threat intelligence among members.

Answer

ISAC: A standardized protocol for automating the exchange of cyber threat intelligence.

Question 13

Match each analysis technique to its description.

Accepted Answer

Behavioral Analysis: Monitors and analyzes the behavior of entities (users, systems) to detect deviations from normal patterns.. Behavioral analysis monitors entity behavior; signature-based uses known patterns; anomaly-based uses baselines; heuristic uses rules. Common confusions include swapping behavioral and anomaly definitions or misassigning signature analysis.

Answer

Behavioral Analysis: Establishes a baseline of normal activity and flags any significant deviations.

Answer

Signature-Based Analysis: Monitors and analyzes the behavior of entities to detect deviations.

Question 14

A cybersecurity analyst is building a compliance dashboard for an upcoming audit. Which TWO metrics are most relevant for demonstrating effective patch management? (Select TWO.)

Accepted Answer

Open vulnerability counts by severity. Option A (Open vulnerability counts by severity) is correct because it directly reflects the backlog of unpatched exposures, and breaking it down by severity (critical/high/medium/low) shows whether the most dangerous CVEs are being remediated promptly, which is a core evidence point for patch management effectiveness. Option C (Patch SLA compliance %) is correct because it measures the percentage of patches applied within the organization's defined remediation timeframes (e.g., critical within 7 days, high within 30 days), directly demonstrating the discipline and performance of the patch management process. Option B (Security incidents by category) is not specific to patching—it describes overall incident trends and could stem from phishing, misconfiguration, or insider activity rather than patch status. Option D (Mean time to detect) measures detection capability (SOC/monitoring efficiency), not remediation of vulnerabilities. Option E (Phishing simulation click rates) is a security awareness metric and has no direct bearing on patch management.

Answer

Security incidents by category

Answer

Mean time to detect (MTTD)

Answer

Phishing simulation click rates

Question 15

A security analyst is investigating a potential data exfiltration incident. The analyst observes the following network traffic from an internal host: Outbound connections to an external IP on port 22, large data transfers during off-hours, and the use of SCP. Which two indicators of compromise (IOCs) are most relevant? (Select TWO.)

Accepted Answer

Large outbound data transfers during off-hours. Option C is correct because the scenario explicitly describes large data transfers occurring during off-hours, which is a classic exfiltration IOC indicating data is being moved out of the network when normal business activity and monitoring are minimal. Option D is correct because SCP operates over SSH on TCP port 22, and using SCP to an external IP is a concrete IOC showing a file-transfer protocol being abused to move data outbound, matching the observed port 22 traffic. The other options do not fit: frequent DNS queries (A) could suggest DNS tunneling but no such activity is described, HTTP POST requests (B) would indicate web-based exfiltration over ports 80/443 rather than SCP/22, and ICMP echo requests (E) are ordinary ping traffic and not consistent with the SCP-over-port-22 behavior observed.

Answer

Frequent DNS queries

Answer

HTTP POST requests

Answer

ICMP echo requests