CS0-003 Practice Test 16 — 15 Questions

Question 1

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Asset criticality, exposure, and business impact. Remediation priority is determined by risk, which is a function of asset criticality, exposure, and business impact. The public payment API has high asset criticality (handles sensitive financial data), high exposure (accessible from the internet), and high business impact (breach could cause regulatory fines and revenue loss), whereas the isolated lab server has low exposure and minimal business impact. This aligns with the CVSS environmental score modifiers and NIST SP 800-30 risk assessment methodology.

Answer

The colour of the scanner dashboard

Answer

The number of installed fonts

Answer

Whether the hostname is shorter

Question 2

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The VPN appliance's critical unauthenticated remote-code-execution flaw is actively exploited in the wild, posing an immediate and severe risk to the entire network perimeter. Remediating this first aligns with the vulnerability management principle of prioritizing by risk severity and exploitability, as an internet-facing device with a known active exploit bypasses all authentication controls and can lead to full compromise. Patching or mitigating it directly removes the exposure without obscuring the risk, unlike compensating controls that might hide the underlying weakness.

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Start with the oldest medium vulnerability

Answer

Defer all remediation until the monthly patch window

Question 3

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

MFA fatigue or push-bombing attack. Option C is correct because the scenario describes MFA fatigue (also called push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This exploits human behavior rather than a technical vulnerability, and is a common initial access vector in credential-stuffing or password-spraying campaigns. The root-cause analysis would directly identify the repeated unsolicited MFA prompts as the mechanism that led to unauthorized approval.

Answer

Password spraying only

Answer

DNS tunnelling

Answer

SSL certificate expiry

Question 4

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Option B is correct because container runtime events (e.g., Docker/containerd exec logs) capture the unexpected shell launch, Kubernetes audit logs record the pod creation and mount operations, and network flow logs (e.g., NetFlow, eBPF-based tools) reveal the outbound connection to the unknown IP. Together, these provide the granular, real-time telemetry needed to detect and investigate the compromise, unlike static or coarse-grained logs.

Answer

Only physical datacenter access logs

Answer

Only monthly vulnerability scan summaries

Answer

Only user password age reports

Question 5

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option C is correct because the immediate priority is to eliminate the public read access vulnerability to prevent further unauthorized data exposure. After restricting access, the team must determine whether sensitive data was accessed by reviewing access logs (e.g., AWS CloudTrail or GCP Audit Logs) to assess the scope of potential breach, which is a standard incident response step. This approach directly mitigates the weakness without concealing risk, aligning with vulnerability management best practices.

Answer

Wait for the next quarterly review

Answer

Delete all audit logs to reduce liability

Answer

Rotate database administrator passwords only

Question 6

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. Option A is correct because the UEBA rule indicates a possible account compromise (impossible travel followed by mailbox rule creation). The analyst must first verify the sign-in logs for authentication source IPs, MFA result to check if the attacker bypassed MFA, device details to identify if a known device was used, and mailbox audit events to confirm the forwarding rule. These four data sources provide the minimum evidence needed to assess the scope of compromise before containment.

Answer

The organisation's public DNS zone file

Answer

Only the user's browser cache

Answer

Only DHCP logs from the London office

Question 7

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Suricata or Snort in IDS mode on a monitored network tap or SPAN port. Option C is correct because the requirement is to detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Suricata or Snort in IDS (Intrusion Detection System) mode, deployed on a network tap or SPAN port, passively analyzes packet payloads against signatures and generates alerts without any inline blocking action. This matches the 'detect only, no block' requirement exactly.

Answer

Inline IPS mode with drop rules for all signatures

Answer

A vulnerability scanner run once per quarter

Answer

Host-based file integrity monitoring only

Question 8

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Log normalization and field mapping in the parser. Option C is correct because inconsistent field mapping (source IP, user, action) prevents the SIEM from correlating events correctly. Log normalization via a parser ensures that fields from the new cloud log source are transformed into a consistent schema (e.g., ECS or CIM), enabling analytics to function. Without fixing the parser, the data remains unusable regardless of other configuration changes.

Answer

Increase the dashboard refresh interval

Answer

Move logs to cold storage immediately

Answer

Disable all enrichment lookups

Question 9

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Log normalization and field mapping in the parser. Option D is correct because inconsistent field mapping (source IP, user, action) prevents the SIEM from correlating and analyzing log data. The engineer must fix the log parser to normalize these fields into a consistent schema, ensuring that enrichment lookups and analytics function correctly. This aligns with the Security Operations domain focus on data ingestion and parsing.

Answer

Disable all enrichment lookups

Answer

Increase the dashboard refresh interval

Answer

Move logs to cold storage immediately

Question 10

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Sigma rule. Sigma rules are platform-agnostic, portable detection signatures written in YAML that can be automatically converted into queries for multiple SIEM platforms (Splunk, QRadar, Elastic, etc.). This makes them the ideal choice for a threat hunter who needs a single detection artifact for suspicious rundll32 execution that can be deployed across different SIEM environments without manual rewriting.

Answer

CVSS vector string

Answer

YARA rule

Answer

OpenIOC package only

Question 11

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option C is correct because the best next step is to validate whether the vulnerable OpenSSL binary is actually reachable or exploitable in the running container, and then rebuild from a patched base image if feasible. This balances security with business priorities by avoiding unnecessary rebuilds for non-exploitable vulnerabilities while ensuring that truly exploitable CVEs are remediated. Simply ignoring or renaming the tag does not address the underlying risk and violates secure CI/CD practices.

Answer

Ignore all base-image vulnerabilities

Answer

Only rename the image tag

Answer

Ship the image and document nothing

Question 12

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Option C is correct because correlating DNS query logs with endpoint process and network connection telemetry provides direct evidence of command-and-control (C2) beaconing. The algorithmically generated domains (DGA) and NXDOMAIN responses are characteristic of malware that generates many domains to evade static blocklists, but only a few are actually registered by the attacker. By mapping the DNS queries to the specific process that initiated them (via endpoint telemetry) and the subsequent network connections (e.g., to the resolved IP of a successful DGA domain), the analyst can confirm C2 activity rather than just anomalous DNS traffic.

Answer

Block all DNS traffic from the subnet

Answer

Search only for successful HTTP 200 responses

Answer

Delete the host from the SIEM asset inventory

Question 13

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Correlate flow volume with database audit logs and the destination reputation. Option C is correct because correlating the outbound flow volume with database audit logs allows you to verify whether the encrypted transfers correspond to legitimate database activity (e.g., scheduled backups or replication) or unauthorized data exfiltration. Checking the destination autonomous system's reputation against threat intelligence feeds (e.g., known C2 infrastructure or bulletproof hosting) provides immediate context on whether the traffic is malicious. This dual-correlation approach gives the highest triage value by confirming or refuting the detection without disrupting operations.

Answer

Disable all outbound internet access for the organisation

Answer

Delete historical flow records to reduce SIEM cost

Answer

Assume encryption means the transfer is safe

Question 14

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option B is correct because a technical remediation section for an OpenSSL vulnerability must include specific, actionable steps: affected assets and package versions to identify scope, patch commands or vendor guidance to apply the fix, a validation method (e.g., openssl version -a or a vulnerability scanner) to confirm remediation, and rollback notes for safety. This ensures the SOC manager can direct the server team with precise, auditable instructions, aligning with the Reporting and Communication domain's requirement for clear, technical content in incident response.

Answer

Only estimated financial loss

Answer

Only the CVE headline

Answer

Only a red/yellow/green chart

Question 15

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Environmental scoring and compensating-control review. Option B is correct because CVSS base scores assume a default, worst-case environment. For a vulnerability with a 9.8 base score that is only reachable from a restricted admin subnet, an environmental scoring (CVSS v3.1 Environmental Metric Group) adjusts the severity based on the actual attack surface, and a compensating-control review documents whether existing controls (e.g., network ACLs, jump-box restrictions) mitigate the risk. This analysis is essential for stakeholder management to justify the risk acceptance or remediation priority, and the resulting documentation (e.g., risk acceptance form signed by the authorizing official) keeps the program defensible under audit.

Answer

Use only the vendor marketing page

Answer

Change all findings to low severity

Answer

Ignore the vulnerability because it is internal