CS0-003 Practice Test 17 — 15 Questions

Question 1

A security team is deploying a new web application and wants to ensure it follows secure configuration practices. Which THREE of the following are recommended configuration settings according to CIS benchmarks for web servers? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable directory listing. Disabling directory listing, removing default accounts, and enforcing HTTPS are common secure configuration practices recommended by CIS benchmarks.

Answer

Use HTTP instead of HTTPS

Answer

Enable automatic directory browsing

Question 2

After a security incident, which component of the incident report provides a chronological sequence of events from detection to recovery?

Accepted Answer

Timeline. The timeline is a critical component that shows the order of events during an incident.

Answer

Lessons learned

Answer

Root cause

Answer

Impact assessment

Question 3

A company wants to prioritize vulnerabilities based on exploitability and impact. Which industry standard framework should the analyst use?

Accepted Answer

CVSS v3. CVSS v3 (Common Vulnerability Scoring System) is the industry-standard framework for prioritizing vulnerabilities based on exploitability and impact. It provides a numerical score (0-10) derived from metrics such as Attack Vector, Attack Complexity, Privileges Required, User Interaction, and Scope, along with Confidentiality, Integrity, and Availability impact. This allows analysts to objectively rank vulnerabilities for remediation.

Answer

OWASP Top 10

Answer

CVE

Answer

NIST SP 800-53

Question 4

An organization is implementing a new security incident response plan and wants to establish clear communication protocols. Which three of the following are essential components of effective incident communication? (Choose three.)

Accepted Answer

Defining a single point of contact (POC) for each stakeholder group. Defining a single point of contact (POC) for each stakeholder group ensures clear, controlled communication and prevents conflicting information. Pre-approved templates for different incident types enable rapid, consistent, and accurate notifications without needing to craft messages from scratch during a crisis. An escalation matrix with authority levels ensures that decisions are made by the appropriate personnel based on incident severity, preventing delays and unauthorized actions.

Answer

Including all employees in every incident notification to ensure transparency

Answer

Automatically releasing incident details to the press within one hour

Answer

Using only email for all incident updates to maintain a written record

Question 5

A user reports approving an unexpected OAuth consent prompt for an app named 'Invoice Reader'. The app now has mailbox read permissions. What should the incident responder do first? During detection and analysis, which decision is most defensible?

Accepted Answer

Revoke the app grant, review mailbox access, and identify other users who consented. The incident responder must first revoke the malicious OAuth app grant to immediately stop the attacker's access via the delegated mailbox permissions. Following revocation, reviewing mailbox access logs (e.g., Mailbox Audit Log, EWS/Graph API calls) is essential to assess the scope of compromise, and identifying other users who consented to the same app is critical to contain lateral movement. This aligns with the NIST SP 800-61 incident response lifecycle's containment and eradication phase.

Answer

Ignore it if MFA is enabled

Answer

Delete all emails from the mailbox

Answer

Only reset the user's Windows password

Question 6

While supporting a hybrid workforce, a web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Web-shell activity on a web server is best confirmed by correlating web access logs showing unusual query parameters with file timestamps indicating the creation of a new executable file, process execution logs revealing the web service account spawning a shell (e.g., cmd.exe or /bin/sh), and outbound connections from that account to an external IP—this multi-source evidence chain directly matches the behavior of a web shell executing commands via HTTP GET/POST parameters. During recovery, the most defensible decision is to isolate the server and preserve these logs as forensic artifacts, guided by the evidence of unauthorized command execution and outbound C2 traffic.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata

Question 7

A company uses a mix of Windows and Linux servers. The vulnerability scanner reports a critical remote code execution vulnerability in Apache Struts (CVE-2017-5638) on a web server located in the DMZ. This server is behind a load balancer with an identical twin server that does not appear vulnerable. The security team needs to implement immediate remediation while minimizing downtime. What should the analyst do?

Accepted Answer

Implement a virtual patch via web application firewall (WAF) rules. Implementing a virtual patch via WAF rules can immediately block exploitation attempts against CVE-2017-5638 (Apache Struts) without modifying the server or taking it offline. The WAF inspects HTTP requests for malicious Content-Type headers used in the exploit and drops them, providing protection while the identical twin server remains unaffected and the vulnerable server can be patched later with minimal downtime.

Answer

Re-image the server with a hardened operating system

Answer

Shut down the vulnerable server until a patch can be tested

Answer

Apply the vendor patch immediately during business hours

Question 8

During a forensic investigation, an analyst needs to acquire volatile memory from a compromised Linux server running a critical application. The server cannot be powered off. Which tool should the analyst use to capture memory with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that captures memory with minimal footprint, suitable for live acquisition on Linux systems.

Answer

avml

Answer

WinPmem

Answer

dd

Question 9

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. The most reliable way to validate whether TLS 1.0 is truly disabled is to perform an active, negotiated test using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to connect using only TLS 1.0. This bypasses any potential misconfiguration in the scanner's service detection or version negotiation logic, and directly confirms whether the server accepts a TLS 1.0 handshake. Relying solely on the scanner's banner grab or the owner's assertion can miss cases where the server still supports the protocol on certain ports or under specific cipher suites.

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Answer

Close the finding because the owner disagrees

Question 10

A security analyst is investigating a potential data breach and needs to collect evidence from a compromised Windows server. The server is still running, and the analyst wants to capture memory, network connections, and process list without writing unnecessary data to disk. Which of the following sequences of commands (tools) should the analyst use to adhere to order of volatility?

Accepted Answer

memory dump, netstat -an, then tasklist. It follows the order of volatility (OOV) principle, which dictates that the most volatile data (memory) should be captured first, followed by network connections (netstat -an), and then the process list (tasklist). Memory is lost when the system is powered off, so it must be collected before any other evidence. Network connections and process lists are less volatile but still transient, and capturing them after memory ensures minimal data loss while avoiding unnecessary writes to disk that could overwrite evidence.

Answer

tasklist, netstat -an, then memory dump

Answer

memory dump, disk image, then network connections

Answer

netstat -an, tasklist, then memory dump

Question 11

A company's IDS generated an alert for a potential SQL injection attack on a web application. The security analyst reviews the alert and confirms that the application is protected by a Web Application Firewall (WAF) that filters SQL injection attempts. Which of the following is the best course of action?

Accepted Answer

No action needed. The WAF is already configured to filter SQL injection attempts, so the alert from the IDS does not indicate a successful attack. Since the WAF is actively blocking the malicious payload, no additional action is required. The IDS alert is a normal byproduct of the WAF's filtering, and the security analyst should confirm that the WAF is functioning correctly rather than taking unnecessary steps.

Answer

Block the source IP

Answer

Disable the Web Application Firewall

Answer

Create a custom signature

Question 12

A security analyst is reviewing a CASB alert indicating a user is accessing a cloud storage application from an unusual location. The analyst needs to investigate further. Which TWO actions are most appropriate?

Accepted Answer

Review the cloud application's audit logs for file access or sharing events. Checking the user's recent authentication logs can confirm if the access was legitimate. Reviewing the cloud application's audit logs can provide details on the activities performed. The other options are less relevant or too broad.

Answer

Disable the user's account immediately

Answer

Reset the user's password without further analysis

Answer

Block all access to the cloud application from that location

Question 13

After a high-priority SOC escalation, an incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Specific playbook updates, escalation triggers, owners, and due dates. A post-incident review (PIR) should produce actionable improvements, not generic statements or blame. Specific playbook updates, escalation triggers, owners, and due dates directly address the delayed escalation by refining incident response procedures, ensuring future incidents are escalated faster and with clear accountability. This aligns with NIST SP 800-61 Rev. 2 guidance on lessons learned and process improvement.

Answer

A generic statement that security is important

Answer

Deletion of all incident tickets

Answer

A blame list of individual analysts

Question 14

An organization uses CIS Benchmarks to secure its Linux servers. The security team applies Level 1 benchmarks. Which of the following best describes Level 1 CIS benchmarks?

Accepted Answer

Basic security configurations with minimal operational impact. CIS Level 1 benchmarks are basic security configurations that cause minimal disruption to business operations. Level 2 is more restrictive and may impact functionality.

Answer

Advanced security settings that may reduce functionality

Answer

Required for all internet-facing systems

Answer

Only applicable to DoD environments

Question 15

Which of the following is the BEST description of configuration drift?

Accepted Answer

The gradual deviation of a system's configuration from the intended baseline. Configuration drift refers to the gradual change in system configurations over time, causing deviations from the baseline or security standards.

Answer

A planned change to a system's configuration

Answer

The process of reverting a system to its baseline configuration

Answer

A vulnerability that is patched and then reappears