CS0-003 Practice Test 17 — 15 Questions

Question 1

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For business prioritization, Which recommendation gives the best risk-based order of work?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Asset criticality, exposure, and business impact. Remediation priority in vulnerability management is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API server has high business impact and exposure to external threats, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based prioritization frameworks such as CVSS environmental metrics and FAIR analysis.

Answer

The number of installed fonts

Answer

The colour of the scanner dashboard

Answer

Whether the hostname is shorter

Question 2

A security team is implementing CIS Benchmarks for a Linux server. They need to choose between Level 1 and Level 2 benchmarks. Which of the following best describes Level 1 benchmarks?

Accepted Answer

They are basic security settings that can be implemented with minimal disruption. CIS Level 1 benchmarks are defined as basic, essential security settings that can be applied with minimal disruption to functionality and are intended for all systems. They represent a practical baseline that most organizations can implement without extensive testing or performance impact, making them suitable as a starting point for hardening. This matches option A's description of basic settings with minimal disruption.

Answer

They are mandatory for compliance with DoD STIGs

Answer

They are the most restrictive settings, suitable for high-security environments

Answer

They include advanced settings that require extensive testing

Question 3

A security analyst needs to present a risk register to a non-technical board. Which of the following formats is most appropriate?

Accepted Answer

A heat map with risk ratings and business impact descriptions. A heat map with risk ratings and business impact descriptions is most appropriate for a non-technical board because it visually communicates risk severity and business consequences without requiring technical expertise. It translates technical risks into business terms, facilitating informed decision-making.

Answer

A timeline of past incidents

Answer

A list of CVEs with CVSS scores

Answer

A detailed network diagram with vulnerability locations

Question 4

A company wants to prioritize vulnerabilities based on exploitability and impact. Which industry standard framework should the analyst use?

Accepted Answer

CVSS v3. CVSS v3 (Common Vulnerability Scoring System) is the industry-standard framework for prioritizing vulnerabilities based on exploitability and impact. It provides a numerical score (0-10) derived from metrics such as Attack Vector, Attack Complexity, Privileges Required, User Interaction, and Scope, along with Confidentiality, Integrity, and Availability impact. This allows analysts to objectively rank vulnerabilities for remediation.

Answer

OWASP Top 10

Answer

CVE

Answer

NIST SP 800-53

Question 5

A security analyst is configuring a container scanning tool to identify vulnerabilities in Docker images before deployment. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner from Aqua Security specifically designed to scan container images, filesystems, and IaC for vulnerabilities and misconfigurations. It integrates directly with Docker and CI/CD pipelines to detect CVEs in OS packages and application dependencies before deployment. This makes it the correct tool for pre-deployment container image scanning.

Answer

Burp Suite

Answer

Nessus

Answer

OpenVAS

Question 6

An organization is implementing a patch management process for servers. Which of the following is a crucial step that should be performed before deploying patches to production servers?

Accepted Answer

Test the patch in a staging environment that closely mirrors production. Before deploying patches to production servers, the critical step is to test the patch in a staging environment that closely mirrors production, because patches can introduce regressions, break application compatibility, or cause unexpected downtime. Testing in staging validates that the patch works correctly with the organization's specific configurations, dependencies, and workloads before it affects live systems. This is a foundational principle of change management and patch management frameworks.

Answer

Immediately apply the patch to all systems to minimize exposure

Answer

Review the CVSS score to decide if the patch is necessary

Answer

Verify patch compliance by checking the vendor's advisory

Question 7

A company wants to ensure that all servers are patched within 30 days of a critical patch release. The security team must verify compliance without causing downtime. Which of the following is the best approach?

Accepted Answer

Conduct automated vulnerability scanning of the server IP ranges.. Automated vulnerability scanning provides a non-intrusive method to check patch levels without affecting system availability. Manual checks are inefficient; agent-based solutions are effective but may introduce overhead; network segmentation does not verify patch compliance.

Answer

Perform manual patch verification on a rotating schedule.

Answer

Deploy an agent-based patch management solution to all servers.

Answer

Implement network segmentation to isolate unpatched servers.

Question 8

A threat intelligence analyst has produced a report containing specific Indicators of Compromise (IoCs) such as IP addresses, domain names, and file hashes. Which TWO audiences are most appropriate for this type of intelligence? (Select TWO.)

Accepted Answer

SOC analysts. SOC analysts (B) are a primary consumer of tactical IoCs because they monitor SIEM alerts, tune detection rules, and hunt for the listed IP addresses, domains, and file hashes in day-to-day security operations. Incident responders (D) also need these atomic indicators to scope and contain active compromises, for example by searching endpoints for the specified file hashes or blocking the malicious domains and IPs at the perimeter. Both roles operate at the tactical level where concrete, machine-readable indicators drive immediate detection and response actions. By contrast, the board of directors (A) and executive leadership (C) consume strategic intelligence such as risk trends, business impact, and threat landscape summaries, not raw IoCs. Network engineers (E) focus on routing, switching, and infrastructure availability, so while they may implement blocks, they are not a primary audience for interpreting threat intelligence reports.

Answer

Board of directors

Answer

Executive leadership

Answer

Network engineers

Question 9

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a workstation to an external IP address known for command and control (C2) activity. Which classification should the analyst assign to this incident?

Accepted Answer

Malware. The suspicious outbound traffic to a known C2 IP indicates that the workstation is likely infected with malware that is beaconing to its command and control server. This is a classic indicator of a malware infection, where the compromised host communicates with an external entity for instructions or data exfiltration. Therefore, the incident should be classified as malware.

Answer

Insider threat

Answer

Data breach

Answer

Phishing

Question 10

A security team uses the Common Vulnerability Scoring System (CVSS) v3.1 to prioritize vulnerabilities. They find a vulnerability with a base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. However, the asset is a public-facing web server with no backups. The team also checks the Exploit Prediction Scoring System (EPSS) and sees a score of 0.95 (95% probability of exploitation in the next 30 days). Which action should the team take first based on prioritizing by risk?

Accepted Answer

Expedite patch testing and deployment, and consider emergency change procedures. With a CVSS base score of 7.5 (High) affecting a public-facing web server, no backups, and an EPSS score of 0.95 indicating a 95% probability of exploitation within 30 days, the risk is extreme — active exploitation is imminent and recovery would be impossible without backups. The correct first action is to expedite patch testing and deployment while invoking emergency change procedures to compress the normal change-management timeline without abandoning testing. This balances urgency with the operational discipline required to avoid introducing new outages.

Answer

Apply the patch within the next 30 days as part of routine maintenance

Answer

Implement a network-based intrusion prevention system signature to block exploitation attempts

Answer

Deploy the patch immediately in the production environment without testing

Question 11

A SOAR playbook enriches suspicious IP addresses. Which enrichment sources are useful? (Choose two.)

Accepted Answer

Threat intelligence reputation and first-seen date. Threat intelligence reputation feeds (e.g., VirusTotal, AlienVault OTX) provide a risk score and first-seen date for an IP, which helps determine if it is known for malicious activity and how recently it became active. Internal asset and previous-seen telemetry (e.g., from a SIEM or asset management database) reveals if the IP belongs to an internal host or has been observed in past incidents, enabling context-aware response. Both sources directly support enrichment by adding authoritative, actionable data to the playbook.

Answer

Random social media comments about cybersecurity

Answer

Office chair inventory

Question 12

During a vulnerability assessment, a security analyst uses a tool that identifies missing patches and misconfigurations based on CIS Benchmarks. Which of the following tools is specifically designed for compliance scanning against CIS benchmarks?

Accepted Answer

OpenSCAP. OpenSCAP is an open-source implementation of the Security Content Automation Protocol (SCAP) that natively consumes SCAP content, including CIS Benchmarks delivered as XCCDF/OVAL datastreams. It is specifically designed for compliance scanning and remediation against benchmarks like CIS, PCI DSS, and STIG. Running 'oscap xccdf eval' against a CIS benchmark profile produces a compliance report mapped to the benchmark's controls.

Answer

Qualys

Answer

Nessus

Answer

OpenVAS

Question 13

During a post-incident review, a security analyst identifies that the mean time to detect (MTTD) for incidents is significantly higher than the industry benchmark. Which THREE actions should the analyst recommend to improve detection capabilities?

Accepted Answer

Implement additional network monitoring sensors.. Option A is correct because deploying additional network monitoring sensors (e.g., IDS/IPS or network TAP/SPAN-based collectors) increases visibility across network segments, allowing malicious traffic and anomalies to be observed sooner and thereby lowering MTTD. Option B is correct because tuning and expanding SIEM correlation rules with current threat intelligence lets the platform detect multi-event attack patterns and known adversary techniques faster, directly reducing the time between compromise and alerting. Option C is correct because subscribing to threat intelligence feeds enriches alerts with indicators of compromise (IOCs) and contextual data, enabling analysts to recognize and prioritize malicious activity more quickly. Option D is not appropriate because vulnerability scans identify unpatched weaknesses on a scheduled basis and do not provide real-time detection of active intrusions, so they do not materially improve MTTD. Option E is not appropriate because reducing log retention removes historical evidence needed for correlation and forensic analysis, which would likely degrade detection and investigation capabilities rather than improve them.

Answer

Increase the frequency of vulnerability scans.

Answer

Reduce the retention period for logs.

Question 14

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Accepted Answer

Place legal holds on relevant data. Option A is correct because placing legal holds on relevant data preserves logs, backups, and affected systems as potential evidence for forensic investigation, regulatory inquiries, and possible litigation, preventing routine deletion or overwriting. Option D is correct because coordinating with law enforcement (e.g., FBI, Secret Service, or local cybercrime units) is a standard incident-response step that supports evidence handling, threat attribution, and may be legally required or beneficial for the organization. Option E is correct because notifying affected customers as required by law satisfies breach-notification obligations under regulations such as GDPR, HIPAA, or state data-breach statutes, which mandate timely disclosure when personal or protected data is compromised. Option B is not appropriate because deleting logs destroys forensic evidence, violates legal-hold and retention requirements, and impedes incident investigation. Option C is not appropriate because publishing details on social media immediately can compromise the investigation, leak sensitive information, and should instead be handled through a coordinated, approved communications plan.

Answer

Delete all logs to prevent data leakage

Answer

Publish details on social media immediately

Question 15

A security team is implementing container security scanning in their CI/CD pipeline. They want to scan container images for vulnerabilities and Kubernetes misconfigurations. Which THREE tools from the following list are best suited for this purpose? (Select THREE)

Accepted Answer

Trivy. Trivy (B) is a purpose-built container and Kubernetes scanner that detects OS package and language dependency CVEs in images and also checks Kubernetes manifests and cluster configurations for misconfigurations, making it a direct fit for both requirements. Clair (D) is an open-source static analyzer from CoreOS/Quay that inspects container image layers against vulnerability databases, so it is well suited for image vulnerability scanning in a CI/CD pipeline. Snyk (E) provides container image vulnerability scanning plus Kubernetes and IaC misconfiguration detection, and it integrates natively into CI/CD workflows, satisfying both stated goals. Burp Suite (A) is a web application security testing proxy for runtime HTTP traffic, not a container image or Kubernetes configuration scanner, so it does not belong. OpenSCAP (C) is a compliance and vulnerability scanner based on SCAP for hosts and operating systems, not for container image layers or Kubernetes misconfigurations, so it is not the best fit here.

Answer

Burp Suite

Answer

OpenSCAP