CS0-003 Practice Test 18 — 15 Questions

Question 1

A security analyst is reviewing a containerized application for vulnerabilities. The analyst uses a container image scanner and identifies several issues. Which THREE of the following are common container and Kubernetes misconfigurations that the analyst should prioritize? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Overly permissive RBAC configurations. Privileged containers grant excessive permissions, hostPath mounts allow host filesystem access, and overly permissive RBAC can lead to unauthorized actions. Keeping containers updated is important but not a misconfiguration, and network policies are a best practice.

Answer

Keeping container images up to date

Answer

Implementing network policies to restrict pod communication

Question 2

Which of the following is a persistence mechanism that involves modifying the Windows Registry to execute a program when a user logs in?

Accepted Answer

Run key. The 'Run' registry key is commonly used to launch programs automatically at user logon, making it a persistence mechanism.

Answer

Scheduled Task

Answer

Service

Answer

Startup folder

Question 3

In a regulated payment environment, after containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Remove persistence, rotate affected credentials, and verify no related hosts remain compromised. After containing a compromised host, the recovery phase requires removing the persistence mechanism (the scheduled task), rotating the stolen service account credentials to prevent re-authentication, and verifying that no other hosts are compromised via lateral movement. This ensures the threat is fully eradicated before returning the host to production, which is critical in a regulated payment environment where PCI DSS or similar standards mandate thorough remediation.

Answer

Reconnect the host because users need it

Answer

Disable logging to improve performance

Answer

Close the incident after isolation

Question 4

A security analyst is reviewing the output of a vulnerability scan and notices that a critical vulnerability on a Linux server has been reported as 'Confirmed' by the scanner. The analyst checks the system and finds that the actual vulnerability does not exist because a kernel upgrade was applied via a yum update but the scanner did not detect the change. Which of the following is the MOST likely cause?

Accepted Answer

The scanner was not configured with proper credentials for authenticated scanning. The vulnerability scanner reported a 'Confirmed' critical vulnerability that no longer exists after a kernel upgrade via yum. This indicates the scanner performed an unauthenticated scan, relying on banner grabbing or service version detection, which cannot verify the actual installed kernel version. With proper credentials (e.g., SSH keys or a service account), the scanner would have performed an authenticated scan, queried the package manager (rpm -q kernel), and correctly identified that the kernel was updated, thus not flagging the vulnerability.

Answer

The vulnerability database was not updated before the scan

Answer

The scanner is configured to alert on missing patches only

Answer

The scanner's plugins for Linux are outdated

Question 5

A security analyst is performing dynamic malware analysis using a sandbox. The analyst observes that the malware creates a scheduled task that executes a PowerShell command to download a payload from a remote server. Which of the following behavioral IOCs should be prioritized for detection?

Accepted Answer

The creation of a scheduled task. The scheduled task creation is a persistent mechanism that can be detected via monitoring for new scheduled tasks.

Answer

The domain name of the remote server

Answer

The hash of the initial malware sample

Answer

The IP address of the remote server

Question 6

You are a senior security analyst at a mid-sized financial company. The SOC has been alerted by the EDR system about anomalous behavior on a domain controller (DC) that runs Windows Server 2019. The alert indicates that a process named 'svchost.exe' spawned a PowerShell process that executed a one-liner to connect to an external IP address (203.0.113.5) over TCP port 443. Further investigation shows that the DC's event logs have gaps of about 10 minutes each, and the local administrator account 'Administrator' was used to log in from a workstation named 'WKSTN-FIN-12' at the time of the event. The company has strict policies: all administrative access must be via dedicated jump hosts, and privileged accounts are monitored. Upon checking, 'WKSTN-FIN-12' is assigned to an employee in the finance department who has no administrative privileges. The employee reports that they did not log in recently. The CISO wants a swift containment and eradication without losing forensic evidence. Based on this scenario, which of the following is the BEST first course of action?

Accepted Answer

Isolate the domain controller from the network by disabling its network interface.. Isolating the domain controller by disabling its network interface is the best first step because it immediately halts any ongoing malicious communication (e.g., C2 traffic over TCP 443) while preserving the volatile state of the system for forensic acquisition. This action prevents further data exfiltration or lateral movement without destroying evidence like memory or logs, which would occur with a power-down. It also aligns with the CISO's requirement for swift containment without losing forensic evidence.

Answer

Capture a memory dump of the domain controller for offline analysis.

Answer

Power down the domain controller to prevent further damage.

Answer

Reset the password for the local Administrator account and revoke the user's access.

Question 7

During a cloud security investigation, a security analyst notices unusual API calls from a compromised IAM user in AWS. The analyst wants to determine the scope of the breach and identify affected resources. Which TWO cloud-native services should the analyst use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, and GuardDuty provides threat detection. Both are native services for investigation.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config

Question 8

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. The immediate priority is to restrict public read access to the storage bucket to prevent further unauthorized exposure, then determine whether sensitive customer data was accessed by reviewing access logs (e.g., AWS CloudTrail or S3 server access logs). This aligns with incident response best practices: contain the threat first, then assess impact. Without confirming data access, the team cannot properly scope the breach or notify affected parties.

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Answer

Delete all audit logs to reduce liability

Question 9

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Use them internally with only people who need to know and avoid wider redistribution. TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and prohibits any wider redistribution. In the alert triage phase, using the indicators internally ensures the SOC can investigate and respond without violating the information-sharing constraints set by the vendor, which is a mandatory security practice, not optional.

Answer

Ignore the indicators because TLP markings are optional

Answer

Publish the indicators on a public GitHub repository

Answer

Send the indicators to all customers

Question 10

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. The best next step is to validate whether the vulnerable OpenSSL binary is actually exploitable in the container's runtime context (e.g., it may be a statically linked unused library or a dead code path). If the binary is truly unused, the team should still rebuild from a patched base image where feasible to maintain a clean supply chain and avoid false-positive fatigue; if it is used, the vulnerability must be remediated. This balances security rigor with operational pragmatism, aligning with vulnerability management best practices for containerized environments.

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Answer

Ignore all base-image vulnerabilities

Question 11

A security analyst is reviewing the output of a vulnerability scanner that uses CVSS v3.1. The analyst wants to understand the impact metrics. Which THREE of the following are impact metrics in the CVSS v3.1 base score? (Select THREE.)

Accepted Answer

Confidentiality (C). CVSS v3.1 base score includes three impact metrics: Confidentiality (C), Integrity (I), and Availability (A). Attack Vector, Attack Complexity, Privileges Required, etc., are exploitability metrics.

Answer

Scope (S)

Answer

Attack Vector (AV)

Question 12

A security analyst is reviewing the results of a recent vulnerability scan. The analyst needs to prioritize remediation efforts effectively. Which four of the following factors should the analyst consider when prioritizing vulnerabilities? (Choose four.)

Accepted Answer

The existence of publicly available exploit code. The Common Vulnerability Scoring System (CVSS) base score provides a standardized numerical rating (0-10) of a vulnerability's severity, factoring in exploitability and impact metrics. This score helps analysts compare vulnerabilities across different systems and prioritize those with higher potential damage. It is a foundational input for risk-based prioritization, not the sole deciding factor.

Answer

The number of times a vendor has released a patch for the vulnerability

Answer

The color of the vulnerability in the scan report

Question 13

A security analyst discovers that a data breach involving personally identifiable information (PII) of European Union citizens occurred two weeks ago but was not detected until now due to a monitoring gap. The company is subject to GDPR, which requires notification to the relevant supervisory authority within 72 hours of becoming aware of the breach. The analyst reports this to the CISO, who decides to delay notification for another week to prepare a more comprehensive response. The analyst believes this violates regulatory requirements. The analyst has documented the breach details and is concerned about the legal and financial penalties for non-compliance. The company's legal department has a strong compliance focus. The analyst has a duty to escalate within the organization. The organization has a whistleblower policy and an ethics hotline. What should the analyst do?

Accepted Answer

Escalate the matter to the company's legal department and explain the regulatory requirement for timely notification.. The analyst has a duty to escalate within the organization, and the legal department is the appropriate internal authority to address compliance with GDPR's 72-hour notification requirement. By escalating to legal, the analyst ensures the regulatory obligation is formally raised without bypassing internal hierarchy, which aligns with the company's compliance focus and whistleblower policy. This approach balances the CISO's decision with the legal imperative to notify the supervisory authority within the mandated timeframe.

Answer

Document the decision and the delay, then proceed with the notification after one week as instructed.

Answer

Report the incident to the data protection authority (DPA) immediately, bypassing the CISO, as required by GDPR.

Answer

Follow the CISO's orders and delay the notification.

Question 14

A security analyst is evaluating a Kubernetes cluster for misconfigurations. Which TWO of the following are common Kubernetes misconfigurations that increase security risk? (Select the two best answers.)

Accepted Answer

Using hostPath mounts. Privileged containers and hostPath mounts are known high-risk misconfigurations in Kubernetes.

Answer

Running containers as non-root user

Answer

Enabling Role-Based Access Control (RBAC)

Answer

Implementing network policies to restrict traffic

Question 15

An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?

Accepted Answer

Disconnect the network cable from the server.. Disconnecting the network cable (Option B) is the correct short-term containment strategy because it immediately isolates the compromised database server from the network, preventing further lateral movement or data exfiltration, while preserving the volatile system state (memory, running processes, open network connections) for forensic analysis. This action stops active network-based attacks without altering the contents of RAM or disk, which is critical for evidence integrity.

Answer

Reboot the server into safe mode.

Answer

Power off the server to freeze the system state.

Answer

Run a memory dump with WinPmem before any action.