CS0-003 Practice Test 18 — 15 Questions

Question 1

A CSIRT is investigating a ransomware incident that encrypted files on multiple servers. The team needs to determine the initial infection vector. Which THREE pieces of evidence should the team prioritize collecting? (Select three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Email gateway logs for the week prior to the incident. Email gateway logs (A) are essential because phishing emails with malicious attachments or links are the most common initial ransomware vector, and reviewing the week prior to the incident can reveal the delivery of the payload. EDR logs from affected servers (B) provide process-level telemetry such as parent-child process relationships, command lines, and file encryption behavior that can pinpoint the execution of the ransomware and its dropper. Network traffic logs from the perimeter firewall (C) can show command-and-control callbacks, exploit kit traffic, or lateral movement that help trace the infection back to its source. Physical access logs (D) are not relevant to a remote ransomware infection vector and would only matter for insider or physical intrusion scenarios. Firewall configuration backups (E) document rule sets rather than activity, so they do not provide evidence of how the infection occurred.

Answer

Physical access logs to the data center

Answer

Firewall configuration backups

Question 2

A security analyst is prioritizing vulnerabilities discovered during a scan. Which TWO factors should the analyst consider as part of business context to determine remediation priority? (Select TWO.)

Accepted Answer

Asset exposure. Asset exposure (A) is a business-context factor because it describes whether the vulnerable asset is reachable from untrusted networks such as the internet, DMZ, or internal segments, directly affecting the likelihood of exploitation and thus remediation priority. Asset criticality (E) is also business context because it reflects the asset's role and value to the organization—such as processing regulated data, supporting revenue-generating services, or being a domain controller—which determines the business impact if compromised. In contrast, CVSS base score (B) is a technical severity metric derived from intrinsic vulnerability characteristics and does not by itself capture business context. Patch availability (C) is a remediation logistics factor, and exploit availability (D) is a threat-intelligence factor; neither is a business-context input for prioritization.

Answer

CVSS base score

Answer

Patch availability

Answer

Exploit availability

Question 3

A security analyst is prioritizing vulnerabilities for remediation. Which THREE factors from the CISA Known Exploited Vulnerabilities (KEV) catalog should the analyst consider? (Select THREE.)

Accepted Answer

Date the vulnerability was added to the catalog. The CISA KEV catalog entry for each vulnerability includes the date it was added to the catalog (option B), which indicates how long the vulnerability has been known to be actively exploited and helps prioritize remediation urgency. It also lists the vulnerability name or CVE ID (option D), which uniquely identifies the specific flaw so the analyst can map it to affected systems and track remediation. The affected vendor or product (option E) is likewise a core KEV field, telling the analyst which technologies are at risk and whether they are present in the environment. EPSS probability score (option A) is not part of the KEV catalog; it comes from the separate EPSS model maintained by FIRST. CVSS base score (option C) is also not a KEV catalog field; it is published by NVD or the vendor and is not included in KEV entries.

Answer

EPSS probability score

Answer

CVSS base score

Question 4

An incident response team is conducting post-incident activities after a ransomware attack. The team wants to improve detection and response for future incidents. Which TWO actions are most appropriate for updating detection rules? (Select TWO.)

Accepted Answer

Create YARA rules to identify the ransomware file hashes and patterns.. Option C is correct because YARA rules are specifically designed to identify malware based on file hashes, byte patterns, and strings, so creating them from the ransomware samples observed during the incident directly improves future detection of that malware. Option E is correct because updating SIEM correlation rules to detect the observed TTPs (tactics, techniques, and procedures) enables the organization to alert on the attacker's behavior, not just static indicators, which strengthens detection and response for future incidents. Option A is not appropriate here because a tabletop exercise tests response processes and decision-making rather than updating detection rules. Option B does not belong because increasing vulnerability scan frequency addresses vulnerability management, not detection rule improvement. Option D is also not the best fit because sharing IOCs with external platforms contributes to threat intelligence sharing and community defense, but it does not itself update the organization's detection rules.

Answer

Conduct a tabletop exercise for the incident response team.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with external threat intelligence platforms.

Question 5

Arrange the steps for a typical penetration testing engagement in the correct order.

Accepted Answer

Reconnaissance, then Scanning, then Exploitation, then Post-exploitation, then Reporting. Penetration testing follows a structured methodology: recon, scanning, exploitation, post-exploitation, and reporting.

Answer

Scanning, then Reconnaissance, then Exploitation, then Post-exploitation, then Reporting

Answer

Reconnaissance, then Scanning, then Post-exploitation, then Exploitation, then Reporting

Answer

Exploitation, then Scanning, then Reconnaissance, then Post-exploitation, then Reporting

Question 6

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. The best next step is to validate whether the vulnerable OpenSSL binary is actually exploitable in the container's runtime context (e.g., it may be a statically linked unused library or a dead code path). If the binary is truly unused, the team should still rebuild from a patched base image where feasible to maintain a clean supply chain and avoid false-positive fatigue; if it is used, the vulnerability must be remediated. This balances security rigor with operational pragmatism, aligning with vulnerability management best practices for containerized environments.

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Answer

Ignore all base-image vulnerabilities

Question 7

A company uses a mix of Windows and Linux servers. The vulnerability scanner reports a critical remote code execution vulnerability in Apache Struts (CVE-2017-5638) on a web server located in the DMZ. This server is behind a load balancer with an identical twin server that does not appear vulnerable. The security team needs to implement immediate remediation while minimizing downtime. What should the analyst do?

Accepted Answer

Implement a virtual patch via web application firewall (WAF) rules. Implementing a virtual patch via WAF rules can immediately block exploitation attempts against CVE-2017-5638 (Apache Struts) without modifying the server or taking it offline. The WAF inspects HTTP requests for malicious Content-Type headers used in the exploit and drops them, providing protection while the identical twin server remains unaffected and the vulnerable server can be patched later with minimal downtime.

Answer

Re-image the server with a hardened operating system

Answer

Shut down the vulnerable server until a patch can be tested

Answer

Apply the vendor patch immediately during business hours

Question 8

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. When a business owner accepts delayed remediation for a production system, the report must formally document the risk owner, the reason for the delay, any compensating controls in place, a scheduled review date, and an expiry date. This ensures accountability, traceability, and that the risk is not permanently ignored, aligning with risk management frameworks like NIST SP 800-37 or ISO 27001.

Answer

A permanent exception with no review

Answer

Only the analyst's personal opinion

Answer

No mention of the accepted risk

Question 9

A security analyst is using OpenVAS to perform a vulnerability scan of an internal network. The scan completes and generates a report listing several vulnerabilities. What is the next step in the vulnerability lifecycle?

Accepted Answer

Prioritization. After discovery (scanning), the next step is prioritization of vulnerabilities based on risk, exploitability, and business impact.

Answer

Verification

Answer

Reporting

Answer

Remediation

Question 10

During a web application penetration test, a security analyst uses a DAST tool and discovers that the application is vulnerable to Server-Side Request Forgery (SSRF). According to the OWASP Top 10 2021, under which category does SSRF fall?

Accepted Answer

A10: Server-Side Request Forgery (SSRF). In the OWASP Top 10 2021, Server-Side Request Forgery (SSRF) was added as a new category, A10: Server-Side Request Forgery (SSRF). This category specifically addresses vulnerabilities where an attacker can induce the server to make requests to unintended locations, such as internal services or external systems.

Answer

A03: Injection

Answer

A01: Broken Access Control

Answer

A06: Vulnerable and Outdated Components

Question 11

During an incident, which of the following should be the FIRST priority when communicating with law enforcement?

Accepted Answer

Coordinating evidence collection and preservation. Law enforcement may need to preserve evidence for legal proceedings. Coordination ensures that evidence is handled properly and that the organization does not inadvertently destroy or compromise evidence.

Answer

Sharing the incident response plan

Answer

Requesting a warrant for internal investigation

Answer

Providing a list of affected customers

Question 12

A security analyst is investigating a potential data breach and needs to collect evidence from a compromised Windows server. The server is still running, and the analyst wants to capture memory, network connections, and process list without writing unnecessary data to disk. Which of the following sequences of commands (tools) should the analyst use to adhere to order of volatility?

Accepted Answer

memory dump, netstat -an, then tasklist. It follows the order of volatility (OOV) principle, which dictates that the most volatile data (memory) should be captured first, followed by network connections (netstat -an), and then the process list (tasklist). Memory is lost when the system is powered off, so it must be collected before any other evidence. Network connections and process lists are less volatile but still transient, and capturing them after memory ensures minimal data loss while avoiding unnecessary writes to disk that could overwrite evidence.

Answer

tasklist, netstat -an, then memory dump

Answer

memory dump, disk image, then network connections

Answer

netstat -an, tasklist, then memory dump

Question 13

A security analyst is conducting static analysis of a suspicious executable. Which of the following tools or techniques is BEST suited for extracting strings and viewing the import table?

Accepted Answer

PEview or CFF Explorer. Static analysis often involves examining the PE header, imports, and strings. Tools like PEview, CFF Explorer, or simply using 'strings' command can extract readable strings. The import table shows DLLs and functions the executable uses.

Answer

LiME

Answer

FTK Imager

Answer

Cuckoo Sandbox

Question 14

Which log source would best help detect an attacker using a domain generation algorithm (DGA) to communicate with a command and control server?

Accepted Answer

DNS query logs. DNS query logs are the best source because DGA malware generates many pseudo-random domain names and attempts to resolve them to locate its C2 server. These queries appear as high volumes of unique, algorithmically generated domains (e.g., 'ajk3n4lkj.com') that often result in NXDOMAIN responses. Firewall logs only show IP connections, not the domain names, and cloud audit logs track API activity, not DNS. Authentication logs record login events, unrelated to DGA traffic.

Answer

Firewall logs

Answer

Cloud audit logs

Answer

Authentication logs

Question 15

A company's IDS generated an alert for a potential SQL injection attack on a web application. The security analyst reviews the alert and confirms that the application is protected by a Web Application Firewall (WAF) that filters SQL injection attempts. Which of the following is the best course of action?

Accepted Answer

No action needed. The WAF is already configured to filter SQL injection attempts, so the alert from the IDS does not indicate a successful attack. Since the WAF is actively blocking the malicious payload, no additional action is required. The IDS alert is a normal byproduct of the WAF's filtering, and the security analyst should confirm that the WAF is functioning correctly rather than taking unnecessary steps.

Answer

Block the source IP

Answer

Disable the Web Application Firewall

Answer

Create a custom signature