CS0-003 Practice Test 19 — 15 Questions

Question 1

An organization uses CIS Benchmarks to secure its Linux servers. The security team applies Level 1 benchmarks. Which of the following best describes Level 1 CIS benchmarks?

Accepted Answer

Basic security configurations with minimal operational impact. CIS Benchmarks Level 1 profiles consist of basic security configurations that are essential for any system and have minimal impact on functionality. They are considered the minimum baseline and are safe to apply to most systems without disrupting operations.

Answer

Advanced security settings that may reduce functionality

Answer

Required for all internet-facing systems

Answer

Only applicable to DoD environments

Question 2

An analyst is investigating a host that communicates with a domain using a DGA-like algorithm. The domain name appears random and resolves to different IPs over time. Which threat-hunting technique would best identify the DGA pattern?

Accepted Answer

DNS log analysis for entropy and frequency. DGA domains can be detected by analyzing DNS query patterns for algorithmic generation, often using frequency analysis or ML models.

Answer

Sigma rule on process creation events

Answer

NetFlow analysis for data volume

Answer

YARA rule matching on process memory

Question 3

A security analyst is configuring a vulnerability scanner for internal infrastructure. Management wants to minimize disruption to critical systems while ensuring accurate results. Which scan configuration should the analyst recommend?

Accepted Answer

Credentialed agent-based scans during off-peak hours. Credentialed scans provide more accurate results by accessing the system deeply, but they can cause load. Agent-based scans reduce network load and allow scheduling, minimizing disruption.

Answer

Non-credentialed scans during business hours

Answer

External scans only

Answer

Continuous non-credentialed scans

Question 4

During a cloud security investigation, an analyst notices that an AWS IAM user generated multiple 'CreateKeyPair' API calls from an IP address outside the corporate network. Which AWS service is best suited to detect this type of anomalous behavior?

Accepted Answer

AWS GuardDuty. AWS GuardDuty uses machine learning and threat intelligence to detect anomalous API activity, including unauthorized key creation, via CloudTrail logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 5

A security analyst is using Nessus to scan a network. The scan completes and reports a vulnerability with a CVSS v3.1 base score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is a low-information disclosure issue that reveals the server's internal IP address in HTTP headers. The asset is a public-facing web server. Which of the following best describes the risk level and appropriate response?

Accepted Answer

Medium risk; schedule a configuration change to remove the header during the next maintenance window.. The CVSS score is 5.3 (Medium) with low impact on confidentiality and no impact on integrity or availability. Although it is a public-facing server, the risk is low because the information disclosed is minimal (internal IP), which may already be known or easily guessable. The appropriate response is to schedule remediation during normal maintenance, not an emergency.

Answer

Low risk; no action needed because internal IP disclosure is not a vulnerability.

Answer

Critical risk because the server is public-facing; immediate patching is required.

Answer

High risk due to public exposure; apply an emergency patch to hide the header.

Question 6

An analyst suspects a process hollowing attack on an endpoint. Which of the following EDR telemetry findings would best support this hypothesis?

Accepted Answer

A legitimate process (e.g., svchost.exe) created in a suspended state and later resumed with changed memory contents. Process hollowing involves creating a legitimate process in a suspended state, then replacing its memory with malicious code. This leaves the original path unchanged but the process may exhibit unusual child process behavior.

Answer

A process with the same name as a Windows system process but running from a temporary directory

Answer

A process injecting code into a legitimate running process

Answer

An unknown process making network connections to multiple internal IPs

Question 7

An organization is implementing a patch management process and wants to track compliance. They deploy patches to a test group of systems before rolling out to the entire environment. After patching the test group, they run a vulnerability scan and find that 95% of the vulnerabilities are resolved. What should the organization do next?

Accepted Answer

Verify the patch on test systems and then proceed with full deployment through change management.. After successful testing, the next step is to deploy the patch to the rest of the environment, following change management procedures.

Answer

Run another scan on the test group in a week to confirm persistence.

Answer

Immediately deploy the patch to all systems without further testing.

Answer

Skip full deployment and rely on the test group results.

Question 8

During a ransomware incident, the incident response team needs to preserve evidence before containment. Which of the following actions should be performed BEFORE isolating the infected system from the network?

Accepted Answer

Capture the contents of RAM.. The order of volatility requires capturing volatile data like RAM before shutting down or isolating the system, as isolation may alter or lose memory contents.

Answer

Run an antivirus scan.

Answer

Disable the network interface.

Answer

Capture a forensic image of the hard drive.

Question 9

A security analyst is reviewing a CASB alert indicating a user is accessing a cloud storage application from an unusual location. The analyst needs to investigate further. Which TWO actions are most appropriate?

Accepted Answer

Review the cloud application's audit logs for file access or sharing events. Checking the user's recent authentication logs can confirm if the access was legitimate. Reviewing the cloud application's audit logs can provide details on the activities performed. The other options are less relevant or too broad.

Answer

Disable the user's account immediately

Answer

Reset the user's password without further analysis

Answer

Block all access to the cloud application from that location

Question 10

A security analyst is reviewing NetFlow data and notices a significant amount of traffic from an internal host to a known malicious IP address on port 443. What tool would be most effective for further analyzing the payload of this traffic?

Accepted Answer

Wireshark. Wireshark captures and analyzes packet payloads, which is necessary for examining the content of encrypted or unencrypted traffic.

Answer

Nikto

Answer

Nmap

Answer

tcpdump

Question 11

A vulnerability scan report shows a critical vulnerability with a CVSS score of 9.8 on a web server. However, the server is only accessible from internal IP addresses and is protected by a Web Application Firewall (WAF) that blocks the attack vector. Which of the following should the analyst recommend?

Accepted Answer

Accept the risk due to compensating controls.. Compensating controls like a WAF that effectively blocks the attack reduce the risk. While patching is ideal, the vulnerability may not be immediately exploitable due to the WAF.

Answer

Disable the WAF to test the vulnerability.

Answer

Immediately patch the server during business hours.

Answer

Run an uncredentialed scan to confirm the vulnerability.

Question 12

During forensic analysis of a compromised Linux server, an analyst needs to acquire memory evidence. The server is running and the analyst has root access. Which of the following tools should the analyst use to capture the contents of RAM with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that dumps memory and is designed to minimize footprint. It is commonly used for Linux memory acquisition.

Answer

WinPmem

Answer

FTK Imager

Answer

dd if=/dev/mem of=mem.dump

Question 13

A security analyst is reviewing a SIEM alert for a single failed login attempt from an internal IP address to a file server. The analyst determines this is a false positive. Which step should the analyst take next?

Accepted Answer

Tune the alert to suppress similar events. After confirming a false positive, the analyst should tune the alert to reduce noise. This may involve adjusting thresholds or whitelisting the source.

Answer

Escalate to a senior analyst

Answer

Disable the SIEM alert permanently

Answer

Create a correlation rule to link with other events

Question 14

A detection engineer is writing a Sigma rule for suspicious rundll32 usage. Which fields should be included? (Choose two.)

Accepted Answer

Command line containing unusual DLL path or URL pattern. Sigma rules for suspicious rundll32 usage focus on detecting abnormal command-line arguments, such as DLL paths from unusual locations (e.g., temp directories, network shares) or URLs that indicate remote payload retrieval. The 'Command line' field is critical because rundll32.exe is a legitimate Windows binary often abused by attackers to execute malicious DLLs, and anomalous patterns in its arguments are a strong indicator of compromise.

Answer

Desk phone extension

Answer

Laptop battery health

Question 15

A security analyst is using a DAST tool to test a web application. Which of the following vulnerabilities would the tool most likely identify?

Accepted Answer

SQL injection. DAST tools interact with the running application and can detect vulnerabilities like SQL injection by sending malicious inputs and observing responses.

Answer

Hardcoded credentials in source code

Answer

Outdated library versions

Answer

Insecure cryptographic algorithms in configuration