CS0-003 Practice Test 19 — 15 Questions

Question 1

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Answer

Give all users local admin rights

Question 2

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. The deception credential is a honeytoken—a fake credential placed in a file share to detect unauthorized use. Since no legitimate user should know it, any authentication attempt using it indicates an attacker has accessed the file share (credential access) and is attempting to move laterally (lateral movement). This warrants high-priority investigation because it directly signals a breach in progress.

Answer

The SIEM parser is always broken

Answer

A scheduled password rotation completed successfully

Answer

The file share requires more storage capacity

Question 3

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Suricata or Snort in IDS mode on a monitored network tap or SPAN port. Option C is correct because Suricata or Snort configured in IDS (Intrusion Detection System) mode on a monitored network tap or SPAN port passively inspects packet payloads against signatures and generates alerts without blocking traffic. This matches the requirement to detect exploit traffic and alert, not block. IDS mode uses a copy of the traffic, so it cannot drop packets, fulfilling the 'without blocking traffic' constraint.

Answer

Host-based file integrity monitoring only

Answer

Inline IPS mode with drop rules for all signatures

Answer

A vulnerability scanner run once per quarter

Question 4

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. Option B is correct because when a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally accept the risk through documented risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This aligns with the NIST SP 800-53 risk management framework and ensures auditability and accountability for the unpatched vulnerability.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 5

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it specifically scans open-source libraries for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures that vulnerable dependencies are detected automatically before code is deployed, enabling early remediation without manual overhead.

Answer

Physical badge access reviews

Answer

Wireless spectrum analysis

Answer

Database transaction log backups

Question 6

A legal hold is issued during an investigation. Which actions support it? (Choose two.)

Accepted Answer

Preserve relevant logs, mailboxes, images, and tickets. A legal hold (litigation hold) requires preservation of all potentially relevant electronically stored information (ESI). Preserving logs, mailboxes, images, and tickets ensures that data is not altered or deleted, maintaining its integrity for forensic analysis and legal proceedings. This action directly supports the hold by preventing spoliation and ensuring compliance with discovery obligations.

Answer

Let each team decide informally what to delete

Answer

Purge audit logs to save storage

Question 7

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it specifically scans open-source libraries and their dependencies for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures that vulnerable libraries are identified automatically before the code is deployed, aligning with the shift-left security principle.

Answer

Wireless spectrum analysis

Answer

Database transaction log backups

Answer

Physical badge access reviews

Question 8

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option B is correct because the scanner may have detected TLS 1.0 due to a false positive from a misconfigured cipher suite or a server-side protocol negotiation artifact. Manually testing with a TLS client (e.g., OpenSSL s_client -tls1) or a scanner profile that explicitly negotiates protocol versions provides definitive evidence of whether TLS 1.0 is actually enabled, resolving the discrepancy between the scanner result and the owner's claim.

Answer

Close the finding because the owner disagrees

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Question 9

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. The SIEM alert describes a workstation requesting a high number of Kerberos service tickets (TGS-REQ) for many different Service Principal Names (SPNs) without subsequent service access. This is classic Kerberoasting reconnaissance: an attacker with valid domain credentials (e.g., after initial compromise) requests TGS tickets for accounts with SPNs, then extracts and cracks the NTLM hash embedded in the ticket offline. The lack of service access confirms the tickets were harvested for offline cracking, not for legitimate use.

Answer

ARP spoofing

Answer

Pass-the-hash using NTLM only

Answer

DNS cache poisoning

Question 10

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. A is correct because a failed alert integration indicates a gap in operational ownership, which must be resolved by assigning a named owner, setting a due date, defining acceptance criteria, and planning a retest. This ensures accountability and verifies that the integration is properly restored and monitored, preventing recurrence. Without these elements, the corrective action lacks closure and measurable success criteria.

Answer

No action because the incident is closed

Answer

Deletion of the integration record

Answer

A vague recommendation to improve security

Question 11

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option C is correct because a technical remediation section must provide actionable steps for the server team to fix the OpenSSL vulnerability. It includes affected assets (specific Linux hosts), package versions (e.g., openssl-1.1.1k), patch commands (e.g., 'yum update openssl' or 'apt-get upgrade openssl'), vendor guidance (e.g., Red Hat or Ubuntu advisories), validation method (e.g., 'openssl version' or 'openssl version -a'), and rollback notes (e.g., 'yum history undo' or snapshot restore). For a business service owner, this content is most appropriate because it translates technical actions into clear, auditable steps that demonstrate risk mitigation and operational planning.

Answer

Only estimated financial loss

Answer

Only a red/yellow/green chart

Answer

Only the CVE headline

Question 12

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Without credentials, a vulnerability scanner can only perform unauthenticated checks, which miss many Windows patch vulnerabilities that require registry or file-level access. Running authenticated scans with least-privilege credentials allows the scanner to query the Windows Update Agent API and check installed KBs, providing accurate patch data. This directly addresses the security manager's concern about missing patch data.

Answer

Disable host firewalls permanently

Answer

Increase only the port range

Answer

Trust the unauthenticated result as complete

Question 13

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. Option C is correct because a post-incident report identifying an unowned failed alert integration requires a corrective action that assigns clear accountability and a measurable remediation plan. Naming an owner, setting a due date, defining acceptance criteria, and scheduling a retest ensure the integration is properly configured and monitored, directly addressing the root cause of the alert failure. This aligns with the NIST Incident Response Lifecycle's post-incident activity phase, which mandates actionable follow-up items to prevent recurrence.

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Answer

No action because the incident is closed

Question 14

A SIEM correlation rule for impossible travel is creating noise from VPN users. Which refinements should improve fidelity? (Choose two.)

Accepted Answer

Require a second signal such as new device, failed MFA, or mailbox rule creation. Option B is correct because requiring a second signal—such as a new device, failed MFA, or mailbox rule creation—adds an additional layer of verification that helps confirm the user's identity and intent. This reduces false positives from VPN users whose IP addresses may change rapidly, as the SIEM can now correlate the impossible travel event with other suspicious activities that indicate a genuine compromise rather than a legitimate VPN connection.

Answer

Disable all identity alerts

Answer

Treat every VPN login as malicious

Question 15

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option C is correct because a technical remediation section must provide actionable steps for the remediation owner. This includes identifying affected assets and package versions, specifying patch commands or vendor guidance, outlining a validation method to confirm the fix, and including rollback notes in case the patch causes issues. Without these details, the remediation owner cannot execute the fix reliably or verify its success.

Answer

Only a red/yellow/green chart

Answer

Only the CVE headline

Answer

Only estimated financial loss