CS0-003 Practice Test 19 — 15 Questions

Question 1

A security analyst is performing an API vulnerability test using OWASP ZAP. The analyst finds several issues. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Broken Object Level Authorization. Broken object level authorization, excessive data exposure, and broken authentication are common API vulnerabilities listed in OWASP API Security Top 10.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 2

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. The immediate priority is to contain the data exposure by restricting public access to the storage bucket, then investigate whether sensitive data was actually accessed by unauthorized parties. This aligns with the vulnerability management principle of 'contain first, investigate second' and addresses the risk of data exfiltration without waiting for a scheduled review or performing unrelated actions.

Answer

Delete all audit logs to reduce liability

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Question 3

A cybersecurity analyst is preparing a post-incident report for a data breach that affected multiple business units. Which three of the following elements should be included in the report to ensure effective communication and support future prevention? (Choose three.)

Accepted Answer

Root cause analysis and contributing factors. A detailed timeline of the incident, including detection and response actions, is correct because it provides a chronological record essential for understanding the sequence of events, assessing response effectiveness, and meeting regulatory reporting requirements. Root cause analysis and contributing factors are correct because they identify the underlying technical or procedural failures (e.g., unpatched vulnerability, misconfigured firewall rule) that must be addressed to prevent recurrence. Recommendations for remediation and process improvements are correct because they translate findings into actionable steps, such as implementing multi-factor authentication or updating incident response playbooks, which directly support future prevention.

Answer

The raw packet capture data from the breach period

Answer

A list of all employees’ personal contact information for notification

Answer

The specific usernames and passwords of affected accounts

Question 4

A security analyst needs to report a critical vulnerability to the executive team. The report should balance technical details with business impact. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in terms of potential business impact and recommended risk treatment. It directly addresses the core requirement of balancing technical details with business impact. For a critical vulnerability, the executive team needs to understand the potential financial, operational, and reputational risks, not just the technical flaw. This approach aligns with the NIST risk management framework, which emphasizes communicating risk in terms of business context to enable informed decision-making on risk treatment (e.g., accept, mitigate, transfer, avoid).

Answer

Simply state the vulnerability exists and a patch is available

Answer

Write a 50-page report covering every technical detail and mitigation option

Answer

Provide a full technical analysis of the vulnerability and remediation steps

Question 5

A company uses a centralized logging solution. A security analyst receives a log from a host indicating a user account 'jsmith' was created locally on a server. The analyst suspects this is a backdoor account. Which of the following log sources would provide the most context to confirm the creation method and identify the responsible process?

Accepted Answer

Sysmon Event ID 1 (Process creation). Sysmon Event ID 1 captures every process creation event with detailed command-line arguments, parent process information, and hashes. This allows the analyst to see exactly which executable (e.g., net.exe, powershell.exe, or a custom script) created the 'jsmith' user account and what command-line parameters were used, providing definitive evidence of the creation method and responsible process.

Answer

Network logs

Answer

Application logs

Answer

Windows Security Event Logs (Event ID 4720)

Question 6

What is the net effect of the policy shown in the exhibit on requests from an IP address in the 10.0.0.0/8 range?

Accepted Answer

Denies all S3 actions from all IP addresses.. The exhibit shows an AWS S3 bucket policy with a Deny effect for all S3 actions (s3:*) from any IP address (the condition block uses a NotIpAddress condition with the value 10.0.0.0/8, meaning the deny applies to all IPs that are NOT in that range). However, because the policy explicitly denies all actions for all IPs not in 10.0.0.0/8, and there is no corresponding Allow statement for the 10.0.0.0/8 range, the net effect is that all S3 actions are denied from all IP addresses, including those in 10.0.0.0/8. This is because AWS IAM policies default to implicit deny, and an explicit deny overrides any allow, so without an explicit allow for the 10.0.0.0/8 range, the deny applies universally.

Answer

Allows all S3 actions from the 10.0.0.0/8 range and denies from other IPs.

Answer

Denies all S3 actions except GetObject from the 10.0.0.0/8 range.

Answer

Allows GetObject requests from the 10.0.0.0/8 range and denies all other S3 actions.

Question 7

Based on the exhibit, which type of issue is most likely affecting the server's network performance?

Accepted Answer

Faulty network cable or interface. The exhibit shows excessive CRC errors and runts on the server's network interface, which are classic symptoms of a faulty physical layer component such as a damaged cable or failing NIC. These errors indicate that frames are being corrupted during transmission, and the interface is discarding them, leading to retransmissions and degraded performance. A faulty cable or interface directly causes these physical-layer issues, unlike configuration or driver problems.

Answer

Duplex mismatch between the server and switch

Answer

Incorrect TCP/IP configuration

Answer

Outdated network driver

Question 8

A security analyst notices that an IDS is generating a high number of false positives for legitimate encrypted traffic. Which tuning method should the analyst use to reduce false positives without reducing detection capability?

Accepted Answer

Whitelist the source IP addresses of known, trusted servers.. Whitelisting the source IP addresses of known, trusted servers reduces false positives by instructing the IDS to ignore alerts for encrypted traffic from those specific hosts. This approach preserves detection capability because the IDS continues to apply all signatures to traffic from other, potentially malicious sources. It is a targeted tuning method that does not disable detection mechanisms or alter sensitivity thresholds, which could otherwise miss real threats.

Answer

Disable the signatures that trigger for encrypted traffic.

Answer

Increase the sensitivity threshold for the encrypted traffic signatures.

Answer

Enable full packet capture and analyze the encrypted traffic manually.

Question 9

During the preparation phase of the NIST SP 800-61 incident response lifecycle, which of the following is the MOST important activity to ensure effective incident response?

Accepted Answer

Creating and training the incident response team. Preparation includes creating and training the incident response team, acquiring tools, and establishing procedures. A well-trained team is critical to executing the response effectively.

Answer

Using YARA rules to detect malware in the environment

Answer

Implementing network segmentation to limit lateral movement

Answer

Conducting a root cause analysis after each incident

Question 10

An organization has identified a ransomware outbreak on several workstations. Which TWO actions should the incident response team take immediately?

Accepted Answer

Disconnect all network shares to prevent encryption.. Isolating affected systems prevents further spread, and disconnecting network shares stops lateral movement. Contacting law enforcement can be done later; paying ransom is not recommended; reimaging may destroy evidence before investigation.

Answer

Pay the ransom to recover data quickly.

Answer

Contact law enforcement for guidance.

Answer

Reimage all affected systems immediately.

Question 11

A security analyst needs to share threat intelligence data with a partner organization as part of an information sharing agreement. Which of the following is the most critical consideration before sharing the data?

Accepted Answer

The classification level and handling restrictions. The classification level and handling restrictions are the most critical consideration because threat intelligence often contains sensitive information such as indicators of compromise (IOCs) that may be classified or subject to legal handling requirements (e.g., TLP markings). Sharing data without verifying classification could violate security policies, breach confidentiality agreements, or expose critical vulnerabilities to unauthorized parties, undermining the trust and legality of the information-sharing agreement.

Answer

The volume of data being shared

Answer

The data format (e.g., STIX, TAXII)

Answer

The geographic location of the partner

Question 12

Which metric would best indicate the effectiveness of an organization's patch management program?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage directly measures how often patches are applied within required timeframes.

Answer

Phishing simulation click rates

Answer

Open vulnerability counts by severity

Answer

Mean time to detect (MTTD)

Question 13

An incident report includes a section that details the sequence of events from initial compromise to containment. Which component of the incident report does this describe?

Accepted Answer

Timeline. The timeline component chronologically documents the incident's progression.

Answer

Impact assessment

Answer

Root cause

Answer

Lessons learned

Question 14

A vulnerability scan report shows a critical vulnerability on a web server with a CVSS score of 9.8. The IT manager wants to know the risk to the organization. Which of the following factors should the analyst consider FIRST?

Accepted Answer

The asset value and business criticality. The CVSS score of 9.8 indicates a critical severity vulnerability, but risk is a function of both severity and business context. The analyst must first assess the asset value and business criticality of the web server because a critical vulnerability on a non-essential server poses lower risk than the same vulnerability on a server handling sensitive data or core business processes. Without this context, the organization cannot prioritize remediation effectively.

Answer

The vendor's patch release schedule

Answer

The number of exploit attempts in the logs

Answer

The number of other vulnerabilities on the server

Question 15

A security analyst is preparing a monthly dashboard for the board of directors. Which metric would best demonstrate the effectiveness of the security program in reducing risk?

Accepted Answer

Mean time to detect (MTTD) and mean time to respond (MTTR).. Mean time to detect (MTTD) and mean time to respond (MTTR) directly quantify the security program's operational efficiency in identifying and containing threats, which reduces the window of exposure and potential damage. A lower MTTD/MTTR indicates faster detection and response, directly correlating with reduced risk from incidents. This makes it the best metric for demonstrating risk reduction effectiveness to the board.

Answer

Number of security incidents detected.

Answer

Percentage of employees who completed security awareness training.

Answer

Number of firewall rules configured.