CS0-003 Practice Test 20 — 15 Questions

Question 1

A vulnerability report is being prepared for an organization's management. Which of the following is the MOST appropriate structure for this report?

Accepted Answer

Executive summary, findings by severity, risk acceptance, remediation timeline. A standard vulnerability report includes an executive summary for high-level decision-makers, findings grouped by severity, risk acceptance decisions, and a remediation timeline.

Answer

Charts showing open vulnerability counts over time, without any narrative

Answer

List of all vulnerabilities sorted by CVSS score, followed by detailed technical descriptions

Answer

Network diagram with vulnerability locations, patch status, and compliance checklists

Question 2

An organization wants to automate the sharing of threat intelligence with other trusted entities using a standardized protocol. Which protocol is specifically designed for this purpose?

Accepted Answer

TAXII. TAXII (Trusted Automated eXchange of Indicator Information) is a protocol for exchanging cyber threat intelligence in a standardized format, often used with STIX.

Answer

STIX

Answer

REST API

Answer

MISP

Question 3

A security analyst is reviewing vulnerability scan results and notices that a critical vulnerability on a web server has a CVSS v3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of the CVSS vector indicates that the vulnerability can be exploited from a remote network?

Accepted Answer

AV:N. AV stands for Attack Vector. AV:N means the vulnerability is exploitable over a network, indicating remote exploitation.

Answer

PR:N

Answer

AC:L

Answer

UI:N

Question 4

During a traffic analysis, a security analyst observes repeated outbound connections from an internal workstation to an external IP address on TCP port 53 at irregular intervals. The connections are small and occur every few minutes. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS normally uses UDP, but TCP port 53 can be used for DNS tunneling. The small, irregular connections to a single external IP suggest data exfiltration via DNS tunneling.

Answer

HTTP smuggling

Answer

TCP handshake anomaly

Answer

Beaconing

Question 5

A security team is scanning container images with Trivy and finds a vulnerability with CVSS v3.1 vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in a container running as a privileged container on a Kubernetes cluster. The team is prioritizing based on risk. Given the CVSS vector, which factor most significantly reduces the likelihood of exploitation in this context?

Accepted Answer

Attack Vector: Local. AV:L (Local) means the attacker must have local access to exploit. AC:H (High) and PR:H (High) are also limiting, but the attack vector being local means remote exploitation is not possible, which is a strong limiting factor. However, the question asks 'most significantly reduces the likelihood'. While local access is limiting, Attack Complexity High also reduces likelihood. But AV:L is more significant because it restricts the attack source. In the context of a container, local access might be more achievable, but still the vector shows it's not remotely exploitable. The best answer is Attack Vector: Local.

Answer

Privileges Required: High

Answer

Attack Complexity: High

Answer

User Interaction: None

Question 6

An analyst needs to capture network traffic on a Linux server to investigate a potential data exfiltration. Which command-line tool is best suited for real-time packet capture and analysis?

Accepted Answer

tcpdump. tcpdump is a powerful command-line packet analyzer for Linux, capable of capturing network traffic in real time and saving it for later analysis.

Answer

netstat

Answer

iperf

Answer

nmap

Question 7

A security analyst is configuring a SIEM correlation rule to detect potential brute-force attacks. Which log source combination is most appropriate for this rule?

Accepted Answer

Authentication logs and firewall logs. Authentication logs show login attempts, and firewall logs show source IPs; combining them can detect multiple failed logins from an IP.

Answer

Authentication logs and DNS logs

Answer

Firewall logs and IDS logs

Answer

Endpoint logs and cloud audit logs

Question 8

A security team is reviewing cloud audit logs from AWS CloudTrail and notices repeated API calls to create EC2 instances in a region where the organization has no presence. What is the most likely cause?

Accepted Answer

Compromised AWS credentials. Unauthorized API calls to create resources in unusual regions often indicate compromised credentials or an attacker using the account for cryptomining.

Answer

Configuration drift

Answer

Service outage

Answer

Valid administrative activity

Question 9

A security analyst is investigating a potential data exfiltration incident. They notice a host sending large amounts of data to an external IP address using DNS queries. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data in DNS queries and responses, allowing exfiltration over port 53, which is often allowed through firewalls.

Answer

DGA

Answer

HTTP smuggling

Answer

Beaconing

Question 10

An analyst is investigating a potential data exfiltration via DNS. Which tool would best help identify DNS tunnelling by analyzing packet payloads and query patterns?

Accepted Answer

Wireshark. Wireshark can capture and analyze DNS packets in detail, including payload and query patterns, making it suitable for detecting DNS tunnelling.

Answer

tcpdump

Answer

nmap

Answer

NetFlow

Question 11

After a DDoS attack, the CSIRT wants to share IOCs with other organizations. Which protocol is specifically designed for automated, real-time threat intelligence sharing?

Accepted Answer

TAXII. TAXII (Trusted Automated Exchange of Indicator Information) is the protocol for exchanging threat intelligence over HTTPS.

Answer

HTTP

Answer

SMTP

Answer

FTP

Question 12

An analyst is investigating a suspected data exfiltration via HTTP. The analyst examines a PCAP file and finds a series of HTTP POST requests to an external site with varying 'Content-Length' values. The payloads appear to be base64-encoded strings. Which tool would be most effective for extracting and decoding the payloads for analysis?

Accepted Answer

Python with scapy. Python with scapy allows custom scripting to extract and decode payloads from PCAP files.

Answer

Wireshark

Answer

tcpdump

Answer

NetFlow

Question 13

A security analyst receives an alert about a possible ransomware outbreak. Which short-term containment action should be performed FIRST to prevent further spread?

Accepted Answer

Isolate the system from the network. Network isolation (disconnecting the affected system from the network) is a quick short-term containment step that stops the ransomware from communicating with C2 or spreading laterally.

Answer

Disable the user account

Answer

Rebuild the system

Answer

Update antivirus signatures

Question 14

What is the primary purpose of performing credentialed vulnerability scans?

Accepted Answer

Provide deeper insight into the system configuration. Credentialed scans authenticate to the target system, allowing deeper inspection (e.g., registry, installed software) for a more accurate assessment.

Answer

Eliminate the need for patch management

Answer

Reduce network bandwidth usage

Answer

Avoid detection by the target system

Question 15

Which TWO of the following are best practices for securing a network firewall configuration? (Choose two.)

Accepted Answer

Implement a default deny rule for inbound and outbound traffic. A default deny rule for inbound and outbound traffic ensures that only explicitly permitted traffic is allowed, which is the foundation of a secure firewall configuration. This approach aligns with the principle of least privilege and prevents unauthorized access or data exfiltration by blocking all traffic that is not specifically required. Without a default deny rule, any misconfiguration or unanticipated traffic could bypass security controls.

Answer

Enable continuous monitoring of firewall logs

Answer

Allow all traffic by default and block specific threats

Answer

Use default vendor passwords for initial access