CS0-003 Practice Test 20 — 15 Questions

Question 1

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. The alert describes a workstation requesting a high number of Kerberos service tickets for many SPNs without subsequent service access. This is characteristic of Kerberoasting reconnaissance, where an attacker with domain credentials (e.g., a compromised user account) requests TGS tickets for service accounts to extract their NTLM hashes offline for cracking. The lack of actual service access confirms the tickets are being harvested, not used for legitimate authentication.

Answer

ARP spoofing

Answer

Pass-the-hash using NTLM only

Answer

DNS cache poisoning

Question 2

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

A software bill of materials. A Software Bill of Materials (SBOM) is the correct request because it provides a formal, machine-readable inventory of all included libraries, components, and their versions used in the software product. In a regulated environment (e.g., healthcare, finance), this visibility is essential for vulnerability management, license compliance, and supply chain risk assessment, as mandated by frameworks like NIST SP 800-53 or FDA premarket cybersecurity guidance.

Answer

A building floor plan

Answer

A password complexity screenshot only

Answer

A DNS MX record report

Question 3

A SOC is tuning a detection for suspected DNS tunnelling. Which evidence points are useful before escalating the alert? (Choose two.)

Accepted Answer

Volume and timing of queries to the same domain or name server. Option B is correct because DNS tunnelling often relies on a high volume of queries to a single domain or name server to exfiltrate data or establish a command-and-control channel. Anomalous query timing—such as regular, machine-like intervals—combined with an unusual query count per minute compared to baseline user behaviour is a strong indicator of automated tunnelling activity. SOC analysts should correlate volume and timing with other suspicious patterns before escalating.

Answer

The user's monitor size

Answer

The colour scheme of the SIEM dashboard

Question 4

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts. Option D is correct because the first automated phase of a SOAR playbook for suspected phishing should focus on enrichment and triage without taking destructive action. Enriching URLs (e.g., via VirusTotal or URL scan APIs), detonating attachments in a sandbox (e.g., using Cuckoo or FireEye), and collecting mailbox search counts (e.g., via EWS or Graph API) provide critical threat intelligence while preserving evidence and avoiding premature containment. This aligns with the containment trade-off phase, where the goal is to balance rapid response with forensic integrity.

Answer

Close all similar alerts as duplicates

Answer

Disable the reporting user's account immediately

Answer

Automatically delete all messages from the sender across all mailboxes

Question 5

A tabletop exercise reveals that no one knows who can approve public statements. What should be updated? (Choose two.)

Accepted Answer

Contact list and escalation matrix. The tabletop exercise revealed a gap in the incident response process: no one knows who can approve public statements. This is a procedural and communication failure, not a technical one. Updating the incident communication plan with named approval roles (Option D) directly addresses this by defining the specific person or role authorized to speak publicly. The contact list and escalation matrix (Option B) must also be updated to ensure the correct approver can be reached quickly, as it provides the hierarchical path and contact details needed to execute the plan.

Answer

The office seating plan only

Answer

The malware signature database only

Question 6

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

A retest showing the vulnerable condition is no longer present. Option B is correct because the vulnerability manager must obtain objective evidence that the fix was successfully applied and the vulnerability is no longer exploitable. A retest—typically performed via authenticated scanning or manual verification—confirms the absence of the vulnerable condition, aligning with the remediation validation phase in the vulnerability management lifecycle. Closing based solely on a team's email (Option C) violates the principle of verify, not trust, and could leave residual risk unaddressed.

Answer

Create a duplicate ticket for every asset

Answer

Close it immediately based on the email

Answer

Wait one year before testing

Question 7

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

MFA fatigue or push-bombing attack. The scenario describes MFA fatigue (also called push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This is a social engineering technique that exploits human behavior, not a technical vulnerability. Option C correctly identifies this attack pattern, which is a known tactic in credential-stuffing and account-takeover campaigns.

Answer

DNS tunnelling

Answer

SSL certificate expiry

Answer

Password spraying only

Question 8

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Sigma rule. Sigma rules are the correct choice because they are designed as a portable, generic detection format that can be converted into queries for multiple SIEM platforms (e.g., Splunk, QRadar, Elastic) without vendor lock-in. This aligns directly with the threat hunter's requirement for a portable detection that can be easily translated across different environments. In contrast, the other options are either scoring systems, forensic artifacts, or file-specific signatures that lack this cross-platform conversion capability.

Answer

CVSS vector string

Answer

OpenIOC package only

Answer

YARA rule

Question 9

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as?

Accepted Answer

MFA fatigue or push-bombing attack. Repeated MFA prompts that the user eventually approves out of frustration or habit is the hallmark of MFA fatigue (also called push-bombing). The attacker sends a flood of push notifications to the user's device, hoping the user will mistakenly approve one to stop the annoyance. This bypasses the MFA control without needing to compromise the second factor.

Answer

Password spraying only

Answer

DNS tunnelling

Answer

SSL certificate expiry

Question 10

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

A retest showing the vulnerable condition is no longer present. A retest is required to confirm that the vulnerability has been successfully remediated. Without a retest, the vulnerability manager cannot verify that the patch was applied correctly or that it did not introduce new issues. This aligns with the vulnerability management lifecycle, where closure is only granted after a validated scan or manual test shows the vulnerable condition is eliminated.

Answer

Wait one year before testing

Answer

Create a duplicate ticket for every asset

Answer

Close it immediately based on the email

Question 11

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option A is correct because it aligns with the structured communication framework required for vendor management during an outage. The business service owner needs a clear timeline, quantified service impact (e.g., number of affected users, duration), evidence (e.g., logs, monitoring data), required corrective actions to prevent recurrence, and contractual follow-up (e.g., SLA breach, credits). This ensures accountability and supports informed decision-making without speculation or unnecessary data.

Answer

Internal blame speculation

Answer

Confidential unrelated customer data

Answer

A public press statement draft first

Question 12

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

MFA fatigue or push-bombing attack. Option C is correct because the scenario describes MFA fatigue (also called push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This exploits the human tendency to accept prompts to stop interruptions, bypassing MFA security. The clearest next triage step is to investigate the source IPs and authentication logs for anomalous patterns and immediately revoke the approved session.

Answer

DNS tunnelling

Answer

Password spraying only

Answer

SSL certificate expiry

Question 13

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. Option C is correct because it combines external threat intelligence (CISA KEV and EPSS) with internal context (asset exposure) to prioritize a medium-severity vulnerability that is actively exploited and has a high probability of exploitation. This approach aligns with the NIST framework for risk-based vulnerability management, which emphasizes that not all high-CVSS vulnerabilities are exploitable in a given environment, while lower-scored vulnerabilities in KEV pose immediate risk.

Answer

Always sort only by CVSS base score

Answer

Remediate alphabetically by CVE ID

Answer

Remediate only vulnerabilities with vendor logos in the report

Question 14

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Use them internally with only people who need to know and avoid wider redistribution. Option A is correct because TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and explicitly prohibits redistribution beyond that group. In detection engineering, using these indicators to create tuned detection rules (e.g., SIEM correlation logic) reduces false positives by focusing on verified threat data while preserving the signal by not over-broadening the rule scope.

Answer

Send the indicators to all customers

Answer

Publish the indicators on a public GitHub repository

Answer

Ignore the indicators because TLP markings are optional

Question 15

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. Option B is correct because the CISA KEV vulnerability with high EPSS indicates active exploitation in the wild, making it a critical threat regardless of its medium CVSS base score. Prioritizing it after confirming asset exposure ensures the organization addresses the most imminent risk first, as high CVSS issues that are not exploitable in the environment pose no actual danger. This aligns with risk-based vulnerability management, where exploitability and threat intelligence (KEV, EPSS) override raw severity scores.

Answer

Remediate alphabetically by CVE ID

Answer

Always sort only by CVSS base score

Answer

Remediate only vulnerabilities with vendor logos in the report