CS0-003 Practice Exam 2 — 20 Questions

Question 1

An analyst is reviewing a packet capture and observes a series of TCP SYN packets sent to a server, each followed by a SYN-ACK from the server, but no ACK from the client. The source IP is spoofed. What type of attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP SYN flood attack. The scenario describes a TCP SYN flood attack, where an attacker sends a series of TCP SYN packets with spoofed source IPs to a server. The server responds with SYN-ACK to the spoofed IP, but the client never sends the final ACK, leaving half-open connections that exhaust the server's connection table. This is a classic denial-of-service attack.

Answer

Man-in-the-middle attack

Answer

DNS amplification attack

Answer

TCP reset attack

Question 2

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Accepted Answer

Check the baseline behavior of the source IP. The first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.

Answer

Immediately block the source IP at the firewall

Answer

Update the signature database

Answer

Isolate the affected system for forensic analysis

Question 3

A security analyst is reviewing a NetFlow record that shows a large amount of data being transferred from an internal server to an external IP address on port 443 during non-business hours. Which type of activity should the analyst suspect?

Accepted Answer

Data exfiltration. Data exfiltration is correct because the pattern — a large volume of data transferred from an internal server to an external IP on port 443 during non-business hours — matches the classic signature of data exfiltration. Port 443 (HTTPS) is commonly used to blend in with normal encrypted web traffic, and off-hours timing plus high volume to an external destination indicates unauthorized data transfer.

Answer

Denial-of-service attack

Answer

Port scanning

Answer

Normal backup operation

Question 4

During the preparation phase of the NIST SP 800-61 incident response lifecycle, a security analyst is tasked with ensuring the team has the necessary tools and resources. Which of the following is the MOST important activity to perform during this phase?

Accepted Answer

Developing and testing incident response playbooks. In the NIST SP 800-61 preparation phase, the most important activity is establishing the capability to respond before an incident occurs, which centers on developing, documenting, and testing incident response playbooks. Playbooks codify roles, communication paths, and step-by-step procedures so the team can act consistently under pressure. Testing them (tabletop exercises, simulations) validates that tools, contacts, and escalation paths actually work.

Answer

Sharing indicators of compromise with threat intel platforms

Answer

Conducting root cause analysis of past incidents

Answer

Analyzing malware samples in a sandbox

Question 5

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies an alert indicating a high volume of outbound traffic from a critical server to an unknown IP address. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Correlate the alert with firewall logs and other security tools.. In the NIST SP 800-61 Detection and Analysis phase, the analyst's first priority is to validate and understand the alert before taking disruptive action. Correlating the alert with firewall logs and other security tools confirms whether the outbound traffic is truly malicious, identifies the destination, and establishes scope — this is the analysis step that precedes containment. Acting on an unverified alert risks unnecessary downtime and destroys evidence needed for the investigation.

Answer

Notify law enforcement immediately.

Answer

Isolate the server from the network to prevent data exfiltration.

Answer

Rebuild the server from a known good backup.

Question 6

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for a recent breach was 14 days, while the mean time to respond (MTTR) was 6 hours. Which metric should the team prioritize to improve in future incidents?

Accepted Answer

Mean time to detect (MTTD). With MTTD at 14 days and MTTR at only 6 hours, detection is clearly the bottleneck — attackers had nearly two weeks of dwell time before anyone noticed. Improving MTTD (via better logging, EDR tuning, threat hunting, or SIEM correlation) will reduce attacker dwell time and blast radius far more than shaving hours off an already-fast response.

Answer

Percentage of incidents containing malware

Answer

Number of incidents per week

Answer

Mean time to respond (MTTR)

Question 7

An analyst detects a process named 'powershell.exe' executing a base64-encoded command. Which type of analysis is most appropriate to decode and understand the command?

Accepted Answer

Process analysis. Process analysis is the most appropriate because it focuses on the live execution context of a running process, including its command-line arguments, loaded modules, and parent-child relationships. In this case, the base64-encoded command is part of the process's command line, which can be decoded to reveal the actual PowerShell script or commands being executed. Tools like Process Explorer, Process Monitor, or PowerShell's own logging (e.g., Script Block Logging) can capture and decode this information. This directly addresses the need to understand what the process is doing.

Answer

Memory analysis

Answer

Registry analysis

Answer

Network traffic analysis

Question 8

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch is intended to fix a remote code execution vulnerability in a widely used application. What is the MOST important step before deploying to production?

Accepted Answer

Perform regression testing to ensure no breakage. Regression testing is the most important step because a patch that fixes a remote code execution vulnerability can still introduce functional regressions or break dependent applications in production. Testing in staging validates that the patch resolves the vulnerability without breaking existing functionality, integrations, or workflows. This aligns with change management best practices where validation precedes production deployment.

Answer

Check the patch's CVSS score

Answer

Verify the patch's digital signature

Answer

Automatically deploy to all production servers immediately

Question 9

Which of the following tools is specifically designed for compliance scanning against security benchmarks on Linux systems?

Accepted Answer

Lynis. Lynis is an open-source security auditing tool specifically designed for Linux systems, performing compliance scans against benchmarks like CIS, HIPAA, and PCI-DSS. It checks system hardening, kernel parameters, file permissions, and installed software. OpenVAS, Nessus, and Qualys are general vulnerability scanners, not Linux-specific compliance benchmark tools.

Answer

OpenVAS

Answer

Nessus

Answer

Qualys

Question 10

A security analyst is investigating a potential DNS tunneling attack. Which of the following patterns in DNS logs would most likely indicate such activity?

Accepted Answer

Unusually long subdomain names with high query frequency to a single domain. DNS tunneling exfiltrates data or establishes command-and-control by encoding payloads into DNS query names, typically subdomains of an attacker-controlled domain. This produces unusually long subdomain labels (often near the 63-character label limit or 253-character FQDN limit) combined with high query volume to a single domain, because each query carries a chunk of encoded data. Option B captures both the encoding artifact (long names) and the beaconing pattern (high frequency to one domain) that together are the hallmark of tunneling tools like iodine, dnscat2, or DNSExfiltrator.

Answer

A high number of NXDOMAIN responses

Answer

Consistent query intervals to a known legitimate domain

Answer

Queries to domains that are less than 24 hours old

Question 11

A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol for exchanging that intelligence over HTTPS. Together, they provide a standardized format and transport mechanism for sharing threat intel between organizations, as required by the question.

Answer

REST

Answer

SOAP

Answer

SNMP

Question 12

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Answer

Give all users local admin rights

Question 13

A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?

Accepted Answer

Scope is changed, high impact on confidentiality only. The CVSS v3.1 vector AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N indicates Scope is Changed (S:C) and Confidentiality impact is High (C:H), while Integrity (I:N) and Availability (A:N) impacts are None. Therefore, the correct description is scope changed with high impact on confidentiality only. The other options misstate either the scope or the impacted security property.

Answer

Scope is unchanged, high impact on confidentiality only

Answer

Scope is changed, high impact on integrity only

Answer

Scope is unchanged, high impact on confidentiality and integrity

Question 14

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic threat intelligence focuses on high-level, long-term trends, adversary motivations, and geopolitical or business risks — exactly what senior executives need for decision-making and risk budgeting. It is typically delivered as reports or briefings rather than raw indicators, and it informs strategic planning over quarters or years. Technical, tactical, and operational intelligence are all more granular and operational in nature.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence

Question 15

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module specifically designed to acquire volatile memory from Linux systems in a forensically sound manner. It captures RAM contents and outputs them in formats like raw or lime, which can then be analyzed with tools such as Volatility. This makes it the correct answer for Linux memory acquisition.

Answer

dd

Answer

FTK Imager

Answer

WinPmem

Question 16

An organization needs to report a data breach involving personal data of EU residents. Under GDPR, what is the maximum time allowed for notifying the supervisory authority after becoming aware of the breach?

Accepted Answer

72 hours. GDPR Article 33 mandates that a controller notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is the maximum; earlier notification is encouraged. If notification is not made within 72 hours, it must be accompanied by reasons for the delay.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 17

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Accepted Answer

Lessons learned and recommendations. An after-action report exists to drive improvement, so the component that directly prevents recurrence is the lessons learned and recommendations section, which translates findings into concrete process, tooling, or training changes. While timeline, impact, and root cause feed into it, only lessons learned and recommendations prescribe the corrective actions that stop the same phishing incident from succeeding again.

Answer

Timeline of the incident

Answer

Impact assessment

Answer

Root cause analysis

Question 18

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Accepted Answer

Explain the potential financial loss and reputational damage.. When communicating risk to a board of directors, the most effective approach is to translate the technical vulnerability into business impact—potential financial loss, regulatory fines, and reputational damage—because executives prioritize strategic and financial consequences over technical detail. This framing enables informed risk acceptance or remediation decisions at the governance level. CVSS scores and technical descriptions, while useful to security teams, do not resonate with non-technical leadership.

Answer

Show the CVSS score and exploit complexity.

Answer

Recommend immediate patching without details.

Answer

Describe the vulnerability in technical terms.

Question 19

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. Under GDPR Article 33, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a core GDPR compliance requirement. The other timeframes do not match the regulation.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 20

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Benchmarks define Level 1 as essential, basic security settings that can be applied broadly with minimal impact on functionality or performance, making them suitable as a universal baseline. Level 2 settings are defense-in-depth measures intended for high-security environments; they are more restrictive and may degrade performance or break usability (e.g., disabling legacy protocols or enforcing strict password policies). The question's goal of a baseline posture maps directly to Level 1.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.