CS0-003 Practice Exam 3 — 20 Questions

Question 1

Which of the following is the FIRST step in the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation. NIST SP 800-61 Rev. 2 defines the incident response lifecycle as four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation is the first phase because it establishes the CSIRT, tools, communications plans, and playbooks before any incident occurs. Without preparation, later phases cannot be executed effectively.

Answer

Detection and Analysis

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 2

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Accepted Answer

Financial impact. Business risk communication should focus on financial impact, reputational impact, and regulatory penalties as these resonate with business leaders. Technical impact is too detailed.

Answer

Operational impact

Answer

Technical impact

Question 3

A security analyst is investigating a potential data breach. The analyst needs to preserve evidence before containment. Which of the following actions is MOST appropriate at this stage?

Accepted Answer

Creating a forensic image of the hard drive. Creating a forensic image of the hard drive is the most appropriate action to preserve evidence before containment. A forensic image is a bit-for-bit copy of the storage media that captures the system state, including deleted files, memory remnants, and metadata, without altering the original. This preserves the integrity of evidence for later analysis and legal proceedings. Powering off, blocking IPs, or disabling accounts are containment actions that can destroy volatile evidence and should be done after imaging.

Answer

Powering off the system

Answer

Blocking the attacker's IP at the firewall

Answer

Disabling the user's account

Question 4

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. The detection of a user authenticating from geographically distant locations within 12 minutes strongly suggests credential theft or token replay, and the subsequent mailbox forwarding rule creation indicates a data exfiltration attempt. The analyst must first correlate sign-in logs (to verify the source IPs and timestamps), MFA results (to check if MFA was satisfied or bypassed), device details (to identify if a known or managed device was used), and mailbox audit events (to confirm who created the forwarding rule and when). This combination directly validates or refutes the UEBA alert by providing the evidence needed to distinguish between a legitimate user with a VPN or a compromised account.

Answer

Only the user's browser cache

Answer

Only DHCP logs from the London office

Answer

The organisation's public DNS zone file

Question 5

During an incident response, the team identifies that a workstation was compromised via a phishing email. Which of the following should be performed immediately after containment?

Accepted Answer

Eradicate the malware from the workstation.. Immediately after containment, the priority is to eradicate the malware from the workstation to prevent reinfection or lateral movement. Containment isolates the system, but eradication removes the malicious artifacts (e.g., registry keys, scheduled tasks, or malicious binaries) to ensure the system is clean before recovery. This step aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment to eliminate the threat's foothold.

Answer

Notify law enforcement about the phishing campaign.

Answer

Collect forensic evidence from the workstation.

Answer

Conduct a root cause analysis of the phishing email.

Question 6

Refer to the exhibit. The output is from a Linux system running `netstat -an`. Which of the following ports is likely being used for remote command-and-control communication?

Accepted Answer

54321. Port 54321 is a high-numbered ephemeral port that is not associated with any standard service, making it a common choice for malware or remote access tools (RATs) to establish command-and-control (C2) communication. In the netstat -an output, an established connection on a non-standard high port from the local system to a remote IP is a strong indicator of C2 activity, as legitimate services typically use well-known ports.

Answer

22

Answer

53

Answer

80

Question 7

An organization uses MISP (Malware Information Sharing Platform) to share threat intelligence with trusted partners. Which of the following standards is commonly used by MISP to structure and exchange threat intelligence data?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Answer

NetFlow

Answer

SNMP

Answer

Syslog

Question 8

A security analyst notices that a system is sending a large amount of data to an external IP address via DNS tunneling. Which containment technique is most appropriate?

Accepted Answer

Disconnect the system from the network. Disconnecting the system from the network (Option B) is the most appropriate containment technique because it immediately stops all data exfiltration, including DNS tunneling traffic, without relying on any other network component. DNS tunneling works by encoding data within DNS queries and responses, so simply changing DNS server settings or blocking the external IP may not stop the attack if the malware uses fallback resolvers or rotates IPs. Disconnecting the system ensures the threat is isolated at the host level, preventing further data loss while preserving forensic evidence.

Answer

Change the DNS server settings

Answer

Block the external IP at the firewall

Answer

Disable the DNS service on the system

Question 9

A company wants to automate the deployment of security patches to endpoints. Which of the following tools would BEST support this requirement?

Accepted Answer

Enterprise patch management tool. An enterprise patch management tool (e.g., Microsoft WSUS, SCCM, or Ivanti) is specifically designed to automate the deployment, scheduling, and reporting of security patches across endpoints. It directly addresses the requirement by pushing patches to systems based on policy, ensuring compliance, and reducing manual effort.

Answer

Vulnerability scanner

Answer

Configuration management tool

Answer

Security information and event management (SIEM) system

Question 10

During forensic acquisition, which of the following types of data is considered the MOST volatile?

Accepted Answer

RAM.. RAM (Random Access Memory) is the most volatile data because it loses its contents immediately when power is removed. In forensic acquisition, the order of volatility dictates that RAM must be captured first, as it contains running processes, open network connections, and decrypted data that cannot be recovered from disk. Network connections, while volatile, are a subset of the data stored in RAM and are less critical to capture first.

Answer

Network connections.

Answer

Disk.

Answer

Page file.

Question 11

A security analyst is reviewing alerts from an IDS. Which TWO indicators are most likely to suggest a successful command and control (C2) communication? (Choose two.)

Accepted Answer

A high volume of outbound traffic to an unusual destination IP on port 443. Option B is correct because sustained outbound traffic to an unusual external IP over port 443 is a classic C2 indicator: attackers frequently tunnel C2 over HTTPS (TCP 443) to blend with legitimate web traffic, and the destination being atypical for the environment raises suspicion. Option E is correct because regular beaconing to an external IP with consistent payload sizes reflects the periodic check-in pattern used by implants (e.g., fixed intervals with jitter and uniform packet sizes), which is a hallmark of established C2 channels. Option A does not belong because an inbound connection from a malicious IP to a mail server suggests scanning, exploitation, or spam relay activity rather than an internal host initiating C2. Option C does not belong because a single large upload to cloud storage is more indicative of data exfiltration than C2, and cloud storage is a legitimate service. Option D does not belong because a DNS query for a malicious domain indicates possible resolution or attempted contact, but a single query alone does not demonstrate the sustained, bidirectional communication characteristic of successful C2.

Answer

An inbound connection from a known malicious IP to the mail server

Answer

A single large file upload to a cloud storage service

Answer

An internal host performing a DNS query for a known malicious domain

Question 12

An analyst needs to identify which process on a Windows system is making outbound connections to the internet. Which tool should be used?

Accepted Answer

Resource Monitor. Resource Monitor (resmon.exe) provides a real-time view of network activity, including which processes are making outbound TCP and UDP connections, along with the remote addresses and ports. Unlike netstat, it directly associates network connections with specific process names and allows filtering by process, making it the most efficient tool for identifying the exact process responsible for outbound internet traffic.

Answer

netstat -an

Answer

Task Manager

Answer

Performance Monitor

Question 13

A security analyst is reviewing a report from an authenticated vulnerability scan of a Windows domain controller. The report indicates multiple critical vulnerabilities related to Active Directory. The system administrator claims the patches have been applied. Which of the following is the MOST likely cause of the discrepancy?

Accepted Answer

The patches require a reboot. The most likely cause is that the patches require a reboot. Many critical Active Directory vulnerabilities, such as those in Kerberos or LSASS, are mitigated by patches that only take effect after a system restart. The authenticated scan detects the vulnerability because the patched files are not yet loaded into memory, even though the patches are installed on disk.

Answer

The vulnerabilities are false positives

Answer

The scan was run with insufficient credentials

Answer

The scan was run before patch installation

Question 14

A security analyst at a financial institution is responsible for vulnerability management. The company has a policy that all critical vulnerabilities must be remediated within 72 hours. The weekly vulnerability scan identifies a critical vulnerability on a file server that hosts sensitive customer data. The vulnerability is a remote code execution in the operating system. The server is running a legacy OS that is no longer supported by the vendor. The system owner states that the application on the server cannot be migrated to a newer OS for at least six months. The server cannot be taken offline because it is used by the compliance team for daily audits. Which of the following should the analyst recommend to best address the risk?

Accepted Answer

Implement compensating controls such as network segmentation and host-based firewall rules.. When a critical vulnerability cannot be patched due to legacy OS constraints, compensating controls are the best approach to reduce risk. Network segmentation isolates the server from untrusted hosts, and host-based firewall rules restrict inbound/outbound traffic to only necessary ports and IPs, mitigating the remote code execution vector without taking the server offline.

Answer

Remove the server from the network immediately.

Answer

Accept the risk and document the exception.

Answer

Apply a custom patch developed by the manufacturer.

Question 15

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Decode the command and inspect the process tree, parent document, and network destination. Decoding the encoded PowerShell command reveals the attacker's intent, inspecting the process tree shows the execution chain from winword.exe to powershell.exe, examining the parent document identifies the malicious attachment, and analyzing the network destination uncovers the C2 server. This systematic approach provides the clearest next triage step by correlating the initial infection vector with the subsequent malicious activity, enabling the analyst to contain the threat effectively.

Answer

Disable the SIEM parser for PowerShell events

Answer

Reimage every workstation in the department

Answer

Close the alert because HTTPS is expected traffic

Question 16

A SOC analyst notices a spike in outbound traffic from a server that normally only serves web pages. The signature-based IDS did not alert. What should the analyst do next?

Accepted Answer

Query threat intelligence for the destination IPs. Querying threat intelligence for the destination IPs is the correct next step because the spike in outbound traffic from a web server suggests a potential data exfiltration attempt or command-and-control (C2) communication. Since the signature-based IDS did not alert, the traffic may be using non-standard ports or encrypted channels that evade known signatures. Threat intelligence can reveal if the destination IPs are associated with known malicious actors, botnets, or recent threat campaigns, providing context to determine if the traffic is benign or malicious.

Answer

Disable the server immediately

Answer

Check for zero-day vulnerabilities

Answer

Increase the IDS sensitivity threshold

Question 17

During a containment phase of an incident response, the team needs to prevent an infected host from communicating with a command-and-control server. The host is a critical database server that cannot be taken offline. Which of the following containment strategies is most appropriate?

Accepted Answer

Block the C2 IP at the firewall. Blocking the C2 IP at the firewall is the most appropriate strategy because it disrupts the command-and-control communication without taking the critical database server offline. This network-layer containment allows the host to continue serving its database functions while preventing outbound traffic to the malicious IP, aligning with the need for a surgical containment approach.

Answer

Pull the network cable

Answer

Disable the database service

Answer

Isolate the host by VLAN

Question 18

During forensic analysis of a compromised server, the analyst finds that the attacker deleted the system logs. Which data source is most likely to still contain relevant evidence?

Accepted Answer

Endpoint detection and response (EDR) telemetry. EDR telemetry is the most reliable source because it captures process creation, network connections, file modifications, and registry changes in real-time, storing them off-host. Even if an attacker deletes local system logs, the EDR agent's telemetry stream remains intact on the central management server, providing a forensic timeline of the attacker's actions.

Answer

Memory dump from before the attack

Answer

Network flow logs

Answer

Backup tapes

Question 19

Which metric measures the average time taken to fix a vulnerability after it is identified?

Accepted Answer

Mean time to remediate (MTTRem). Mean time to remediate (MTTRem) is defined as the average elapsed time between when a vulnerability is identified and when it is fully remediated (patched, mitigated, or accepted with compensating controls). This matches the question's wording exactly — identification to fix.

Answer

Mean time to detect (MTTD)

Answer

Mean time to respond (MTTR)

Answer

Patch SLA compliance %

Question 20

A root-cause analysis finds that an alert fired but was never triaged. Which corrective actions are useful? (Choose two.)

Accepted Answer

Define queue ownership and escalation thresholds. Defining queue ownership and escalation thresholds ensures that alerts are assigned to a specific team or individual and have a clear path for escalation if not acknowledged within a defined time. This directly addresses the root cause of the alert never being triaged by enforcing accountability and automated follow-up, which is a standard incident response practice per NIST SP 800-61.

Answer

Blame an individual without process review

Answer

Delete the alert rule because it was inconvenient