CS0-003 Practice Exam 3 — 20 Questions

Question 1

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Option D is correct because correlating DNS query logs with endpoint process and network connection telemetry provides direct evidence of command-and-control (C2) beaconing. The algorithmically generated domains (DGA) and NXDOMAIN responses are strong indicators of an infected host attempting to contact a C2 server that is currently offline or unreachable. By linking the DNS queries to the specific process generating them and the subsequent network connections, the analyst can confirm malicious activity rather than benign misconfiguration.

Answer

Delete the host from the SIEM asset inventory

Answer

Search only for successful HTTP 200 responses

Answer

Block all DNS traffic from the subnet

Question 2

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

A retest showing the vulnerable condition is no longer present. Option D is correct because the vulnerability manager must obtain objective evidence that the vulnerability has been remediated. A retest, either automated or manual, confirms that the specific vulnerable condition (e.g., a missing patch, misconfiguration, or outdated library) is no longer present on the asset. This aligns with the NIST SP 800-115 and PCI DSS 11.3.2 requirement for verification of remediation before closure.

Answer

Wait one year before testing

Answer

Close it immediately based on the email

Answer

Create a duplicate ticket for every asset

Question 3

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. Option D is correct because SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) can break credentialed scans if the scanner's account permissions, allowed authentication methods, or sudo command restrictions are not aligned with the new configuration. Reviewing these settings ensures the scanner can authenticate and execute privileged commands, restoring scan coverage without compromising security.

Answer

Run only unauthenticated scans forever

Answer

Disable SSH on all servers

Answer

Assume the hosts have no vulnerabilities

Question 4

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are the standard operational metrics for measuring incident response effectiveness. These directly quantify how quickly threats are identified, contained, and whether they return, which is exactly what the CISO needs to assess quarter-over-quarter improvement.

Answer

Number of desktop wallpapers changed

Answer

Total coffee consumed by analysts

Answer

Number of unused dashboards

Question 5

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option D is correct because the only way to definitively resolve a discrepancy between a scanner finding and a service owner's claim is to perform an independent, manual test. Using a TLS client (e.g., OpenSSL s_client) or a scanner profile that specifically negotiates protocol versions allows you to directly verify whether the server actually accepts TLS 1.0 connections, eliminating false positives or misconfigurations.

Answer

Change the severity to informational automatically

Answer

Close the finding because the owner disagrees

Answer

Delete the server from the scan scope

Question 6

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Asset criticality, exposure, and business impact. Option D is correct because remediation priority in vulnerability management is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API server has high business impact and exposure to external threats, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based prioritization frameworks such as CVSS environmental metrics and FAIR analysis.

Answer

The number of installed fonts

Answer

The colour of the scanner dashboard

Answer

Whether the hostname is shorter

Question 7

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option B is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk owner, the reason for the delay, any compensating controls in place, a scheduled review date, and an expiry date. This ensures accountability, traceability, and that the risk is not permanently ignored, aligning with risk management frameworks like NIST SP 800-37 or ISO 27001.

Answer

A permanent exception with no review

Answer

Only the analyst's personal opinion

Answer

No mention of the accepted risk

Question 8

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. Option B is correct because the detection of a user authenticating from geographically distant locations within 12 minutes strongly suggests credential theft or token replay, and the subsequent mailbox forwarding rule creation indicates a data exfiltration attempt. The analyst must first correlate sign-in logs (to verify the source IPs and timestamps), MFA results (to check if MFA was satisfied or bypassed), device details (to identify if a known or managed device was used), and mailbox audit events (to confirm who created the forwarding rule and when). This combination directly validates or refutes the UEBA alert by providing the evidence needed to distinguish between a legitimate user with a VPN or a compromised account.

Answer

Only the user's browser cache

Answer

Only DHCP logs from the London office

Answer

The organisation's public DNS zone file

Question 9

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Sigma rule. Sigma rules are the correct choice because they are designed as a generic, open-source signature format for log events, making them portable across multiple SIEM platforms (e.g., Splunk, Elastic, QRadar) without vendor lock-in. For suspicious rundll32 execution, a Sigma rule can describe the specific event log patterns (e.g., Event ID 4688 with CommandLine containing 'rundll32.exe') that can be converted into each SIEM's native query language. This portability directly meets the threat hunter's goal of creating a detection that can be reused across different environments.

Answer

CVSS vector string

Answer

YARA rule

Answer

OpenIOC package only

Question 10

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option A is correct because it directly addresses the board's question about whether cyber risk is decreasing by presenting trend data on exploitable critical exposures, remediation SLA performance, and residual risk by business service. This combination provides a clear, measurable view of risk reduction over time, which is exactly what a SOC manager needs to justify the vulnerability-management investment. The focus on residual risk by business service ties technical findings to business impact, making the data actionable for both technical and executive audiences.

Answer

A screenshot of every scanner page

Answer

A list of tool login names

Answer

A raw CSV of 20,000 findings

Question 11

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Asset criticality, exposure, and business impact. D is correct because remediation priority is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API has high business impact and exposure, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based vulnerability management principles where context (e.g., data sensitivity, network reachability) drives patching order.

Answer

The colour of the scanner dashboard

Answer

The number of installed fonts

Answer

Whether the hostname is shorter

Question 12

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are the core operational metrics that directly measure the effectiveness and efficiency of an incident response program. For a SOC manager assessing quarter-over-quarter improvement, these metrics provide actionable insight into detection speed, response agility, containment effectiveness, and whether incidents are being fully remediated to prevent repeats.

Answer

Number of desktop wallpapers changed

Answer

Number of unused dashboards

Answer

Total coffee consumed by analysts

Question 13

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners analyze live web applications by sending HTTP requests and inspecting responses. When authentication is required to access protected pages, the scanner must maintain a valid session to reach those endpoints. Configuring authenticated scanning with a test account and proper session handling (e.g., using cookies, tokens, or form-based login) allows the scanner to traverse authenticated pages, ensuring the scan covers the full attack surface and reports findings from restricted areas.

Answer

Reduce the scan to only the landing page

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Question 14

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option D is correct because it directly answers the board's question about whether cyber risk is decreasing by showing a trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. This provides a clear, quantitative, and business-aligned view of risk reduction, which is essential for executive reporting. For a technical remediation owner, this content is most appropriate as it focuses on actionable metrics (e.g., SLA compliance, residual risk per service) that directly guide patching and mitigation priorities.

Answer

A raw CSV of 20,000 findings

Answer

A screenshot of every scanner page

Answer

A list of tool login names

Question 15

Match each security tool to its primary purpose.

Question 16

Match each network protocol to its well-known port number.

Question 17

Match each incident response phase to its activity.

Question 18

Match each threat intelligence source to its description.

Question 19

Match each log type to its typical source.

Question 20

Match each vulnerability scanning concept to its definition.