CS0-003 Practice Exam 4 — 20 Questions

Question 1

Match each regulatory framework to its focus.

Question 2

Match each analysis technique to its description.

Question 3

Order the steps to perform a vulnerability scan using a tool like Nessus.

Question 4

Arrange the steps for conducting a risk assessment in the correct order.

Question 5

Order the steps for setting up a SIEM (Security Information and Event Management) system.

Question 6

Arrange the steps for a typical penetration testing engagement in the correct order.

Question 7

Arrange the steps for conducting a security incident response in the correct order.

Question 8

Order the steps for proper forensic acquisition of a hard drive.

Question 9

Order the steps for deploying a new security patch to a production environment.

Question 10

Order the steps for a typical patch management process.

Question 11

Arrange the steps for a typical digital forensics investigation process.

Question 12

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. When a business unit formally accepts the risk of delaying a patch, the risk must be documented in the risk register with an owner, justification, an expiry date, and compensating controls. This ensures the risk is tracked, reviewed, and mitigated within an acceptable timeframe, which is a core requirement of vulnerability management governance.

Answer

The firewall vendor invoice

Answer

The incident containment playbook only

Answer

The phishing training completion list

Question 13

A CISO wants a concise incident update during active containment. Which elements should be included? (Choose three.)

Accepted Answer

Containment actions completed and pending. During active containment, the CISO needs a concise update focused on actions taken and pending, not raw data. Option B is correct because containment actions completed and pending directly inform the CISO of the current response status, enabling rapid decision-making without sifting through logs.

Answer

Every raw log line collected so far

Question 14

A company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible?

Accepted Answer

Tabletop exercise using a realistic ransomware scenario. A tabletop exercise is the correct choice because it allows stakeholders (legal, PR, IT, executives) to validate their roles and decision-making processes during a ransomware incident without impacting production systems. This aligns with the NIST SP 800-61 incident response testing framework, which emphasizes discussion-based exercises for validating procedures and communication flows. Unlike destructive tests, a tabletop exercise uses a realistic scenario to simulate the incident lifecycle, ensuring role clarity and procedural readiness.

Answer

Purchasing a new SIEM without testing procedures

Answer

Annual password reset only

Answer

Full destructive malware detonation in production

Question 15

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Cloud audit logs for identity, policy, and key-management API calls. Control-plane operations in cloud environments are managed through APIs for identity (IAM), policy, and key management. Cloud audit logs (e.g., AWS CloudTrail, Azure Activity Log) capture every API call to these services, including who made the call, from which IP address, and what changes were made. The spike in IAM policy changes, access key creation, and failed console logons from a new country is directly recorded in these logs, making them the strongest evidence for a control-plane compromise.

Answer

Packet captures from user laptops only

Answer

Web server access logs from the public website

Answer

Endpoint antivirus quarantine reports only

Question 16

A cloud security posture tool reports public access on object storage. Which follow-up checks matter? (Choose two.)

Accepted Answer

Whether sensitive objects were accessed or downloaded. Option B is correct because the primary concern with public access to object storage is data exposure. Checking whether sensitive objects were accessed or downloaded determines if a breach actually occurred, which is a critical follow-up step in vulnerability management. Without this check, you cannot assess the real-world impact of the misconfiguration.

Answer

Whether the storage account name is short

Answer

Whether the administrator uses dark mode

Question 17

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. After SSH hardening, credentialed scans fail because the scanner's authentication method (e.g., password or key-based login) may be blocked, or the scanner account lacks necessary sudo privileges. Option B is correct because reviewing scanner account permissions, allowed authentication methods (e.g., ensuring public key authentication is enabled in sshd_config), and sudo command restrictions directly addresses the root cause of scan failures without compromising security.

Answer

Assume the hosts have no vulnerabilities

Answer

Disable SSH on all servers

Answer

Run only unauthenticated scans forever

Question 18

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option A is correct because an executive summary for a SOC manager must focus on business risk, customer impact, remediation status, and remaining exposure. Since no exploitation was found, the emphasis shifts to the potential impact and the steps taken to mitigate the vulnerability, aligning with the SOC manager's need to communicate risk to leadership and prioritize resources.

Answer

Every command the scanner executed

Answer

Raw packet captures from the scan

Answer

A list of analyst shift times only

Question 19

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners cannot access authenticated pages without valid session credentials. Configuring authenticated scanning with a test account and proper session handling (e.g., via cookies, tokens, or form-based login) allows the scanner to crawl and test behind the login wall, ensuring coverage of all application states. This is the standard remediation for the described limitation.

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Question 20

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. The presence of a deception credential in a file share that is used to authenticate to a server, with no legitimate user knowing it, strongly indicates that an attacker has discovered and used the credential to gain unauthorized access. This is a classic sign of credential access (stealing credentials) followed by lateral movement (using them to authenticate to another system). Such activity is a high-priority incident because it suggests the attacker has moved beyond initial compromise and is actively expanding their foothold, which requires immediate containment and investigation.

Answer

A scheduled password rotation completed successfully

Answer

The file share requires more storage capacity

Answer

The SIEM parser is always broken