CS0-003 Practice Exam 4 — 20 Questions

Question 1

An organization performs quarterly vulnerability scans of its internal network. The scans have a high number of false positives for out-of-date software that is actually up to date. Which of the following would BEST improve the accuracy of the scans?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement credential-based scanning.. Credential-based scanning (authenticated scanning) allows the scanner to log into target systems with valid credentials, enabling it to query the local registry or package manager for the exact installed software versions. This eliminates reliance on banner grabbing or service fingerprinting, which often produce false positives when out-of-date software is detected based on network-level heuristics rather than actual installed patches.

Answer

Disable verbose output to reduce clutter.

Answer

Increase scan frequency to monthly.

Answer

Use a different vulnerability scanner.

Question 2

A small business with 50 employees uses a single Windows Server 2019 as a domain controller and file server. The company recently experienced a ransomware attack that encrypted all files on the server. The IT manager restored the files from a backup that was taken two days before the attack. However, the next day, the files were encrypted again. The analyst suspects the ransomware may have persisted or re-entered. The network is air-gapped from the internet, but employees use USB drives. Which of the following is the MOST likely reason for the re-infection?

Accepted Answer

An employee inserted an infected USB drive after the restoration.. The network is air-gapped from the internet, leaving USB drives as the primary vector for reintroducing malware. If an employee inserted an infected USB drive after the restoration, the ransomware could execute and re-encrypt the files. The air-gap eliminates internet-based re-entry, and the backup was clean since it restored files without immediate re-encryption until the next day.

Answer

The backup itself contained the ransomware.

Answer

The ransomware was still active in memory on the server.

Answer

The domain controller was not fully patched.

Question 3

An organization uses automated patch management for workstations but manual patching for servers. After a critical vulnerability is announced, the security team wants to expedite patching for servers. Which of the following is the BEST approach?

Accepted Answer

Test the patch in a staging environment and then deploy. Testing the patch in a staging environment before deploying to production servers validates compatibility and stability, reducing the risk of service disruption. This approach balances the urgency of a critical vulnerability with the need to maintain server availability, which is especially important given that manual patching is the standard procedure for servers. Staging allows the security team to identify any conflicts with existing configurations or dependencies before widespread deployment.

Answer

Disable the affected services until the patch can be applied

Answer

Deploy the patch immediately to all servers

Answer

Implement virtual patching via an IPS

Question 4

A security analyst is conducting a vulnerability assessment of a web application. The assessment reveals that the application is vulnerable to SQL injection. Which of the following is the MOST effective remediation?

Accepted Answer

Use parameterized queries in the application code. Parameterized queries (also known as prepared statements) are the most effective remediation for SQL injection because they separate SQL logic from user-supplied data by using placeholders. The database engine treats the input strictly as data, not executable code, which prevents an attacker from altering the query structure. This addresses the root cause at the application layer, unlike other controls that only mitigate or detect the attack.

Answer

Upgrade the web application framework to the latest version

Answer

Deploy a web application firewall (WAF)

Answer

Implement client-side input validation

Question 5

During a vulnerability scan, an analyst discovers a high-severity vulnerability on a critical database server. The server is in production and cannot be taken offline. The vendor has released a patch but requires a reboot. Which of the following should the analyst recommend FIRST?

Accepted Answer

Schedule the patch during the next maintenance window.. The database server is in production and cannot be taken offline, so the patch must be applied during a scheduled maintenance window to minimize business disruption. The vulnerability is high-severity, but the vendor requires a reboot, which would cause downtime; therefore, the first step is to plan the patch application at the next available maintenance window, not to apply it immediately or implement a workaround that may not fully mitigate the risk.

Answer

Implement a workaround from the vendor.

Answer

Apply the patch immediately.

Answer

Migrate the database to a new server.

Question 6

A security dashboard is being designed for the executive team. Which metric is MOST appropriate to display?

Accepted Answer

Overall risk posture score with trend over time. The executive team requires a high-level, strategic view of security effectiveness, not granular operational data. The overall risk posture score with trend over time directly communicates the organization's security health and whether it is improving or deteriorating, enabling informed decision-making. This aligns with the Reporting and Communication domain's emphasis on translating technical metrics into business-relevant insights.

Answer

Current CPU utilization on firewalls

Answer

Patch installation status of all endpoints

Answer

Number of IDS alerts per hour

Question 7

A cloud security posture tool reports public access on object storage. Which follow-up checks matter? (Choose two.)

Accepted Answer

Whether sensitive objects were accessed or downloaded. The primary concern with public access to object storage is data exposure. Checking whether sensitive objects were accessed or downloaded determines if a breach actually occurred, which is a critical follow-up step in vulnerability management. Without this check, you cannot assess the real-world impact of the misconfiguration.

Answer

Whether the storage account name is short

Answer

Whether the administrator uses dark mode

Question 8

A security analyst has identified a critical vulnerability in a customer-facing web application. The analyst needs to communicate this to senior management. Which of the following is the best approach for this communication?

Accepted Answer

Summarize the vulnerability in terms of business risk, potential financial impact, and recommended mitigation timeline.. Communicating a critical vulnerability to senior management requires translating technical risk into business impact. Security analysts must present findings in terms of potential financial loss, regulatory consequences, and a clear mitigation timeline, enabling informed decision-making without requiring deep technical expertise.

Answer

Send a brief email stating that a critical vulnerability exists and ask management to schedule a meeting.

Answer

Notify the development team only and have them fix it before informing management.

Answer

Provide a detailed technical analysis of the vulnerability, including exploit code.

Question 9

After containing a ransomware outbreak, the incident response team needs to restore encrypted files. They have verified clean backups from two weeks ago, but some critical files were modified on the day of the attack. What is the best approach?

Accepted Answer

Restore critical files from backup and manually update them using change logs. Restoring critical files from backup and manually updating them using change logs preserves the modifications made on the day of the attack, which are not present in the two-week-old backups. This approach ensures data integrity by combining the clean baseline from backups with the legitimate changes recorded in change logs, avoiding data loss while maintaining security.

Answer

Restore from backups and then apply all available updates

Answer

Attempt to decrypt files using the ransom key

Answer

Restore all files from backups

Question 10

Your organization has deployed a new web application on a Linux server. The application uses a custom database port (TCP 3307). During a routine vulnerability scan, the scanner reports a critical vulnerability: 'MySQL Server - Unrestricted File Upload (CVE-20XX-XXXX)'. The system administrator confirms that MySQL is not installed; the custom database uses PostgreSQL on port 3307. The scanner likely misidentified the service due to port-based fingerprinting. On further investigation, you find that the scanner's fingerprinting database has an incorrect mapping for port 3307. The PostgreSQL version is current and fully patched. The environment is production and cannot be disrupted. Which of the following is the BEST action to take?

Accepted Answer

Mark the vulnerability as a false positive and suppress it for this asset.. The vulnerability report is based on a false positive: the scanner misidentified the service on port 3307 as MySQL due to an incorrect port mapping in its fingerprinting database, while the actual service is a fully patched PostgreSQL. Since MySQL is not installed and no actual vulnerability exists, marking the finding as a false positive and suppressing it for this asset is the appropriate response in a production environment that cannot be disrupted.

Answer

Manually update the scanner's database to correct the port mapping.

Answer

Schedule an immediate patch of the supposed MySQL vulnerability.

Answer

Apply a workaround to block file upload functionality on port 3307.

Question 11

A security analyst has identified a large number of false positives in a vulnerability scan report. Which of the following is the BEST way to reduce false positives in future scans?

Accepted Answer

Tune the vulnerability scanner's configuration. Tuning the vulnerability scanner's configuration (option D) is the best approach because it allows the analyst to adjust scan parameters such as credential settings, plugin thresholds, and network timeouts to match the target environment. This reduces false positives by ensuring the scanner accurately identifies real vulnerabilities rather than reporting benign deviations or configuration mismatches. For example, enabling authenticated scans with valid credentials eliminates many false positives related to missing patches that are actually installed.

Answer

Manually verify each vulnerability before reporting

Answer

Increase the frequency of vulnerability scans

Answer

Exclude the false positives from the report

Question 12

A security analyst suspects an insider threat based on unusual data access patterns by an employee. According to best practices, which TWO actions should the analyst take FIRST?

Accepted Answer

Restrict the employee's access to sensitive data.. Restricting the employee's access to sensitive data (A) is a correct first action because it immediately reduces the risk of further data exfiltration or damage while preserving the ability to investigate. Collecting additional evidence without alerting the employee (D) is also correct because it allows the analyst to build a forensic case covertly, preventing the insider from destroying evidence or altering behavior. Both actions align with the incident response principle of containment before eradication and the need to avoid tipping off a potential adversary.

Answer

Suspend the employee's accounts outright.

Answer

Immediately notify law enforcement.

Answer

Confront the employee about the behavior.

Question 13

Order the steps to perform a vulnerability scan using a tool like Nessus.

Accepted Answer

Define targets, then choose a scan policy, then configure settings, then execute the scan, then analyze results. Vulnerability scanning typically involves defining targets, choosing a policy, configuring settings, executing, and analyzing results.

Answer

Define targets, then configure settings, then choose a scan policy, then execute the scan, then analyze results

Answer

Choose a scan policy, then define targets, then configure settings, then execute the scan, then analyze results

Answer

Define targets, then choose a scan policy, then execute the scan, then configure settings, then analyze results

Question 14

An analyst wants to capture all traffic to and from a specific IP address for analysis. Which command-line tool is most appropriate?

Accepted Answer

tcpdump host 10.0.0.1. `tcpdump host 10.0.0.1` captures all packets where the source or destination IP address matches 10.0.0.1, making it the ideal tool for capturing all traffic to and from a specific IP for analysis. It operates at the packet level, using libpcap to intercept raw network frames, and the `host` filter instructs it to match both directions of traffic without additional parsing or state tracking.

Answer

nmap -sS 10.0.0.1

Answer

netstat -ant | grep 10.0.0.1

Answer

iptables -L -v

Question 15

Arrange the steps for conducting a risk assessment in the correct order.

Accepted Answer

1. Identify assets, 2. Identify threats and vulnerabilities, 3. Analyze likelihood and impact, 4. Calculate risk, 5. Prioritize risks. Risk assessment involves asset identification, threat/vulnerability identification, likelihood/impact analysis, risk calculation, and prioritization.

Answer

1. Identify threats and vulnerabilities, 2. Identify assets, 3. Analyze likelihood and impact, 4. Calculate risk, 5. Prioritize risks

Answer

1. Identify assets, 2. Identify threats and vulnerabilities, 3. Calculate risk, 4. Analyze likelihood and impact, 5. Prioritize risks

Answer

1. Identify assets, 2. Identify threats and vulnerabilities, 3. Analyze likelihood and impact, 4. Prioritize risks, 5. Calculate risk

Question 16

A security engineer needs to implement a baseline configuration for all new Linux servers. Which of the following should be included in the baseline to reduce the attack surface?

Accepted Answer

Disable all unnecessary services and daemons.. Disabling all unnecessary services and daemons directly reduces the attack surface by eliminating potential entry points for exploitation. Each running service represents a vector for attacks, such as buffer overflows or misconfigurations, and removing them minimizes the number of listening ports and active processes. This aligns with the principle of least functionality, a core security baseline for Linux servers.

Answer

Enable strong password policies for all users.

Answer

Enable comprehensive audit logging.

Answer

Configure disk encryption for all data volumes.

Question 17

After a risk assessment, a security analyst recommends accepting a low-risk finding. The system owner disagrees. Which communication strategy should the analyst use?

Accepted Answer

Present the risk assessment data and cost-benefit analysis to justify acceptance. The security analyst should use data-driven communication to resolve disagreements over risk acceptance. By presenting the risk assessment data and a cost-benefit analysis, the analyst provides objective evidence that the low-risk finding does not warrant mitigation, aligning with the NIST risk management framework's emphasis on informed decision-making. This approach respects the system owner's concerns while justifying the acceptance based on technical and business rationale.

Answer

Escalate the disagreement to the CISO immediately

Answer

Agree with the system owner and change the recommendation

Answer

Insist that the finding must be mitigated due to policy

Question 18

A security team discovers a critical vulnerability in a widely used software component. The vulnerability has a CVSS score of 9.0, but there is no known exploit or patch available yet. However, the software vendor has released a workaround. According to the vulnerability management lifecycle, which action should the team prioritize first?

Accepted Answer

Apply the workaround as a compensating control. Since no patch is available, the team should apply compensating controls to mitigate the risk. Remediation typically involves patching, but if not possible, compensating controls are the next best step.

Answer

Wait for the vendor to release a patch before taking any action

Answer

Remove the affected component from all systems immediately

Answer

Increase monitoring of the affected systems but take no other action

Question 19

After a data breach incident, a post-incident review team is collecting lessons learned. Which THREE items should be included in the lessons learned documentation?

Accepted Answer

Timeline of events during the incident. The timeline of events is a critical component of lessons learned documentation. It provides a chronological sequence of actions, detections, and responses during the incident, which is essential for identifying gaps in detection, delays in response, and opportunities for improvement. Without a precise timeline, the team cannot accurately assess the effectiveness of their incident response procedures or the speed of containment.

Answer

Individual performance evaluations of team members

Answer

Legal liability of the organization

Question 20

During a network traffic analysis, a security analyst observes repeated connections from an internal host to a known malicious IP on port 4444. The payload appears to be encrypted. Which type of activity is most likely indicated?

Accepted Answer

Command and control beaconing. Repeated connections to a known malicious IP on a non-standard port with encrypted payloads strongly suggest command and control (C2) beaconing.

Answer

Port scanning activity

Answer

Data exfiltration via DNS tunnelling

Answer

Lateral movement using SMB