CS0-003 Practice Test 21 — 15 Questions

Question 1

Which tool is specifically designed to check Linux systems for compliance with security best practices and can be used for configuration auditing?

Accepted Answer

Lynis. Lynis is a security auditing tool for Linux/Unix systems that performs compliance checks and configuration reviews.

Answer

Burp Suite

Answer

OpenVAS

Answer

Nessus

Question 2

Which of the following is the primary purpose of log normalisation in a SIEM?

Accepted Answer

Convert logs into a standardised format for correlation and analysis. Log normalisation converts logs from different sources into a common, structured format so that the SIEM can correlate and analyse them uniformly.

Answer

Encrypt logs to protect confidentiality

Answer

Reduce storage space by compressing log data

Answer

Remove false positives from log entries

Question 3

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from a known internal IP address to a file server. The user authenticated successfully on the next attempt. Which classification best describes this alert?

Accepted Answer

False positive. The alert is a false positive because a single failed login followed by success is normal user behavior and not indicative of malicious activity.

Answer

True negative

Answer

True positive

Answer

False negative

Question 4

A security analyst detects ransomware on a critical server. Which containment strategy should be implemented FIRST to minimize damage?

Accepted Answer

Disconnect the server from the network. Immediate network isolation (short-term containment) stops lateral spread and limits damage.

Answer

Run a full antivirus scan on the server

Answer

Block the ransomware's command-and-control IP at the firewall

Answer

Rebuild the server from a clean backup

Question 5

An organization is experiencing a DDoS attack targeting its web servers. Which of the following is the BEST short-term containment strategy?

Accepted Answer

Reroute traffic through a DDoS mitigation service.. Short-term containment for DDoS often involves rerouting traffic through a scrubbing center or cloud-based DDoS mitigation service that filters malicious traffic.

Answer

Rebuild the web servers from backups.

Answer

Implement rate limiting on the firewall.

Answer

Disable the web server accounts.

Question 6

During a post-incident activity, the CSIRT performs a root cause analysis for a data breach. They discover that the breach originated from a misconfigured S3 bucket that allowed public read access. Which of the following actions should be included in the lessons learned to prevent recurrence?

Accepted Answer

Implement automated compliance checks for cloud storage configurations. Implementing automated compliance checks using tools like AWS Config ensures that storage configurations are continuously monitored and misconfigurations are flagged or corrected.

Answer

Rotate all access keys for the affected account

Answer

Disable public access to all S3 buckets permanently

Answer

Conduct a penetration test on the cloud environment

Question 7

A security analyst is using OpenSCAP to perform a compliance scan against a set of RHEL servers. The analyst wants to ensure the servers comply with the CIS Benchmark Level 1 for Red Hat Enterprise Linux. What does Level 1 typically indicate?

Accepted Answer

A set of security controls that are considered best practices with minimal impact on functionality. CIS Benchmarks define Level 1 as basic security requirements that can be implemented with minimal impact on functionality, while Level 2 includes more stringent controls.

Answer

A custom profile defined by the organization

Answer

The most secure configuration possible

Answer

Configuration settings that are required for DoD environments

Question 8

An analyst is using YARA to create rules for detecting a specific malware strain. Which of the following pieces of information is MOST useful for writing a YARA rule?

Accepted Answer

A unique string within the malware.. YARA rules are based on patterns in the file, such as strings and byte sequences. A unique string found in the malware sample can be used to create a rule that identifies the malware.

Answer

The malware's file size.

Answer

The date the malware was first seen.

Answer

The malware's MD5 hash.

Question 9

A security team is responding to a phishing incident that led to credential compromise. Which of the following is the BEST short-term containment action to prevent further damage?

Accepted Answer

Disable the compromised user account.. Short-term containment aims to stop the attack quickly. Disabling the compromised account prevents the attacker from using the stolen credentials to access resources.

Answer

Rebuild the user's workstation.

Answer

Block the phishing email's source IP at the firewall.

Answer

Rotate all domain admin passwords.

Question 10

During a forensic analysis, an analyst needs to collect data in order of volatility. Which of the following represents the correct order from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility dictates that volatile data in memory (CPU registers, RAM) is collected first, then less volatile data like swap, disk, and logs. The correct sequence is CPU registers, RAM, swap, disk, then logs.

Answer

Disk, swap, RAM, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Answer

Logs, disk, swap, RAM, CPU registers

Question 11

A security analyst is using a container image scanner to identify vulnerabilities in a Kubernetes deployment. Which of the following tools is specifically designed for container image scanning?

Accepted Answer

Trivy. Trivy is a popular open-source tool for scanning container images for vulnerabilities.

Answer

OpenVAS

Answer

Nessus

Answer

Burp Suite

Question 12

During a vulnerability assessment, a security analyst discovers a web application that is vulnerable to SQL injection. The application is a legacy system that cannot be easily patched. The analyst recommends implementing a web application firewall (WAF) rule to block malicious SQL patterns. Which type of control does this represent?

Accepted Answer

Compensating control. A compensating control is an alternative control that mitigates risk when the primary control (patch) cannot be applied.

Answer

Corrective control

Answer

Preventive control

Answer

Detective control

Question 13

A security analyst is reviewing a DAST report from Burp Suite for a web application. The report indicates a potential Server-Side Request Forgery (SSRF) vulnerability in a feature that fetches URLs. Which of the following is the most effective mitigation?

Accepted Answer

Use a whitelist of allowed URLs and validate user input against it.. SSRF can be mitigated by validating and sanitizing user input, whitelisting allowed URLs, and blocking access to internal networks.

Answer

Disable the URL fetching feature entirely.

Answer

Increase memory limits on the server to prevent resource exhaustion.

Answer

Implement a Web Application Firewall (WAF) to block malicious requests.

Question 14

An analyst needs to collect evidence for a compliance audit. Which type of evidence is most appropriate to demonstrate that access reviews are performed regularly?

Accepted Answer

Access review reports. Access review reports serve as direct evidence that reviews are conducted, showing dates and outcomes.

Answer

Vulnerability scan reports

Answer

Configuration backups

Answer

Log exports of user activity

Question 15

An analyst receives an alert that a user's workstation contacted a known command-and-control (C2) IP address. The analyst checks the EDR logs and finds that the process 'svchost.exe' initiated the connection. What should the analyst do next to determine if this is a true positive?

Accepted Answer

Check the parent process of svchost.exe. Checking the parent process of svchost.exe helps identify if it was spawned by a malicious process like a service or scheduled task, indicating compromise.

Answer

Verify the IP address with threat intelligence feeds

Answer

Search for other workstations contacting the same IP

Answer

Isolate the workstation from the network immediately