CS0-003 Practice Test 22 — 15 Questions

Question 1

A security engineer is configuring a new SIEM correlation rule to detect lateral movement. Which of the following log sources would provide the most relevant data for detecting pass-the-hash attacks?

Accepted Answer

Authentication logs. Authentication logs (e.g., Windows Security Event ID 4624) contain details about logon types (e.g., Network logon) and account names, which are crucial for detecting pass-the-hash.

Answer

Cloud audit logs

Answer

DNS logs

Answer

Firewall logs

Question 2

A company uses a cloud-based identity provider (IdP) for single sign-on (SSO) to all applications. The SOC receives an alert that a user's account logged in from an IP address associated with a country where the company has no offices. The user is currently on a planned vacation and is not in that country. The analyst reviews the authentication logs and sees the login used a valid token and correct multi-factor authentication (MFA) method. Which of the following is the BEST initial step to handle this alert?

Accepted Answer

Contact the user to verify if they logged in.. The best initial step is to contact the user to verify if they logged in. Since the login used a valid token and correct MFA, it could be authorized (e.g., user using a VPN or traveling). Disabling the account or blocking the IP without verification could impact productivity if the login is legitimate. Reviewing recent activity may be useful but should come after contacting the user to avoid delays.

Answer

Review the user's recent activity for other anomalies.

Answer

Add the IP address to the block list.

Answer

Disable the user account immediately.

Question 3

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. The executive summary for legal/privacy stakeholders must focus on business risk, customer impact, remediation status, and remaining exposure. Since no exploitation was found, the summary should communicate the potential regulatory and privacy implications (e.g., GDPR, CCPA) and the steps taken to close the vulnerability, not technical details. This aligns with the CS0-004 objective of tailoring communication to the audience's need for risk-based, non-technical summaries.

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Answer

Raw packet captures from the scan

Question 4

During a phishing investigation, an employee reports clicking a link and entering credentials. Which of the following should be the first step?

Accepted Answer

Reset the employee's password. The immediate priority after credential compromise is to secure the account and prevent unauthorized access. Resetting the employee's password (Option D) invalidates the stolen credentials, stopping the attacker from using them to log in. This aligns with the NIST Incident Response Framework's containment phase, which must occur before any remediation or analysis steps.

Answer

Conduct user awareness training

Answer

Block the phishing domain

Answer

Analyze the email headers

Question 5

During a threat hunting exercise, an analyst formulates a hypothesis that an attacker may be using DNS tunneling to exfiltrate data. Which data source would provide the best evidence to confirm or deny this hypothesis?

Accepted Answer

Deep packet inspection (DPI) of DNS traffic. Deep packet inspection (DPI) of DNS traffic is the best evidence because DNS tunneling works by encoding data within DNS queries and responses, often using non-standard record types (e.g., TXT, NULL) or unusually long domain names. DPI can decode the payload within DNS packets to reveal hidden data, whereas other methods only see metadata or connection summaries. This allows the analyst to directly inspect the content of DNS messages for signs of exfiltration, such as base64-encoded data or anomalous query patterns.

Answer

Firewall logs showing allowed outbound connections

Answer

NetFlow records from the border router

Answer

EndPoint detection and response (EDR) logs showing DNS client activity

Question 6

A security analyst has identified a critical vulnerability that affects multiple systems. The analyst needs to report the vulnerability to management. Which THREE elements should be included in the vulnerability report? (Choose three.)

Accepted Answer

Number of affected systems and their criticality. A vulnerability report must convey the scope and business impact of the issue. Including the number of affected systems and their criticality (e.g., system classification, data sensitivity, or role in the network) allows management to prioritize remediation based on risk exposure. Without this context, management cannot assess the urgency or allocate resources effectively.

Answer

Specific patch installation dates for each system

Answer

Organizational risk appetite

Question 7

A company has implemented a vulnerability management program. The security team needs to ensure that all critical vulnerabilities are remediated within 30 days. Which of the following metrics would BEST measure the effectiveness of this goal?

Accepted Answer

Mean time to remediate critical vulnerabilities. The goal is to ensure all critical vulnerabilities are remediated within 30 days. Mean time to remediate (MTTR) directly measures the average time taken to fix critical vulnerabilities, making it the best metric to assess compliance with the 30-day remediation window. Other metrics, such as detection counts or patch levels, do not capture the timeliness of remediation.

Answer

Number of critical vulnerabilities detected per month

Answer

Number of rescan results showing vulnerability closure

Answer

Percentage of systems with up-to-date patches

Question 8

Which SIEM component is responsible for centralizing and correlating logs from multiple sources?

Accepted Answer

Correlation engine. The correlation engine is the SIEM component specifically designed to centralize and analyze logs from multiple sources, applying rules and statistical analysis to identify relationships and patterns indicative of security incidents. It ingests normalized data from the aggregation tier and uses correlation rules to detect complex threats like multi-stage attacks or lateral movement across different systems.

Answer

Data retention system

Answer

Aggregation tier

Answer

Normalization component

Question 9

An analyst is reviewing a CASB alert indicating that a user accessed a cloud application from a geolocation that is not typical for the organization. Which THREE additional data sources would be most helpful to determine if the activity is malicious?

Accepted Answer

User activity logs from the cloud application. Option A (User activity logs from the cloud application) is correct because these logs reveal what the user actually did inside the SaaS app—file downloads, sharing changes, admin actions, or mass data access—which distinguishes benign travel-related access from malicious exfiltration or account takeover. Option B (Threat intelligence feeds for the source IP address) is correct because enriching the source IP with reputation, proxy/VPN/Tor exit-node, and known-bad infrastructure data helps determine whether the geolocation is a hostile or anonymized source rather than the legitimate user. Option E (Authentication logs from the identity provider) is correct because IdP logs show the authentication context—MFA success/failure, device, session token issuance, impossible-travel patterns, and sign-in risk—confirming whether the session was legitimately established or the result of credential compromise. Option C (Firewall logs showing outbound connections) is not among the marked answers because outbound firewall metadata generally shows only IP/port/protocol and cannot confirm user identity or in-app behavior, adding little beyond what the CASB alert and IP reputation already provide. Option D (Vulnerability scan results for the user's workstation) is not among the marked answers because endpoint vulnerabilities describe potential exposure and do not indicate whether this specific cloud access was malicious or legitimate.

Answer

Firewall logs showing outbound connections

Answer

Vulnerability scan results for the user's workstation

Question 10

A threat hunter suspects data exfiltration over HTTPS from a database server. Which data sources are most useful? (Choose two.)

Accepted Answer

Database audit logs showing queried objects and accounts. Database audit logs record which objects (tables, columns) were queried and by which accounts, directly revealing unauthorized access or unusual data retrieval patterns that could indicate exfiltration. NetFlow or proxy logs capture destination IP addresses, data volumes, and timing of HTTPS sessions, allowing the hunter to spot large or anomalous outbound transfers to suspicious hosts, even though the payload is encrypted.

Answer

Printer toner status

Answer

Building temperature logs

Question 11

A responder is acquiring evidence from a potentially compromised server. Which actions support forensic integrity? (Choose two.)

Accepted Answer

Calculate and record hashes of acquired images. Calculating and recording hashes (e.g., SHA-256) of acquired disk images ensures data integrity by providing a cryptographic fingerprint that can be used later to verify that the evidence has not been altered. This is a foundational step in forensic acquisition, as any modification to the image will produce a different hash, proving tampering or corruption.

Answer

Disable all logging before acquisition

Answer

Edit suspicious files to see whether malware reacts

Question 12

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant?

Accepted Answer

Office document spawning a script interpreter from a user context. The correct detection logic is 'Office document spawning a script interpreter from a user context' because the scenario describes a classic phishing attack where a malicious macro or embedded script in an invoice document launches wscript.exe (a Windows Script Host interpreter) from the user's profile directory. This behavior is a strong indicator of script-based malware execution, as legitimate Office documents rarely spawn script interpreters directly from user-writable paths. The detection logic specifically targets the parent-child process relationship between an Office application (e.g., WINWORD.EXE, EXCEL.EXE) and wscript.exe, which is a common technique used by attackers to bypass application whitelisting and execute arbitrary code.

Answer

A password expiry warning

Answer

High CPU usage on the print server

Answer

Successful DHCP renewal

Question 13

A security analyst is prioritizing vulnerabilities for remediation. The analyst has the following information: a vulnerability with a CVSS score of 9.0 that affects a public-facing web server, and a vulnerability with a CVSS score of 7.5 that affects an internal database server with sensitive data. Which two factors should the analyst consider when prioritizing? (Choose two.)

Accepted Answer

The presence of known exploits in the wild.. The presence of known exploits in the wild directly impacts the likelihood of a vulnerability being weaponized. Even a high CVSS score (e.g., 9.0) may be less urgent if no exploit exists, while a lower-scored vulnerability (e.g., 7.5) with active exploitation poses an immediate threat. This aligns with the CVSS environmental metrics and threat intelligence integration in vulnerability management.

Answer

The vendor's patch release date.

Answer

The number of open ports on each server.

Answer

The vulnerability publication date.

Question 14

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix?

Accepted Answer

Log normalization and field mapping in the parser. Log normalization and field mapping in the parser ensure that source IP, user, and action fields from the new cloud log source are consistently transformed into the schema expected by the SIEM or analytics platform. Without this, the analytics engine cannot correlate or alert on the data because the fields are not recognized or are mapped to incorrect attributes, leading to failed analytics.

Answer

Disable all enrichment lookups

Answer

Increase the dashboard refresh interval

Answer

Move logs to cold storage immediately

Question 15

A host is suspected of running fileless malware. Which artefacts should be collected quickly? (Choose two.)

Accepted Answer

Memory image or live response data. Fileless malware operates in memory without writing to disk, so capturing a memory image or live response data preserves the malicious code, injected DLLs, and process hollowing artifacts that would vanish on reboot. Active network connections and running processes reveal the malware's C2 communications and its in-memory execution context, which are critical for identifying the infection vector and scope.

Answer

A list of cafeteria purchases

Answer

A printed office map