CS0-003 Practice Test 23 — 15 Questions

Question 1

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For validation, Which action should be taken before closing or downgrading the finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The critical unauthenticated remote-code-execution (RCE) vulnerability on the internet-facing VPN appliance poses an immediate and active threat, as it is being exploited in the wild. According to the CVSS scoring system and industry best practices (e.g., PCI DSS, NIST SP 800-115), vulnerabilities that are remotely exploitable, have high impact, and are actively exploited must be prioritized over internal-only medium-severity issues. Remediating this flaw first reduces the attack surface exposed to the internet and prevents potential compromise of the entire network.

Answer

Start with the oldest medium vulnerability

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Defer all remediation until the monthly patch window

Question 2

Arrange the steps for conducting a security incident response in the correct order.

Accepted Answer

Preparation, then Detection and Analysis, then Containment/Eradication/Recovery, then Post-Incident. Incident response follows the NIST framework: Prepare, Detect & Analyze, Contain/Eradicate/Recover, Post-Incident, and Report.

Answer

Detection and Analysis, then Preparation, then Containment/Eradication/Recovery, then Post-Incident

Answer

Preparation, then Containment/Eradication/Recovery, then Detection and Analysis, then Post-Incident

Answer

Containment/Eradication/Recovery, then Detection and Analysis, then Preparation, then Post-Incident

Question 3

During a vulnerability assessment, a security analyst discovers a critical vulnerability affecting a legacy application that cannot be patched due to vendor end-of-life status. Which of the following is the BEST next step?

Accepted Answer

Document the risk and implement compensating controls. When a patch is not available, implementing compensating controls is the best approach to mitigate risk. This may include network segmentation, access controls, or additional monitoring.

Answer

Remove the legacy application from the network immediately

Answer

Disable the application until a patch becomes available

Answer

Apply a virtual patch via an intrusion prevention system

Question 4

An analyst views the above SIEM logs from a Linux server. Which of the following attacks is MOST likely occurring?

Accepted Answer

Brute force attack leading to credential compromise and malware installation. The SIEM logs show repeated failed SSH login attempts from multiple IP addresses, followed by a successful login and then a wget command to download a suspicious file, indicating a brute force attack that succeeded, leading to credential compromise and subsequent malware installation. This pattern matches the typical lifecycle of a brute force attack against SSH services, where an attacker gains access and then stages malware.

Answer

Man-in-the-middle attack intercepting credentials

Answer

SQL injection through the web application

Answer

Denial of service attack against the SSH service

Question 5

A company experiences a data breach involving personal data of EU citizens. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of a breach.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 6

A security analyst detects unusual outbound traffic from a workstation. Which immediate action should the analyst take?

Accepted Answer

Disconnect the network cable. Disconnecting the network cable immediately isolates the workstation from the network, containing potential data exfiltration or lateral movement. This is the first step in incident response containment, as it stops the suspicious outbound traffic without destroying volatile evidence like running processes or network connections.

Answer

Run a full antivirus scan

Answer

Create a memory dump

Answer

Reimage the system

Question 7

An analyst is investigating a potential memory injection attack on a Windows system. Which of the following memory analysis artifacts is most indicative of code injection?

Accepted Answer

A process with a memory region that is both writable and executable (RWX). A process that is executing in a region of memory that is both writable and executable (RWX) is a strong indicator of injected code, as legitimate processes typically have separate write and execute permissions.

Answer

A process that is running from a temp directory

Answer

A process that has an unusually high handle count

Answer

A process with multiple threads in a suspended state

Question 8

During a vulnerability assessment, a security analyst discovers that a network device is running an outdated firmware version with known exploits. The device is critical to production and cannot be rebooted during business hours. Which of the following is the BEST approach to remediate this vulnerability?

Accepted Answer

Schedule the firmware upgrade during the next maintenance window. Scheduling the firmware upgrade during the next maintenance window aligns with change management best practices for critical production devices that cannot tolerate downtime during business hours. This approach ensures the vulnerability is remediated in a controlled manner, minimizing operational risk while still addressing the known exploit.

Answer

Apply the firmware patch immediately without rebooting

Answer

Implement a virtual patch via the IDS/IPS until a full patch is possible

Answer

Request a hotfix from the vendor that does not require a reboot

Question 9

During incident response, the team identifies that an attacker used a compromised third-party vendor account to access the network. Which of the following should the team do first?

Accepted Answer

Revoke the vendor's access. The immediate priority is to contain the breach by revoking the compromised third-party vendor's access. This stops the attacker from using the valid session or credentials to move laterally or exfiltrate data. Changing all system passwords (A) is too broad and time-consuming, while forensic analysis (C) and law enforcement notification (D) are secondary steps that occur after containment.

Answer

Change all system passwords

Answer

Conduct forensic analysis on the vendor's account

Answer

Notify law enforcement

Question 10

Which TWO of the following are essential steps in the incident response phase of 'Containment, Eradication, and Recovery'? (Choose two.)

Accepted Answer

Remove malicious files and artifacts from affected systems. Removing malicious files and artifacts from affected systems is a core step in the eradication phase, ensuring that the root cause of the incident is eliminated and the system can be safely restored to normal operations. This step directly addresses the removal of malware, persistence mechanisms, and unauthorized changes that were identified during analysis.

Answer

Reimage all systems in the environment

Answer

Disconnect the organization from the internet

Answer

Collect and preserve forensic evidence

Question 11

Order the steps for a typical patch management process.

Accepted Answer

Identify, Test, Approve, Deploy, Verify. Patch management includes identification, testing, approval, deployment, and verification.

Answer

Test, Identify, Approve, Deploy, Verify

Answer

Identify, Approve, Test, Deploy, Verify

Answer

Identify, Test, Deploy, Approve, Verify

Question 12

Which pipeline controls help prevent vulnerable dependencies reaching production? (Choose two.)

Accepted Answer

SBOM generation and review for released builds. A is correct because SBOM (Software Bill of Materials) generation and review provides a detailed inventory of all components in a build, enabling teams to identify and block vulnerable dependencies before release. This aligns with supply chain security best practices, as SBOMs allow automated comparison against vulnerability databases (e.g., NVD) to enforce policy gates early in the pipeline.

Answer

Manual badge checks at the office door

Answer

DNS MX record rotation

Question 13

A vulnerability management team uses OpenVAS to scan a network of 500 hosts weekly. The scans are causing network congestion and generating false positives. Which of the following would BEST reduce the impact while maintaining effective vulnerability detection?

Accepted Answer

Schedule scans during off-peak hours and limit concurrent scans.. Scheduling scans during off-peak hours and limiting concurrent scans directly reduces network congestion by shifting traffic to low-utilization periods and capping the number of simultaneous connections. This approach maintains the weekly scan frequency and full vulnerability coverage, unlike other options that degrade detection effectiveness.

Answer

Disable the vulnerable host discovery phase.

Answer

Increase the scan interval to monthly.

Answer

Use credential-based scanning to reduce false positives.

Question 14

An analyst identifies a security policy violation during a routine audit. The violation does not pose immediate risk. Which of the following is the BEST way to report this finding?

Accepted Answer

Create a formal report with the finding, policy references, and recommended remediation. A formal report is the best method for documenting a security policy violation because it provides a permanent, auditable record that includes specific policy references and recommended remediation steps. This aligns with the reporting and communication domain's emphasis on structured, traceable documentation for non-urgent findings, ensuring proper tracking and accountability without causing unnecessary alarm.

Answer

Mention it casually in a team meeting

Answer

Send an instant message to the system owner

Answer

Immediately report it to the Chief Information Security Officer

Question 15

Which signals strengthen an alert for Kerberoasting activity? (Choose two.)

Accepted Answer

Unusual volume of TGS requests for many service principals. Kerberoasting involves requesting Ticket-Granting Service (TGS) tickets for service principals (SPNs) to crack their passwords offline. An unusual volume of TGS requests for many SPNs is a strong indicator because attackers typically enumerate SPNs and request tickets in bulk, which deviates from normal user behavior.

Answer

A user changing their desktop wallpaper

Answer

Successful DHCP lease renewal