CS0-003 Practice Test 23 — 15 Questions

Question 1

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Correlate flow volume with database audit logs and the destination reputation. Option D is correct because correlating the flow volume with database audit logs allows the analyst to verify if the outbound transfers correspond to legitimate database queries or exports, while checking the destination reputation helps determine if the autonomous system is known for malicious activity. This combination provides the clearest triage value by directly linking the network anomaly to potential data exfiltration or a compromised database server, without prematurely disrupting operations or ignoring the encryption indicator.

Answer

Assume encryption means the transfer is safe

Answer

Delete historical flow records to reduce SIEM cost

Answer

Disable all outbound internet access for the organisation

Question 2

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. Option D is correct because the immediate priority is to restrict public read access to the storage bucket to prevent further unauthorized exposure, then determine whether sensitive customer data was accessed by reviewing access logs (e.g., AWS CloudTrail or S3 server access logs). This aligns with incident response best practices: contain the threat first, then assess impact. Without confirming data access, the team cannot properly scope the breach or notify affected parties.

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Answer

Delete all audit logs to reduce liability

Question 3

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Cloud audit logs for identity, policy, and key-management API calls. Option D is correct because cloud audit logs (e.g., AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs) capture control-plane API calls such as IAM policy changes, access key creation, and authentication events. These logs provide the strongest evidence of identity and access management (IAM) compromise at the control plane, as they directly record who made what change, from which source IP, and with what outcome. In the containment trade-off phase, preserving these logs while disabling compromised keys or applying a deny-all policy balances stopping the attacker with retaining forensic evidence.

Answer

Web server access logs from the public website

Answer

Packet captures from user laptops only

Answer

Endpoint antivirus quarantine reports only

Question 4

A security analyst needs to communicate the findings of a penetration test to the IT operations team and the CISO. Which three of the following actions best support effective reporting and communication? (Choose three.)

Accepted Answer

Provide actionable remediation steps with ownership assignments. Customizing the level of detail for each audience ensures that technical teams receive the operational depth they need (e.g., raw findings, exploit paths) while executives get a high-level summary focused on business risk and strategic impact. This aligns with the principle of audience-aware reporting in penetration testing, where the CISO requires risk context and the IT operations team needs actionable technical details.

Answer

Include raw command outputs and exploit code in the executive summary

Answer

Submit the report as a confidential document without any verbal briefing

Answer

Delay the report until all findings are fully verified with no uncertainty

Question 5

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Use them internally with only people who need to know and avoid wider redistribution. TLP:AMBER+STRICT restricts sharing to recipients within the organization who need to know, prohibiting further redistribution outside the organization. The SOC must use these indicators internally only with personnel who require them for detection and response, avoiding any external sharing. This ensures compliance with the Traffic Light Protocol (TLP) standard defined by FIRST.org.

Answer

Publish the indicators on a public GitHub repository

Answer

Send the indicators to all customers

Answer

Ignore the indicators because TLP markings are optional

Question 6

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts. Option D is correct because enrichment (URL reputation, sandbox detonation) and mailbox search counts are non-destructive, automated actions that gather threat intelligence without altering systems. This aligns with the SOC's requirement to reduce analyst workload while avoiding destructive actions before confirmation. In the detection engineering phase, tuning to reduce noise without losing signal involves adjusting thresholds or whitelisting benign indicators based on enrichment results.

Answer

Close all similar alerts as duplicates

Answer

Disable the reporting user's account immediately

Answer

Automatically delete all messages from the sender across all mailboxes

Question 7

Arrange the steps for configuring a firewall rule set in the correct order.

Question 8

After a high-priority SOC escalation, a laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Option D is correct because forensic acquisition requires a complete chain of custody to ensure evidence admissibility in legal proceedings. The responder must document who collected the evidence, the exact date/time, the physical location, cryptographic hash values (e.g., SHA-256) to verify integrity, transfer details (e.g., write-blocker used, destination media), and the final storage location. This aligns with NIST SP 800-86 and ISO 27037 forensic best practices.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title

Question 9

After a high-priority SOC escalation, after containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Remove persistence, rotate affected credentials, and verify no related hosts remain compromised. Option D is correct because after containment, the incident response process requires removing the persistence mechanism (the scheduled task), rotating the stolen service account credentials to prevent re-authentication, and verifying that no other hosts are compromised (lateral movement check). This aligns with the NIST SP 800-61 recovery phase, which mandates eradication before recovery to ensure the threat is fully removed.

Answer

Reconnect the host because users need it

Answer

Disable logging to improve performance

Answer

Close the incident after isolation

Question 10

An incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible?

Accepted Answer

Specific playbook updates, escalation triggers, owners, and due dates. Option D is correct because a post-incident review must produce actionable improvements to prevent recurrence. Delayed escalation indicates a failure in detection or notification procedures; therefore, specific playbook updates, escalation triggers, owners, and due dates directly address the root cause by refining incident response workflows and ensuring timely escalation in future incidents.

Answer

A generic statement that security is important

Answer

Deletion of all incident tickets

Answer

A blame list of individual analysts

Question 11

A malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible?

Accepted Answer

Business impact, privilege level, asset criticality, and spread potential. Option B is correct because severity in incident response is determined by business impact, privilege level, asset criticality, and spread potential, not by timing or trivial factors. A domain admin workstation has elevated privileges and access to sensitive systems, making the same malware far more dangerous than on an isolated kiosk. During recovery, prioritizing based on these factors ensures defensible decisions align with risk management frameworks like NIST SP 800-61.

Answer

Whether the alert arrived first

Answer

Alphabetical order of hostnames

Answer

The analyst's preferred dashboard theme

Question 12

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners require authenticated access to crawl and test pages behind login forms. By configuring authenticated scanning with a test account and session handling (e.g., using cookies or OAuth tokens), the scanner can traverse protected routes and detect vulnerabilities such as SQL injection or XSS on authenticated pages. This directly addresses the stated weakness without masking risk.

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Question 13

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Option C is correct because network-isolating the endpoint via EDR (e.g., using a firewall rule or agent-based isolation) stops the beaconing to the malicious IP and prevents further credential dumping, while preserving the disk and memory evidence needed for forensic analysis. This balances containment with evidence preservation by keeping the system powered on so volatile data (e.g., running processes, network connections) is not lost, unlike a hard shutdown.

Answer

Allow the host to run until the next maintenance window

Answer

Run disk cleanup to remove temporary files

Answer

Power off the machine immediately in every case

Question 14

Which three of the following are effective techniques for prioritizing vulnerabilities for remediation in a vulnerability management program? (Choose three.)

Accepted Answer

Correlating vulnerabilities with active exploit campaigns and threat intelligence feeds. Correlating vulnerabilities with active exploit campaigns and threat intelligence feeds is effective because it prioritizes vulnerabilities that are currently being exploited in the wild, which directly reduces the risk of a breach. This approach aligns remediation with real-world attacker behavior rather than theoretical severity.

Answer

Applying the Common Vulnerability Scoring System (CVSS) base score as the sole prioritization metric

Answer

Prioritizing vulnerabilities based solely on the age of the CVE

Answer

Focusing remediation efforts exclusively on vulnerabilities with a CVSS score of 9.0 or higher

Question 15

Which three of the following are best practices for integrating vulnerability scanning into a continuous integration/continuous deployment (CI/CD) pipeline? (Choose three.)

Accepted Answer

Embedding static application security testing (SAST) into the build phase to catch code-level vulnerabilities early. Embedding SAST into the build phase is a best practice because it allows developers to identify and fix code-level vulnerabilities (e.g., SQL injection, buffer overflows) early in the development lifecycle, reducing remediation cost and preventing insecure code from progressing further down the pipeline. This shift-left approach aligns with DevSecOps principles by catching flaws before they reach integration or production environments.

Answer

Scanning dependencies only when a new vulnerability disclosure is published

Answer

Scanning only the production environment after deployment to ensure real-world security

Answer

Disabling all vulnerability scanning during development to accelerate build times