CS0-003 Practice Test 24 — 15 Questions

Question 1

During a post-incident review, the security team needs to communicate findings to the IT operations team. Which communication method is MOST effective for this audience?

Accepted Answer

A detailed technical report including indicators of compromise and remediation procedures. The IT operations team needs actionable technical details to implement remediation and prevent recurrence. A detailed technical report with indicators of compromise (IoCs) and remediation procedures provides the precise commands, log entries, and configuration changes required for their work, making it the most effective method for this audience.

Answer

A presentation with graphs and trends

Answer

An informal email with bullet points and no specific actions

Answer

A one-page executive summary with risk ratings

Question 2

Which THREE of the following are common challenges in vulnerability management? (Select THREE)

Accepted Answer

Lack of asset inventory. Without a complete and accurate asset inventory, vulnerability management cannot identify which systems require scanning or patching. An asset inventory provides the foundational data for vulnerability scanning scope, and its absence leads to blind spots where unmanaged systems remain unpatched and vulnerable.

Answer

Inability to scan all systems

Answer

Excessive budget

Question 3

Order the steps for proper forensic acquisition of a hard drive.

Accepted Answer

Document chain of custody, connect write blocker, create forensic image, hash original drive, hash image, store securely. Forensic acquisition requires documentation, write-blocked imaging, hash verification, secure storage, and image hash verification.

Answer

Connect write blocker, document chain of custody, create forensic image, hash original drive, hash image, store securely

Answer

Document chain of custody, create forensic image, connect write blocker, hash original drive, hash image, store securely

Answer

Document chain of custody, connect write blocker, create forensic image, hash image, hash original drive, store securely

Question 4

A large enterprise uses a vulnerability management platform that integrates with Active Directory and a configuration management database (CMDB). During a quarterly scan, a critical vulnerability (CVE-2021-44228) is detected on a legacy application server running an end-of-life (EOL) version of Java. The server supports a critical business process and cannot be upgraded or patched because the vendor no longer provides updates. The analyst must reduce the risk to an acceptable level. What is the best approach?

Accepted Answer

Implement network segmentation and strict access controls to limit exposure. Network segmentation combined with strict access controls limits the attack surface and potential impact, providing a practical risk reduction when patching is not possible. Removing the server would disrupt business, hotfixes are unavailable, and replacement is a long-term project.

Answer

Remove the server from the network until it can be replaced

Answer

Apply a vendor-supplied hotfix to mitigate the vulnerability

Answer

Replace the server with a newer model that supports patching

Question 5

A vulnerability scan report shows a critical vulnerability with a CVSS score of 10.0. The application team states that the affected service is isolated in a DMZ and has no access to sensitive data. What should the analyst consider?

Accepted Answer

Accept the risk based on compensating controls. Compensating controls like network isolation can reduce the risk even if the vulnerability itself is critical.

Answer

Reclassify the vulnerability as low severity

Answer

Immediately patch the vulnerability

Answer

Ignore the finding as a false positive

Question 6

An organization has experienced a data breach involving personally identifiable information (PII). The incident response team has contained the breach and eradicated the threat. During the post-incident activity phase, which activity is MOST critical to prevent future similar incidents?

Accepted Answer

Conducting a root cause analysis. Conducting a root cause analysis helps identify the underlying vulnerability or weakness that led to the breach, enabling the organization to implement corrective measures and prevent recurrence.

Answer

Resetting all user passwords

Answer

Updating the firewall rules to block the attacker's IP

Answer

Restoring data from backups

Question 7

A company uses Qualys to scan their internal network. The scan report shows a vulnerability with plugin output indicating that the server is running a version of Apache httpd vulnerable to CVE-2023-1234. The asset is a development web server that is not exposed to the internet. The CVSS score is 7.5 (High). However, the EPSS score is 0.001 (very low). Which of the following should be the primary factor in prioritizing this vulnerability?

Accepted Answer

The asset is a development server not exposed to the internet, so remediation should be scheduled during normal maintenance.. Since the EPSS score is very low, the likelihood of exploitation in the wild is minimal. Additionally, the asset is not internet-facing, reducing exposure. The best approach is to consider the business context and asset criticality; development servers may be lower priority. However, among the options, the EPSS score is a strong indicator of exploitability. But given the low EPSS, the vulnerability might be deprioritized. The question asks for primary factor; business context (asset criticality and exposure) is key. But options include both EPSS and business context. The answer should be business context because the asset is internal and EPSS low, but business context might still prioritize if critical. However, in this scenario, the development server is likely not critical. The most appropriate is to consider the business context including asset criticality and exposure.

Answer

The CVSS score of 7.5 indicates high severity, so it should be remediated immediately.

Answer

The EPSS score of 0.001 indicates very low exploitability, so remediation can be delayed.

Answer

The vulnerability is in Apache httpd, which is widely used, so it must be patched within 24 hours.

Question 8

An analyst is tasked with creating a correlation rule in the SIEM to detect beaconing activity. Which log sources and fields are most relevant to model this behavior?

Accepted Answer

Firewall logs and connection timestamps. Beaconing involves periodic outbound connections, so firewall logs (source IP, destination IP, destination port) and connection timestamps are essential for detecting regularity.

Answer

Authentication logs and user IDs

Answer

Endpoint logs and process creation

Answer

DNS logs and query types

Question 9

After containing a data breach, the incident response team discovers that an attacker exfiltrated sensitive data over DNS tunneling. Which of the following detection rules would BEST identify similar activity in the future?

Accepted Answer

A YARA rule that flags DNS queries with high entropy domain names. DNS tunneling often involves unusual domain names with high entropy or long subdomains. A YARA rule targeting DNS query patterns can detect such anomalies.

Answer

An SIEM alert for any DNS query exceeding 100 bytes

Answer

A Snort rule blocking traffic to known malicious IPs

Answer

A firewall rule that blocks all DNS requests from internal servers

Question 10

During a phishing incident, an analyst extracts a URL from the email body and searches VirusTotal. The URL is associated with a credential harvesting page. Which type of indicator is this URL?

Accepted Answer

Indicator of Compromise (IOC). The URL is an observable that indicates malicious activity and can be used to detect and block further phishing attempts, making it an IOC.

Answer

Indicator of Attack (IOA)

Answer

Campaign

Answer

TTP

Question 11

Which TWO of the following are common indicators of compromise (IOCs) that can be identified through log analysis?

Accepted Answer

Unexpected changes to file hashes. Unexpected changes to file hashes (A) are a key indicator of compromise because they suggest that a file has been modified, potentially by malware or an attacker. Log analysis can detect these changes by comparing current file hashes against a known-good baseline, revealing unauthorized alterations that may indicate a security breach.

Answer

Expired SSL certificates

Answer

Scheduled backup completion logs

Answer

Use of strong passwords

Question 12

A security team is configuring a vulnerability scanner for external scanning of their public-facing web applications. Which scan type will provide the most accurate assessment of vulnerabilities without requiring credentials?

Accepted Answer

External scan. An external scan assesses the attack surface from the internet perspective, typically without credentials. Agent-based and authenticated scans require credentials or internal access.

Answer

Agent-based scan

Answer

Authenticated scan

Answer

Internal scan

Question 13

During a threat hunting exercise, an analyst uses osquery to query process events on endpoints. They discover a process named 'svchost.exe' running under a user account with parent process 'cmd.exe'. Which of the following describes this observation?

Accepted Answer

Potential LOLBin abuse with anomalous parent-child relationship. svchost.exe should normally run under SYSTEM or NETWORK SERVICE with 'services.exe' as parent. A user-level svchost.exe with cmd.exe parent indicates a potential LOLBin misuse.

Answer

Normal behavior for Windows services

Answer

Evidence of a DLL injection attack

Answer

Indicative of a process hollowing attack

Question 14

A security analyst is reviewing a vulnerability scan report and sees a finding for a web application with a CVSS v3.1 base score of 6.1. The vector string is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Which OWASP Top 10 category does this vulnerability most likely belong to?

Accepted Answer

A03: Injection. The vector indicates Reflected XSS (requires user interaction, scope change, low CIA impact). Reflected XSS is part of the OWASP Top 10 category 'Injection' (2017) or 'Cross-site Scripting' (2021). However, the most direct is Cross-site Scripting (XSS).

Answer

A05: Security Misconfiguration

Answer

A06: Vulnerable and Outdated Components

Answer

A01: Broken Access Control

Question 15

During a threat hunting engagement, an analyst creates a hypothesis based on a recent threat intelligence report about a new APT group using DLL side-loading for persistence. The analyst decides to search for processes that have loaded a known vulnerable DLL. Which framework is most appropriate to map the TTPs?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the most comprehensive framework for mapping adversary TTPs, including persistence techniques like DLL side-loading (T1574.002).

Answer

Diamond Model

Answer

NIST CSF

Answer

Cyber Kill Chain