CS0-003 Practice Test 2 — 25 Questions

Question 1

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for a recent breach was 14 days, while the mean time to respond (MTTR) was 6 hours. Which metric should the team prioritize to improve in future incidents?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mean time to detect (MTTD). With MTTD at 14 days and MTTR at only 6 hours, detection is clearly the bottleneck — attackers had nearly two weeks of dwell time before anyone noticed. Improving MTTD (via better logging, EDR tuning, threat hunting, or SIEM correlation) will reduce attacker dwell time and blast radius far more than shaving hours off an already-fast response.

Answer

Percentage of incidents containing malware

Answer

Number of incidents per week

Answer

Mean time to respond (MTTR)

Question 2

An analyst detects a process named 'powershell.exe' executing a base64-encoded command. Which type of analysis is most appropriate to decode and understand the command?

Accepted Answer

Process analysis. Process analysis is the most appropriate because it focuses on the live execution context of a running process, including its command-line arguments, loaded modules, and parent-child relationships. In this case, the base64-encoded command is part of the process's command line, which can be decoded to reveal the actual PowerShell script or commands being executed. Tools like Process Explorer, Process Monitor, or PowerShell's own logging (e.g., Script Block Logging) can capture and decode this information. This directly addresses the need to understand what the process is doing.

Answer

Memory analysis

Answer

Registry analysis

Answer

Network traffic analysis

Question 3

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch is intended to fix a remote code execution vulnerability in a widely used application. What is the MOST important step before deploying to production?

Accepted Answer

Perform regression testing to ensure no breakage. Regression testing is the most important step because a patch that fixes a remote code execution vulnerability can still introduce functional regressions or break dependent applications in production. Testing in staging validates that the patch resolves the vulnerability without breaking existing functionality, integrations, or workflows. This aligns with change management best practices where validation precedes production deployment.

Answer

Check the patch's CVSS score

Answer

Verify the patch's digital signature

Answer

Automatically deploy to all production servers immediately

Question 4

Which of the following tools is specifically designed for compliance scanning against security benchmarks on Linux systems?

Accepted Answer

Lynis. Lynis is an open-source security auditing tool specifically designed for Linux systems, performing compliance scans against benchmarks like CIS, HIPAA, and PCI-DSS. It checks system hardening, kernel parameters, file permissions, and installed software. OpenVAS, Nessus, and Qualys are general vulnerability scanners, not Linux-specific compliance benchmark tools.

Answer

OpenVAS

Answer

Nessus

Answer

Qualys

Question 5

A security analyst is investigating a potential DNS tunneling attack. Which of the following patterns in DNS logs would most likely indicate such activity?

Accepted Answer

Unusually long subdomain names with high query frequency to a single domain. DNS tunneling exfiltrates data or establishes command-and-control by encoding payloads into DNS query names, typically subdomains of an attacker-controlled domain. This produces unusually long subdomain labels (often near the 63-character label limit or 253-character FQDN limit) combined with high query volume to a single domain, because each query carries a chunk of encoded data. Option B captures both the encoding artifact (long names) and the beaconing pattern (high frequency to one domain) that together are the hallmark of tunneling tools like iodine, dnscat2, or DNSExfiltrator.

Answer

A high number of NXDOMAIN responses

Answer

Consistent query intervals to a known legitimate domain

Answer

Queries to domains that are less than 24 hours old

Question 6

A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol for exchanging that intelligence over HTTPS. Together, they provide a standardized format and transport mechanism for sharing threat intel between organizations, as required by the question.

Answer

REST

Answer

SOAP

Answer

SNMP

Question 7

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Answer

Give all users local admin rights

Question 8

A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?

Accepted Answer

Scope is changed, high impact on confidentiality only. The CVSS v3.1 vector AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N indicates Scope is Changed (S:C) and Confidentiality impact is High (C:H), while Integrity (I:N) and Availability (A:N) impacts are None. Therefore, the correct description is scope changed with high impact on confidentiality only. The other options misstate either the scope or the impacted security property.

Answer

Scope is unchanged, high impact on confidentiality only

Answer

Scope is changed, high impact on integrity only

Answer

Scope is unchanged, high impact on confidentiality and integrity

Question 9

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic threat intelligence focuses on high-level, long-term trends, adversary motivations, and geopolitical or business risks — exactly what senior executives need for decision-making and risk budgeting. It is typically delivered as reports or briefings rather than raw indicators, and it informs strategic planning over quarters or years. Technical, tactical, and operational intelligence are all more granular and operational in nature.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence

Question 10

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module specifically designed to acquire volatile memory from Linux systems in a forensically sound manner. It captures RAM contents and outputs them in formats like raw or lime, which can then be analyzed with tools such as Volatility. This makes it the correct answer for Linux memory acquisition.

Answer

dd

Answer

FTK Imager

Answer

WinPmem

Question 11

An organization needs to report a data breach involving personal data of EU residents. Under GDPR, what is the maximum time allowed for notifying the supervisory authority after becoming aware of the breach?

Accepted Answer

72 hours. GDPR Article 33 mandates that a controller notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is the maximum; earlier notification is encouraged. If notification is not made within 72 hours, it must be accompanied by reasons for the delay.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 12

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Accepted Answer

Lessons learned and recommendations. An after-action report exists to drive improvement, so the component that directly prevents recurrence is the lessons learned and recommendations section, which translates findings into concrete process, tooling, or training changes. While timeline, impact, and root cause feed into it, only lessons learned and recommendations prescribe the corrective actions that stop the same phishing incident from succeeding again.

Answer

Timeline of the incident

Answer

Impact assessment

Answer

Root cause analysis

Question 13

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Accepted Answer

Explain the potential financial loss and reputational damage.. When communicating risk to a board of directors, the most effective approach is to translate the technical vulnerability into business impact—potential financial loss, regulatory fines, and reputational damage—because executives prioritize strategic and financial consequences over technical detail. This framing enables informed risk acceptance or remediation decisions at the governance level. CVSS scores and technical descriptions, while useful to security teams, do not resonate with non-technical leadership.

Answer

Show the CVSS score and exploit complexity.

Answer

Recommend immediate patching without details.

Answer

Describe the vulnerability in technical terms.

Question 14

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. Under GDPR Article 33, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a core GDPR compliance requirement. The other timeframes do not match the regulation.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 15

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Benchmarks define Level 1 as essential, basic security settings that can be applied broadly with minimal impact on functionality or performance, making them suitable as a universal baseline. Level 2 settings are defense-in-depth measures intended for high-security environments; they are more restrictive and may degrade performance or break usability (e.g., disabling legacy protocols or enforcing strict password policies). The question's goal of a baseline posture maps directly to Level 1.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.

Question 16

Which of the following is the FIRST step in the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation. NIST SP 800-61 Rev. 2 defines the incident response lifecycle as four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation is the first phase because it establishes the CSIRT, tools, communications plans, and playbooks before any incident occurs. Without preparation, later phases cannot be executed effectively.

Answer

Detection and Analysis

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 17

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Accepted Answer

Financial impact. Business risk communication should focus on financial impact, reputational impact, and regulatory penalties as these resonate with business leaders. Technical impact is too detailed.

Answer

Operational impact

Answer

Technical impact

Question 18

A security analyst is investigating a potential data breach. The analyst needs to preserve evidence before containment. Which of the following actions is MOST appropriate at this stage?

Accepted Answer

Creating a forensic image of the hard drive. Creating a forensic image of the hard drive is the most appropriate action to preserve evidence before containment. A forensic image is a bit-for-bit copy of the storage media that captures the system state, including deleted files, memory remnants, and metadata, without altering the original. This preserves the integrity of evidence for later analysis and legal proceedings. Powering off, blocking IPs, or disabling accounts are containment actions that can destroy volatile evidence and should be done after imaging.

Answer

Powering off the system

Answer

Blocking the attacker's IP at the firewall

Answer

Disabling the user's account

Question 19

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. The detection of a user authenticating from geographically distant locations within 12 minutes strongly suggests credential theft or token replay, and the subsequent mailbox forwarding rule creation indicates a data exfiltration attempt. The analyst must first correlate sign-in logs (to verify the source IPs and timestamps), MFA results (to check if MFA was satisfied or bypassed), device details (to identify if a known or managed device was used), and mailbox audit events (to confirm who created the forwarding rule and when). This combination directly validates or refutes the UEBA alert by providing the evidence needed to distinguish between a legitimate user with a VPN or a compromised account.

Answer

Only the user's browser cache

Answer

Only DHCP logs from the London office

Answer

The organisation's public DNS zone file

Question 20

During an incident response, the team identifies that a workstation was compromised via a phishing email. Which of the following should be performed immediately after containment?

Accepted Answer

Eradicate the malware from the workstation.. Immediately after containment, the priority is to eradicate the malware from the workstation to prevent reinfection or lateral movement. Containment isolates the system, but eradication removes the malicious artifacts (e.g., registry keys, scheduled tasks, or malicious binaries) to ensure the system is clean before recovery. This step aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment to eliminate the threat's foothold.

Answer

Notify law enforcement about the phishing campaign.

Answer

Collect forensic evidence from the workstation.

Answer

Conduct a root cause analysis of the phishing email.