CS0-003 Practice Test 2 — 25 Questions

Question 1

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Correlate flow volume with database audit logs and the destination reputation. Option C is correct because correlating the flow volume with database audit logs allows you to identify which specific records or queries were accessed during the anomalous transfers, while checking the destination reputation helps determine if the unfamiliar AS is known for data exfiltration or is a legitimate service. This combination directly addresses the suspicious behavior—large encrypted outbound transfers during off-hours—by linking network evidence to host-based logs, which is essential for triaging a potential data breach. Without this correlation, you cannot distinguish between a legitimate backup or replication job and malicious exfiltration.

Answer

Delete historical flow records to reduce SIEM cost

Answer

Assume encryption means the transfer is safe

Answer

Disable all outbound internet access for the organisation

Question 2

Order the steps to perform a vulnerability scan using a tool like Nessus.

Question 3

Arrange the steps for conducting a risk assessment in the correct order.

Question 4

Order the steps for setting up a SIEM (Security Information and Event Management) system.

Question 5

Arrange the steps for a typical penetration testing engagement in the correct order.

Question 6

Arrange the steps for conducting a security incident response in the correct order.

Question 7

Order the steps for proper forensic acquisition of a hard drive.

Question 8

Order the steps for deploying a new security patch to a production environment.

Question 9

Order the steps for a typical patch management process.

Question 10

Arrange the steps for a typical digital forensics investigation process.

Question 11

An incident may involve regulated personal data. Who should be engaged early to determine notification obligations? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Legal, privacy, and compliance stakeholders. When an incident involves regulated personal data, legal, privacy, and compliance stakeholders must be engaged early because they determine notification obligations under laws such as GDPR, HIPAA, or CCPA. These stakeholders assess the data type, jurisdiction, and breach thresholds to decide if and when to notify regulators and affected individuals. In the context of CS0-003, this aligns with the Reporting and Communication domain, where timely stakeholder involvement is critical for legal compliance and risk mitigation.

Answer

Only the graphic design team

Answer

Only the facilities manager

Answer

Only the vulnerability scanner vendor

Question 12

During a post-compromise review, a server suspected of running fileless malware is still powered on. Which evidence should be captured first if it is safe to do so? During detection and analysis, which decision is most defensible? which action should be prioritized before closure?

Accepted Answer

Volatile memory and active network/process state. In a post-compromise review of a server suspected of running fileless malware, volatile memory (RAM) and active network/process state must be captured first because fileless malware resides only in memory and leaves no persistent artifacts on disk. Capturing this evidence preserves the malware's code, running processes, network connections, and other transient data that would be lost on reboot or shutdown, enabling forensic analysis of the attack.

Answer

Marketing screenshots

Answer

Archived monthly reports

Answer

The office seating plan

Question 13

Which actions are appropriate before restoring systems after malware eradication? (Choose two.)

Accepted Answer

Validate backups are clean and restorable. Option C is correct because restoring from backups that are themselves infected or corrupted would reintroduce the malware or cause system instability. Before restoration, backups must be validated as clean (e.g., scanned with updated antivirus or checked against known file hashes) and restorable (e.g., tested via a restore dry-run or checksum verification). This ensures the recovery process does not perpetuate the incident.

Answer

Disable all monitoring during restoration

Answer

Reuse known-compromised credentials

Question 14

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Office document spawning a script interpreter from a user context. Option A is correct because the scenario describes a classic phishing attack where a malicious macro or embedded script in an Office document (the invoice) executes wscript.exe from the user's profile. This behavior matches the detection logic of 'Office document spawning a script interpreter from a user context,' which is a key indicator of script-based malware execution. The root-cause analysis would identify the malicious document as the initial vector, directly explaining the subsequent process execution.

Answer

High CPU usage on the print server

Answer

A password expiry warning

Answer

Successful DHCP renewal

Question 15

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager should request a documented risk acceptance with compensating controls and a migration/remediation plan. This is the only option that formally acknowledges the risk, implements compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting) to reduce exploitability, and establishes a timeline to decommission or replace the system. This aligns with the risk-based prioritization required for business decisions.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 16

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Option B is correct because container runtime events (e.g., Docker/containerd exec logs) capture the unexpected shell launch, Kubernetes audit logs record the pod creation and mount operations, and network flow logs (e.g., NetFlow, eBPF-based tools) reveal the outbound connection to the unknown IP. Together, these provide the granular, real-time telemetry needed to detect and investigate the compromise, unlike static or coarse-grained logs.

Answer

Only physical datacenter access logs

Answer

Only monthly vulnerability scan summaries

Answer

Only user password age reports

Question 17

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Environmental scoring and compensating-control review. Option B is correct because CVSS base scores assume a default, worst-case environment. For a vulnerability with a 9.8 base score that is only reachable from a restricted admin subnet, an environmental scoring (CVSS v3.1 Environmental Metric Group) adjusts the severity based on the actual attack surface, and a compensating-control review documents whether existing controls (e.g., network ACLs, jump-box restrictions) mitigate the risk. This analysis is essential for stakeholder management to justify the risk acceptance or remediation priority, and the resulting documentation (e.g., risk acceptance form signed by the authorizing official) keeps the program defensible under audit.

Answer

Use only the vendor marketing page

Answer

Change all findings to low severity

Answer

Ignore the vulnerability because it is internal

Question 18

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Correlate flow volume with database audit logs and the destination reputation. Option D is correct because correlating flow volume with database audit logs and destination reputation provides direct evidence of whether the encrypted outbound transfer is legitimate database replication or exfiltration. This approach leverages existing security controls (flow records, audit logs, threat intelligence) to validate the activity without assuming encryption implies safety or disrupting operations.

Answer

Assume encryption means the transfer is safe

Answer

Disable all outbound internet access for the organisation

Answer

Delete historical flow records to reduce SIEM cost

Question 19

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option C is correct because when a third-party vendor causes an outage during remediation, the communication must focus on operational and contractual details: the exact timeline of the outage, the scope of service impact (e.g., number of users affected, systems down), evidence (e.g., logs, monitoring alerts), required corrective actions to prevent recurrence, and contractual follow-up (e.g., SLA breach, penalties). This aligns with the SOC manager's need for actionable, factual data to manage incident response and vendor accountability, not public relations or unrelated data.

Answer

A public press statement draft first

Answer

Confidential unrelated customer data

Answer

Internal blame speculation

Question 20

An analyst has several malware samples from the same campaign and wants to detect related files based on unique strings and byte patterns. Which method is MOST appropriate? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Create and test a YARA rule against known-good and known-bad samples. YARA rules are specifically designed to identify and classify malware samples based on textual or binary patterns, including unique strings and byte sequences. By testing a YARA rule against known-good and known-bad samples, the analyst can validate its accuracy and ensure it reliably detects related files from the same campaign while minimizing false positives.

Answer

Tune DHCP lease duration

Answer

Use only a firewall deny rule for port 443

Answer

Create a CVE entry