CS0-003 Practice Test 3 — 25 Questions

Question 1

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners cannot access authenticated pages without valid session credentials. Configuring authenticated scanning with a test account and proper session handling (e.g., via cookies, tokens, or form-based login) allows the scanner to crawl and test behind the login wall, ensuring coverage of all application states. This is the standard remediation for the described limitation.

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Question 2

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option A is correct because the best validation method is to independently verify the server's TLS configuration by manually testing with a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to negotiate TLS 1.0. This eliminates false positives from automated scanners that may rely on banner grabbing or outdated fingerprints, and directly confirms whether the service accepts TLS 1.0 handshakes at the protocol level.

Answer

Delete the server from the scan scope

Answer

Change the severity to informational automatically

Answer

Close the finding because the owner disagrees

Question 3

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. Option B is correct because the vulnerability is a critical unauthenticated remote-code-execution (RCE) flaw on an internet-facing VPN appliance that is actively exploited in the wild. According to the CVSS scoring system, such a flaw (typically CVSS 9.0–10.0) poses an immediate and severe risk to the organization's perimeter, and remediation must be prioritized over all internal-only medium vulnerabilities. The principle of risk-based prioritization dictates that externally exploitable, actively weaponized vulnerabilities must be patched or mitigated first to prevent a likely breach.

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Start with the oldest medium vulnerability

Answer

Defer all remediation until the monthly patch window

Question 4

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Decode the command and inspect the process tree, parent document, and network destination. Option B is correct because decoding the encoded PowerShell command reveals the attacker's intent, inspecting the process tree shows the execution chain from winword.exe to powershell.exe, examining the parent document identifies the malicious attachment, and analyzing the network destination uncovers the C2 server. This systematic approach provides the clearest next triage step by correlating the initial infection vector with the subsequent malicious activity, enabling the analyst to contain the threat effectively.

Answer

Disable the SIEM parser for PowerShell events

Answer

Reimage every workstation in the department

Answer

Close the alert because HTTPS is expected traffic

Question 5

Which three of the following are common challenges when conducting authenticated vulnerability scans in a large, heterogeneous network? (Choose three.)

Accepted Answer

Ensuring the scan account has appropriate privileges without granting excessive permissions. Correct: Credential management and rotation is a major challenge due to diverse systems and the need for secure storage. Incorrect credentials can cause account lockouts or disrupt services, especially in Active Directory environments. Granting the principle of least privilege to scan accounts is critical but complex across many systems. Incorrect: Bandwidth increase from authenticated scans is usually minimal; the main impact is on the target system's performance. Most modern scanners support authenticated scanning of virtual and cloud assets via APIs or agent-based methods. Authenticated scans greatly improve accuracy but never guarantee 100% detection due to unknown vulnerabilities or configuration nuances.

Answer

Inability to scan virtualized or cloud-based assets using authenticated methods

Answer

Authenticated scans always provide 100% accurate vulnerability detection

Answer

Increased network bandwidth consumption due to deeper inspection of system configurations

Question 6

A responder is acquiring evidence from a potentially compromised server. Which actions support forensic integrity? (Choose two.)

Accepted Answer

Calculate and record hashes of acquired images. Calculating and recording hashes (e.g., SHA-256) of acquired disk images ensures data integrity by providing a cryptographic fingerprint that can be used later to verify that the evidence has not been altered. This is a foundational step in forensic acquisition, as any modification to the image will produce a different hash, proving tampering or corruption.

Answer

Disable all logging before acquisition

Answer

Edit suspicious files to see whether malware reacts

Question 7

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option B is correct because the best next step is to validate whether the OpenSSL vulnerability is actually exploitable in the context of the application, and if so, rebuild from a patched base image. This balances security with operational efficiency by not blocking the pipeline unnecessarily for unused binaries, while still ensuring that truly exploitable vulnerabilities are remediated. The question asks for the 'BEST next step' for the team, not the scanner configuration, so validating exploitability before acting is the most appropriate response.

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Answer

Ignore all base-image vulnerabilities

Question 8

A CVSS 9.8 vulnerability affects an internal service reachable only from a restricted admin subnet. Which additional analysis is most useful? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Environmental scoring and compensating-control review. Option C is correct because CVSS base scores (like 9.8) do not account for network context or existing security controls. Environmental scoring (CVSS Environmental Metrics) adjusts the base score based on factors like asset criticality and network placement, while a compensating-controls review determines whether firewalls, ACLs, or network segmentation already mitigate the risk. This combined analysis provides the true residual risk for business prioritization.

Answer

Ignore the vulnerability because it is internal

Answer

Change all findings to low severity

Answer

Use only the vendor marketing page

Question 9

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Container runtime events (e.g., `docker events` or CRI-O logs) capture the unexpected shell execution and host filesystem mount. Kubernetes audit logs record the API calls that initiated the pod, revealing the attacker's initial access vector. Network flow logs from the pod (e.g., via Calico or Cilium) show the outbound connections to the unknown IP, linking the lateral movement to the compromised container. Together, these three telemetry sources provide the complete chain of events needed for root-cause analysis.

Answer

Only user password age reports

Answer

Only physical datacenter access logs

Answer

Only monthly vulnerability scan summaries

Question 10

A phishing incident led to credential theft. Which containment actions are appropriate? (Choose two.)

Accepted Answer

Reset affected credentials and revoke active sessions. Option A is correct because immediately resetting compromised credentials and revoking active sessions (e.g., via Azure AD 'Revoke-AzureADUserAllRefreshToken' or Active Directory 'Reset-ADAccountPassword' combined with 'Revoke-AuthenticationTokens') invalidates the attacker's access tokens and session cookies, preventing further lateral movement or data exfiltration. This aligns with the NIST SP 800-61 containment phase, which prioritizes cutting off attacker access while preserving forensic evidence.

Answer

Delete all user mailboxes

Answer

Disable DNS for the entire company indefinitely

Question 11

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners require authenticated sessions to crawl and test pages behind login forms. Without session handling (e.g., cookies, tokens), the scanner only sees public content. Configuring authenticated scanning with a test account and proper session management (e.g., OWASP ZAP's session handling rules or Burp Suite's authentication pre-script) allows the scanner to maintain state and reach restricted pages, enabling full coverage of the application's attack surface.

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Answer

Disable all application authentication

Question 12

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The critical unauthenticated remote-code-execution vulnerability on an internet-facing VPN appliance is actively exploited in the wild, posing an immediate risk of complete compromise. Remediation must be prioritized based on severity, exploitability, and exposure, making immediate patching or mitigation the only defensible first step.

Answer

Start with the oldest medium vulnerability

Answer

Remediate only low-risk internal findings to improve closure rate

Answer

Defer all remediation until the monthly patch window

Question 13

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Sigma rule. Sigma rules are the correct choice because they are a vendor-agnostic, YAML-based format designed specifically for writing detection logic that can be converted into multiple SIEM query languages (e.g., Splunk SPL, Elastic EQL, QRadar AQL). This portability directly meets the threat hunter's goal of creating a single detection for suspicious rundll32 execution that works across different SIEM platforms.

Answer

CVSS vector string

Answer

OpenIOC package only

Answer

YARA rule

Question 14

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. The alert describes a workstation requesting a high number of Kerberos service tickets (TGS-REQ) for many different Service Principal Names (SPNs) without subsequently accessing those services. This pattern is classic for Kerberoasting reconnaissance, where an attacker with valid domain credentials (e.g., a compromised user account) enumerates SPNs to request TGS tickets for accounts that have servicePrincipalName attributes set. The attacker then extracts the encrypted ticket data offline to crack the associated service account passwords. The lack of corresponding service access confirms the tickets were harvested, not used for legitimate authentication.

Answer

ARP spoofing

Answer

DNS cache poisoning

Answer

Pass-the-hash using NTLM only

Question 15

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. Option A is correct because a technical remediation section for an OpenSSL vulnerability must include affected assets (specific Linux hosts and package versions), the exact patch commands or vendor guidance (e.g., 'yum update openssl' or 'apt-get upgrade openssl'), a validation method (e.g., 'openssl version -a' or running a vulnerability scanner), and rollback notes (e.g., 'yum history undo' or snapshot restoration). For a legal/privacy stakeholder audience, the most appropriate content choice is a red/yellow/green chart (Option C) that summarizes risk posture without overwhelming technical detail, but the question asks for the technical remediation section content, not the stakeholder-appropriate summary.

Answer

Only the CVE headline

Answer

Only a red/yellow/green chart

Answer

Only estimated financial loss

Question 16

A SOC wants to measure whether alert enrichment is improving operations. Which metrics are useful? (Choose two.)

Accepted Answer

Reduction in analyst triage time for enriched alerts. Option A is correct because a primary goal of alert enrichment is to reduce the time analysts spend investigating alerts. By automatically populating context such as asset owner, criticality, and vulnerability data, enrichment eliminates manual lookup steps, directly lowering mean time to triage (MTTT). This metric quantifies operational efficiency gains from enrichment.

Answer

Amount of storage used by desktop screenshots

Answer

Number of unused browser bookmarks

Question 17

A threat hunter suspects data exfiltration over HTTPS from a database server. Which data sources are most useful? (Choose two.)

Accepted Answer

Database audit logs showing queried objects and accounts. Database audit logs record which objects (tables, columns) were queried and by which accounts, directly revealing unauthorized access or unusual data retrieval patterns that could indicate exfiltration. NetFlow or proxy logs capture destination IP addresses, data volumes, and timing of HTTPS sessions, allowing the hunter to spot large or anomalous outbound transfers to suspicious hosts, even though the payload is encrypted.

Answer

Printer toner status

Answer

Building temperature logs

Question 18

During a post-compromise review, a web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible? which action should be prioritized before closure?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Option C is correct because web-shell activity is best confirmed by correlating web access logs (showing the suspicious file being accessed with a query parameter), file timestamps (indicating when the file was created or modified), process execution logs (showing commands spawned by the web service account), and outbound connections (indicating data exfiltration or command-and-control traffic). This multi-source evidence provides a complete chain of compromise, unlike a single log source.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata

Question 19

A third-party supplier needs incident information to fix an integration. What should be shared? (Choose two.)

Accepted Answer

Required remediation outcome and deadline. Option C is correct because sharing the required remediation outcome and deadline ensures the third-party supplier understands the expected fix and urgency, aligning with incident response communication best practices. This enables the supplier to prioritize their work and deliver a solution that meets the organization's security and operational requirements, without exposing unnecessary internal details.

Answer

Internal blame discussions

Answer

Credentials for unrelated systems

Question 20

In a regulated payment environment, a developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Disable or rotate the key and review actions performed with it. Option B is correct because the immediate priority is to revoke the compromised cloud access key to prevent further unauthorized use, while simultaneously reviewing logs to understand the scope of the attacker's actions. In a regulated payment environment (e.g., PCI DSS), failing to disable the key promptly could lead to a data breach and non-compliance penalties. Reviewing actions with the key is essential for incident response and forensic evidence collection.

Answer

Wait to see whether charges increase

Answer

Block the developer's laptop from Wi-Fi

Answer

Ask the developer to delete the commit only