CS0-003 Practice Test 4 — 25 Questions

Question 1

A company has a policy to remediate vulnerabilities within 30 days. A critical vulnerability is discovered on a database server. The patch requires a reboot, and the database cannot be taken offline during business hours. Which of the following is the BEST approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Schedule the patch during the next maintenance window. Since the database cannot be taken offline during business hours, the standard and best practice is to schedule the installation and reboot during the next scheduled maintenance window (which occurs outside of business hours). This allows the vulnerability to be fully remediated (patched) within the 30-day policy limit without violating operational SLAs. Compensating controls are typically reserved for situations where a patch cannot be applied at all or must be delayed significantly beyond policy limits.

Answer

Implement a compensating control

Answer

Apply a hotfix without reboot

Answer

Extend the remediation deadline

Question 2

A security analyst is reviewing vulnerability scan results and sees a critical vulnerability on a web server with a CVSS score of 9.8. The server is a legacy system that cannot be patched without causing application downtime. The business requires the application to remain available. Which of the following is the BEST course of action?

Accepted Answer

Implement a virtual patch using a web application firewall.. A virtual patch via a web application firewall (WAF) can inspect and block exploit attempts against the vulnerability without modifying the legacy server's code or binaries. This allows the business-critical application to remain available while mitigating the 9.8 CVSS risk at the network layer, typically using signature-based or behavioral rules to intercept malicious payloads targeting the flaw.

Answer

Remove the system from the network.

Answer

Disable the vulnerable service on the server.

Answer

Accept the risk and do nothing.

Question 3

A security analyst discovers a server that is missing multiple critical patches. The server hosts a legacy application that cannot be patched immediately due to compatibility issues. Which of the following is the BEST approach to manage the vulnerability risk?

Accepted Answer

Implement network segmentation and increase monitoring. The best approach because network segmentation isolates the vulnerable legacy server from critical assets, reducing the attack surface, while increased monitoring allows the security team to detect and respond to any exploitation attempts in real time. This balances risk acceptance with active defense, which is a core principle of vulnerability management when patching is not immediately feasible.

Answer

Apply a virtual patch using a WAF

Answer

Disable the server until a patch is available

Answer

Remove the server from the network

Question 4

During a ransomware attack, several workstations have been encrypted. The incident response team has identified the ransomware variant and determined it does not have a known decryption tool. Which containment strategy is MOST appropriate?

Accepted Answer

Disconnect the affected workstations from the network, but leave them powered on.. Disconnecting the affected workstations from the network (but leaving them powered on) preserves volatile evidence in memory (e.g., encryption keys, process artifacts) and prevents the ransomware from spreading to other hosts via SMB, RDP, or other lateral movement protocols. Powering off would destroy this critical forensic data, while leaving them connected risks further encryption of network shares.

Answer

Power off all affected workstations immediately.

Answer

Run a full antivirus scan on the affected workstations.

Answer

Restore all affected workstations from backups immediately.

Question 5

A security team is reviewing firewall logs and identifies traffic to a known malicious IP address from an internal workstation running a critical business application that cannot be interrupted. Which of the following is the most appropriate immediate action?

Accepted Answer

Add a firewall rule to block the malicious IP. Adding a firewall rule to block the malicious IP is the most appropriate immediate action because it stops the outbound traffic to the known malicious address without disrupting the critical business application running on the workstation. This approach maintains availability (a key CIA triad principle) while mitigating the threat at the network layer, which is faster and less invasive than host-level changes. It also preserves the workstation's state for potential forensic analysis.

Answer

Shut down the workstation

Answer

Disconnect the network cable

Answer

Run an antivirus scan

Question 6

Arrange the steps for configuring a firewall rule set in the correct order.

Accepted Answer

Identify traffic, Create rule, Apply to interface, Test, Monitor. Firewall rule configuration involves identifying traffic, creating rules, applying to interface, testing, and monitoring.

Answer

Create rule, Identify traffic, Apply to interface, Test, Monitor

Answer

Apply to interface, Create rule, Identify traffic, Test, Monitor

Answer

Identify traffic, Test, Create rule, Apply to interface, Monitor

Question 7

Order the steps for deploying a new security patch to a production environment.

Accepted Answer

Download/verify the patch -> Test in staging environment -> Backup production systems -> Roll out the patch to production -> Monitor for issues. Patch deployment involves download/verification, testing, backup, rollout, and monitoring.

Answer

Backup production systems -> Download/verify the patch -> Test in staging environment -> Roll out the patch to production -> Monitor for issues

Answer

Download/verify the patch -> Backup production systems -> Test in staging environment -> Roll out the patch to production -> Monitor for issues

Answer

Download/verify the patch -> Roll out the patch to production -> Test in staging environment -> Backup production systems -> Monitor for issues

Question 8

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Container runtime events (e.g., from containerd or CRI-O) capture process spawns like an unexpected shell, Kubernetes audit logs record API calls that could indicate a compromised pod mounting the host filesystem, and network flow logs from the pod (e.g., via eBPF or Calico) reveal outbound connections to an unknown IP. Together, these three telemetry sources provide direct, real-time evidence of the three suspicious behaviors described, making them the most useful for detection and investigation.

Answer

Only monthly vulnerability scan summaries

Answer

Only user password age reports

Answer

Only physical datacenter access logs

Question 9

Which technology is specifically designed to detect anomalous user behavior that may indicate a compromised account?

Accepted Answer

UEBA.. User and Entity Behavior Analytics (UEBA) is specifically designed to establish baselines of normal user behavior and detect anomalous activities—such as unusual login times, impossible travel, or abnormal data access patterns—that may indicate a compromised account. Unlike signature-based tools, UEBA leverages machine learning and statistical modeling to identify deviations from established norms, making it the correct choice for detecting account compromise.

Answer

IDS.

Answer

SIEM.

Answer

Antivirus.

Question 10

During a vulnerability scan, the scanner reports a high number of open ports on a server that is supposed to be a hardened web server. The analyst investigates and finds that the server is running unnecessary services. Which of the following is the MOST effective long-term solution?

Accepted Answer

Implement a configuration management baseline and enforce it. Implementing a configuration management baseline and enforcing it (Option A) is the most effective long-term solution because it ensures that the server is consistently provisioned with only the necessary services and configurations. This approach uses tools like Ansible, Puppet, or Chef to automatically remediate drift, preventing unnecessary services from reappearing after manual changes or reboots. It addresses the root cause by codifying the desired state, rather than relying on ad-hoc fixes.

Answer

Disable the unnecessary services manually

Answer

Increase the frequency of vulnerability scans

Answer

Install a host-based firewall to block the ports

Question 11

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. It provides a structured, factual communication that addresses the legal and privacy stakeholder's need for accountability, risk assessment, and contractual compliance. The timeline and evidence establish the sequence of events, service impact quantifies the breach of SLA, required corrective actions demonstrate remediation steps, and contractual follow-up triggers legal review of penalties or liabilities. This approach avoids speculation and focuses on verifiable data, which is critical for legal teams to assess regulatory obligations (e.g., GDPR breach notification timelines) and potential litigation.

Answer

Confidential unrelated customer data

Answer

Internal blame speculation

Answer

A public press statement draft first

Question 12

A company uses a SIEM platform that ingests logs from various sources. The SOC team receives an alert for a high number of failed login attempts (over 100 in 5 minutes) on the domain controller from a single IP address. The analyst investigates and finds that the failed attempts are for multiple different usernames, including some disabled accounts. The source IP is traced to an external VPN service. The analyst also notices that a few accounts had successful logins from the same IP after the failed attempts. Which of the following is the MOST likely attack type?

Accepted Answer

Password spraying.. The attack involves a single external IP attempting logins with multiple different usernames (including disabled accounts) and eventually succeeding on a few. This is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid triggering account lockout policies. The use of an external VPN service indicates the attacker is anonymizing their origin, and the successful logins after failures confirm the attack's objective.

Answer

Brute-force attack.

Answer

Kerberoasting.

Answer

Pass-the-hash.

Question 13

An analyst is preparing a report that includes Personally Identifiable Information (PII) from a data breach. The report will be shared with external auditors. Which of the following is the BEST practice for handling PII in the report?

Accepted Answer

Use tokenization or pseudonymization to mask PII while preserving analytical value. Tokenization or pseudonymization replaces PII with non-sensitive placeholders that retain referential integrity and analytical utility, allowing auditors to perform their review without exposing actual personal data. This approach balances transparency requirements with data minimization principles mandated by regulations like GDPR and PCI DSS, unlike full disclosure or simple encryption which still exposes the original data to the recipient.

Answer

Include full PII in the report for complete transparency

Answer

Encrypt the report and send it via email to auditors

Answer

Remove all PII entirely, leaving only anonymized records

Question 14

A security analyst is configuring a vulnerability scan for a demilitarized zone (DMZ) containing public-facing web servers. The analyst wants to minimize the risk of causing a denial-of-service condition on the servers. Which of the following scan settings should be configured?

Accepted Answer

Limit the number of concurrent checks.. Limiting the number of concurrent checks (option D) reduces the simultaneous requests sent to the target servers, which prevents overwhelming the web server's connection pool or CPU. This is the most direct way to minimize the risk of a denial-of-service condition during a vulnerability scan, especially in a DMZ with public-facing servers that may have limited resources.

Answer

Enable a full port scan.

Answer

Disable safe checks to speed up the scan.

Answer

Increase the scan timeout values.

Question 15

An organization performs quarterly vulnerability scans of its internal network. The scans have a high number of false positives for out-of-date software that is actually up to date. Which of the following would BEST improve the accuracy of the scans?

Accepted Answer

Implement credential-based scanning.. Credential-based scanning (authenticated scanning) allows the scanner to log into target systems with valid credentials, enabling it to query the local registry or package manager for the exact installed software versions. This eliminates reliance on banner grabbing or service fingerprinting, which often produce false positives when out-of-date software is detected based on network-level heuristics rather than actual installed patches.

Answer

Disable verbose output to reduce clutter.

Answer

Increase scan frequency to monthly.

Answer

Use a different vulnerability scanner.

Question 16

A small business with 50 employees uses a single Windows Server 2019 as a domain controller and file server. The company recently experienced a ransomware attack that encrypted all files on the server. The IT manager restored the files from a backup that was taken two days before the attack. However, the next day, the files were encrypted again. The analyst suspects the ransomware may have persisted or re-entered. The network is air-gapped from the internet, but employees use USB drives. Which of the following is the MOST likely reason for the re-infection?

Accepted Answer

An employee inserted an infected USB drive after the restoration.. The network is air-gapped from the internet, leaving USB drives as the primary vector for reintroducing malware. If an employee inserted an infected USB drive after the restoration, the ransomware could execute and re-encrypt the files. The air-gap eliminates internet-based re-entry, and the backup was clean since it restored files without immediate re-encryption until the next day.

Answer

The backup itself contained the ransomware.

Answer

The ransomware was still active in memory on the server.

Answer

The domain controller was not fully patched.

Question 17

An organization uses automated patch management for workstations but manual patching for servers. After a critical vulnerability is announced, the security team wants to expedite patching for servers. Which of the following is the BEST approach?

Accepted Answer

Test the patch in a staging environment and then deploy. Testing the patch in a staging environment before deploying to production servers validates compatibility and stability, reducing the risk of service disruption. This approach balances the urgency of a critical vulnerability with the need to maintain server availability, which is especially important given that manual patching is the standard procedure for servers. Staging allows the security team to identify any conflicts with existing configurations or dependencies before widespread deployment.

Answer

Disable the affected services until the patch can be applied

Answer

Deploy the patch immediately to all servers

Answer

Implement virtual patching via an IPS

Question 18

A security analyst is conducting a vulnerability assessment of a web application. The assessment reveals that the application is vulnerable to SQL injection. Which of the following is the MOST effective remediation?

Accepted Answer

Use parameterized queries in the application code. Parameterized queries (also known as prepared statements) are the most effective remediation for SQL injection because they separate SQL logic from user-supplied data by using placeholders. The database engine treats the input strictly as data, not executable code, which prevents an attacker from altering the query structure. This addresses the root cause at the application layer, unlike other controls that only mitigate or detect the attack.

Answer

Upgrade the web application framework to the latest version

Answer

Deploy a web application firewall (WAF)

Answer

Implement client-side input validation

Question 19

During a vulnerability scan, an analyst discovers a high-severity vulnerability on a critical database server. The server is in production and cannot be taken offline. The vendor has released a patch but requires a reboot. Which of the following should the analyst recommend FIRST?

Accepted Answer

Schedule the patch during the next maintenance window.. The database server is in production and cannot be taken offline, so the patch must be applied during a scheduled maintenance window to minimize business disruption. The vulnerability is high-severity, but the vendor requires a reboot, which would cause downtime; therefore, the first step is to plan the patch application at the next available maintenance window, not to apply it immediately or implement a workaround that may not fully mitigate the risk.

Answer

Implement a workaround from the vendor.

Answer

Apply the patch immediately.

Answer

Migrate the database to a new server.

Question 20

A security dashboard is being designed for the executive team. Which metric is MOST appropriate to display?

Accepted Answer

Overall risk posture score with trend over time. The executive team requires a high-level, strategic view of security effectiveness, not granular operational data. The overall risk posture score with trend over time directly communicates the organization's security health and whether it is improving or deteriorating, enabling informed decision-making. This aligns with the Reporting and Communication domain's emphasis on translating technical metrics into business-relevant insights.

Answer

Current CPU utilization on firewalls

Answer

Patch installation status of all endpoints

Answer

Number of IDS alerts per hour