CS0-003 Practice Test 4 — 25 Questions

Question 1

A security engineer needs to implement a baseline configuration for all new Linux servers. Which of the following should be included in the baseline to reduce the attack surface?

Accepted Answer

Disable all unnecessary services and daemons.. Disabling all unnecessary services and daemons directly reduces the attack surface by eliminating potential entry points for exploitation. Each running service represents a vector for attacks, such as buffer overflows or misconfigurations, and removing them minimizes the number of listening ports and active processes. This aligns with the principle of least functionality, a core security baseline for Linux servers.

Answer

Enable strong password policies for all users.

Answer

Enable comprehensive audit logging.

Answer

Configure disk encryption for all data volumes.

Question 2

After a risk assessment, a security analyst recommends accepting a low-risk finding. The system owner disagrees. Which communication strategy should the analyst use?

Accepted Answer

Present the risk assessment data and cost-benefit analysis to justify acceptance. The security analyst should use data-driven communication to resolve disagreements over risk acceptance. By presenting the risk assessment data and a cost-benefit analysis, the analyst provides objective evidence that the low-risk finding does not warrant mitigation, aligning with the NIST risk management framework's emphasis on informed decision-making. This approach respects the system owner's concerns while justifying the acceptance based on technical and business rationale.

Answer

Escalate the disagreement to the CISO immediately

Answer

Agree with the system owner and change the recommendation

Answer

Insist that the finding must be mitigated due to policy

Question 3

A security team discovers a critical vulnerability in a widely used software component. The vulnerability has a CVSS score of 9.0, but there is no known exploit or patch available yet. However, the software vendor has released a workaround. According to the vulnerability management lifecycle, which action should the team prioritize first?

Accepted Answer

Apply the workaround as a compensating control. Since no patch is available, the team should apply compensating controls to mitigate the risk. Remediation typically involves patching, but if not possible, compensating controls are the next best step.

Answer

Wait for the vendor to release a patch before taking any action

Answer

Remove the affected component from all systems immediately

Answer

Increase monitoring of the affected systems but take no other action

Question 4

After a data breach incident, a post-incident review team is collecting lessons learned. Which THREE items should be included in the lessons learned documentation?

Accepted Answer

Timeline of events during the incident. The timeline of events is a critical component of lessons learned documentation. It provides a chronological sequence of actions, detections, and responses during the incident, which is essential for identifying gaps in detection, delays in response, and opportunities for improvement. Without a precise timeline, the team cannot accurately assess the effectiveness of their incident response procedures or the speed of containment.

Answer

Individual performance evaluations of team members

Answer

Legal liability of the organization

Question 5

During a network traffic analysis, a security analyst observes repeated connections from an internal host to a known malicious IP on port 4444. The payload appears to be encrypted. Which type of activity is most likely indicated?

Accepted Answer

Command and control beaconing. Repeated connections to a known malicious IP on a non-standard port with encrypted payloads strongly suggest command and control (C2) beaconing.

Answer

Port scanning activity

Answer

Data exfiltration via DNS tunnelling

Answer

Lateral movement using SMB

Question 6

A cloud security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The instance is part of an auto-scaling group. What is the best immediate action?

Accepted Answer

Isolate the instance by modifying its security group to deny all traffic.. Isolating the instance by removing it from the security group or using a quarantine VPC prevents further communication while preserving forensic data.

Answer

Terminate the instance immediately to stop the threat.

Answer

Ignore the alert because auto-scaling groups are ephemeral.

Answer

Update the GuardDuty threat list to ignore that IP.

Question 7

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a finance workstation to a known malicious IP address at 2:00 AM. The analyst checks the firewall logs and sees a single connection. Which action should the analyst take FIRST according to NIST SP 800-61?

Accepted Answer

Validate the incident by reviewing additional data sources.. NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.

Answer

Run a full antivirus scan on the workstation.

Answer

Isolate the workstation from the network immediately.

Answer

Notify law enforcement per the incident response plan.

Question 8

A security analyst is triaging an alert indicating that a user's workstation has been infected with ransomware. The file server shows signs of encryption. The analyst needs to contain the incident. Which action should the analyst take FIRST to minimize damage?

Accepted Answer

Disconnecting the workstation from the network. Disconnecting the infected workstation from the network stops the ransomware from spreading to other systems via network shares.

Answer

Running a full antivirus scan on the workstation

Answer

Disabling the user's Active Directory account

Answer

Rebuilding the workstation from a known good image

Question 9

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Accepted Answer

Notify all affected data subjects without undue delay if high risk. GDPR requires notification to the supervisory authority within 72 hours, documentation of the breach, and notification to affected individuals if high risk.

Answer

Publish a public notice in the local newspaper

Answer

Notify law enforcement within 24 hours

Question 10

A vulnerability manager wants accurate Linux package findings. Which scan conditions are important? (Choose two.)

Accepted Answer

Authenticated access to inspect installed packages. For accurate Linux package findings, the vulnerability scanner must have authenticated access (e.g., via SSH with valid credentials) to inspect installed packages directly from the package manager database (e.g., RPM or dpkg). Without authentication, the scanner can only perform unauthenticated network-based checks, which cannot reliably determine installed software versions or patch levels. Authenticated access ensures the scanner can execute commands like 'rpm -qa' or 'dpkg -l' to enumerate packages with high accuracy.

Answer

Only scanning ICMP echo replies

Answer

Changing server hostnames randomly

Question 11

An analyst is creating a compliance dashboard for management. Which of the following is the most relevant metric to include regarding patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance percentage directly measures how well the organization meets patch deadlines, which is a key compliance metric.

Answer

Number of antivirus alerts

Answer

Phishing simulation click rate

Answer

Mean time to detect incidents

Question 12

A security analyst is reviewing a vulnerability scan report and notices a plugin that identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which attack vector is indicated?

Accepted Answer

Network. AV:N indicates network attack vector, meaning the vulnerability can be exploited remotely over the network without any physical or local access.

Answer

Adjacent network

Answer

Local

Answer

Physical

Question 13

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the average time to detect an incident.

Answer

Mean Time to Resolve (MTTR)

Answer

Patch SLA compliance percentage

Answer

Mean Time to Remediate (MTTRem)

Question 14

An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)

Accepted Answer

Blocking outbound communication from infected hosts at the firewall.. Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.

Answer

Creating a forensic image of the infected systems for later analysis.

Answer

Notifying law enforcement agencies about the incident.

Answer

Identifying and patching the vulnerability exploited by the malware.

Question 15

A vulnerability management team is evaluating whether to apply a patch immediately or implement a compensating control. The patch is for a vulnerability in a legacy system that cannot be taken offline during business hours. The compensating control would involve restricting network access to the system. Which decision is MOST appropriate?

Accepted Answer

Implement a compensating control and schedule patching during a maintenance window. If the system cannot be patched immediately, implementing a compensating control (network restriction) reduces risk while waiting for a maintenance window.

Answer

Ignore the vulnerability since it affects a legacy system

Answer

Remove the system from the network

Answer

Apply the patch immediately despite the outage risk

Question 16

A company is implementing a patch management process. Which of the following steps should be performed FIRST after a vendor releases a security patch for a critical vulnerability?

Accepted Answer

Test the patch in a staging environment that mirrors production. Patches should be tested in a staging environment to ensure they do not break critical business functions before deployment.

Answer

Schedule the patch for the next maintenance window

Answer

Deploy the patch to all production servers immediately

Answer

Create a patch compliance report

Question 17

Which of the following is the primary audience for a strategic threat intelligence report?

Accepted Answer

Executive leadership. Strategic intelligence is high-level and intended for executive leadership to inform business decisions.

Answer

System administrators

Answer

SOC analysts

Answer

Incident responders

Question 18

A vulnerability scanner reports a finding with a CVSS v3.1 base score of 7.5 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. What does this indicate about the vulnerability?

Accepted Answer

It has high impact on availability. The vector shows high impact to availability (A:H) and no impact to confidentiality or integrity, so the vulnerability primarily affects availability.

Answer

It has high impact on integrity

Answer

It requires authentication to exploit

Answer

It has high impact on confidentiality

Question 19

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Accepted Answer

Overall risk posture summary. The executive summary should provide a high-level overview, including the overall risk posture and key findings that require management attention. Detailed technical descriptions are better left for the main body.

Answer

Raw CVSS scores for all vulnerabilities

Answer

Detailed technical description of each vulnerability

Answer

Network topology diagrams

Question 20

During a forensic investigation, an analyst needs to acquire disk images from multiple suspect drives. Which THREE practices ensure forensic soundness? (Select THREE)

Accepted Answer

Documenting the chain of custody for each drive. Forensic soundness requires maintaining evidence integrity. Using a verified write blocker prevents alteration. Hashing the original and copy ensures integrity. Documenting the chain of custody maintains accountability.

Answer

Using the fastest available imaging method without verification

Answer

Acquiring the image while the system is running (live acquisition)