CS0-003 Practice Test 5 — 25 Questions

Question 1

A security analyst is using Burp Suite to test a web application for vulnerabilities. Which TWO of the following are common web application vulnerabilities that can be detected using Burp Suite? (Select TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cross-site scripting (XSS). Burp Suite can detect SQL injection and XSS through its scanner and manual testing tools. Buffer overflow and race conditions are typically not web application vulnerabilities detected by web proxies. Insecure deserialization can be detected but is less common than SQLi and XSS.

Answer

Buffer overflow

Answer

Insecure deserialization

Answer

Race condition

Question 2

A security analyst is responding to a potential data exfiltration incident. As part of the containment strategy, the analyst must preserve evidence. Which TWO actions should the analyst take before containment? (Select two.)

Accepted Answer

Capture a forensic image of the affected systems. Forensic imaging of the affected systems captures the state before containment actions alter it. Recording current network connections captures volatile evidence that may be lost when the system is isolated.

Answer

Change passwords for affected accounts

Answer

Disconnect the system from the network

Answer

Kill malicious processes

Question 3

During a forensic investigation, an analyst must acquire digital evidence while maintaining forensic soundness. Which THREE practices should the analyst follow? (Choose three.)

Accepted Answer

Verify the hash of the image against the original. Write blockers prevent modification, hash verification ensures integrity, and proper documentation maintains chain of custody.

Answer

Use the suspect's operating system to copy files

Answer

Power on the system to capture volatile data first

Question 4

During a memory forensics investigation, a security analyst identifies a process that appears to have code injected into it. The process is 'explorer.exe' and its memory contains sections that are not part of the original executable. Which TWO memory analysis techniques should the analyst use to confirm code injection?

Accepted Answer

Scan for executable memory pages not backed by a file on disk. Comparing the process's loaded DLL list with the expected list can reveal anomalies. Checking for executable memory pages that are not backed by a known module is another indicator.

Answer

List the process's open handles

Answer

Examine the process's environment variables

Answer

Check the process's parent process

Question 5

An organization's incident response team is classifying an incident based on severity and priority. Which TWO factors should the team consider when determining the priority of an incident? (Select TWO.)

Accepted Answer

The potential business impact of the incident.. Priority is often based on the criticality of the affected assets and the potential business impact, as these determine how quickly the incident needs to be addressed.

Answer

The number of users reporting the issue.

Answer

The time of day the incident occurred.

Answer

The type of threat actor involved.

Question 6

Which three of the following are key considerations when implementing a vulnerability management lifecycle in an enterprise environment? (Choose three.)

Accepted Answer

Defining a formal remediation SLA that aligns with organizational risk tolerance. Establishing a remediation prioritization framework based on asset criticality and exploitability is correct because it ensures that vulnerabilities posing the greatest risk to the business are addressed first. This aligns with risk-based vulnerability management, where not all vulnerabilities are equal; prioritizing by asset value and exploitability (e.g., CVSS exploitability metrics or active exploitation evidence) optimizes resource allocation and reduces overall risk exposure.

Answer

Using default scan credentials from the vulnerability scanner vendor for consistency

Answer

Performing vulnerability scans only during off-peak hours to minimize network disruption

Answer

Scanning all assets with the highest possible scan intensity to ensure no vulnerability is missed

Question 7

During a security incident, a digital forensics investigator must preserve evidence according to best practices. Which three of the following actions align with proper forensic procedures? (Choose three.)

Accepted Answer

Calculate and document cryptographic hashes of acquired images.. Calculating and documenting cryptographic hashes (e.g., SHA-256) of acquired images ensures data integrity by providing a verifiable fingerprint that can prove the image has not been altered since acquisition. Maintaining a documented chain of custody tracks every person who handled the evidence, preserving its admissibility in legal proceedings. Using a write blocker when creating disk images prevents any accidental writes to the original media, which is critical to avoid altering the evidence.

Answer

Boot the suspect system to check for running processes.

Answer

Reinstall the operating system before imaging to ensure stability.

Answer

Store original evidence on the same network as the investigation.

Question 8

A security team is implementing container security scanning in their CI/CD pipeline. They want to scan container images for vulnerabilities and Kubernetes misconfigurations. Which THREE tools from the following list are best suited for this purpose? (Select THREE)

Accepted Answer

Trivy. Trivy, Clair, and Snyk are all container image scanning tools. OpenSCAP is for compliance scanning of hosts, not containers. Burp Suite is a web application DAST tool.

Answer

Burp Suite

Answer

OpenSCAP

Question 9

A security analyst is configuring a vulnerability scanner for an internal network. Which two settings are most important for reducing false positives during the scan? (Choose two.)

Accepted Answer

Disabling unnecessary plug-ins. Credentialed scans access system details for accurate results, and appropriate plug-in selection reduces irrelevant checks.

Answer

Using a higher scan intensity

Answer

Scanning from multiple IP addresses

Answer

Scanning only during business hours

Question 10

During a post-incident review, a security analyst identifies that the mean time to detect (MTTD) for incidents is significantly higher than the industry benchmark. Which THREE actions should the analyst recommend to improve detection capabilities?

Accepted Answer

Implement additional network monitoring sensors.. Updating detection rules, integrating threat intelligence, and improving monitoring coverage directly reduce detection time.

Answer

Increase the frequency of vulnerability scans.

Answer

Reduce the retention period for logs.

Question 11

A security analyst is selecting tools for vulnerability management. Which THREE of the following are vulnerability scanning tools?

Accepted Answer

Nessus. Nessus, Qualys, and OpenVAS are well-known vulnerability scanners. Lynis is a security auditing tool for hardening, but not primarily a vulnerability scanner, and Wireshark is a network protocol analyzer.

Answer

Lynis

Answer

Wireshark

Question 12

An organization is implementing a patch management process. Which THREE of the following are essential steps that should be included before deploying patches to production systems? (Select the three best answers.)

Accepted Answer

Testing patches in a staging environment. Staging environment testing, regression testing, and vendor advisory review are key pre-deployment steps.

Answer

Deploying patches directly to all production systems simultaneously

Answer

Disabling all security controls to avoid conflicts

Question 13

A cybersecurity analyst is preparing an incident report after a data breach. Which TWO components are essential to include? (Select TWO.)

Accepted Answer

Root cause. Root cause and timeline are standard components of incident reports.

Answer

Budget forecast

Answer

Employee performance review

Answer

Marketing analysis

Question 14

After a security incident involving a ransomware attack, the organization needs to communicate with various stakeholders. Which THREE of the following are appropriate actions? (Select THREE.)

Accepted Answer

Place legal holds on relevant data. Customer notification, law enforcement coordination, and legal holds are key communication steps during incidents.

Answer

Delete all logs to prevent data leakage

Answer

Publish details on social media immediately

Question 15

A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?

Accepted Answer

Frequent DNS queries to domains with random-looking, long subdomains. DGA domains are often algorithmically generated, resulting in random-looking, long domain names. High NXDOMAIN rates occur because many generated domains are not registered at the time of query.

Answer

All DNS queries are to internal DNS servers

Answer

DNS queries to domains with a high Alexa ranking

Answer

Consistent DNS query intervals to a single IP

Question 16

A security analyst is conducting a dynamic application security testing (DAST) scan of a REST API. The scanner reports a potential Server-Side Request Forgery (SSRF) vulnerability. The analyst needs to confirm the finding manually. Which TWO of the following techniques are most appropriate for validating SSRF?

Accepted Answer

Submit a payload that triggers the server to send a request to an attacker-controlled external server (e.g., Burp Collaborator). SSRF can be confirmed by making requests to internal resources (e.g., localhost) and observing responses, or by using an external collaborator service to detect out-of-band callbacks.

Answer

Inject malicious SQL queries into input fields to see if they are executed

Answer

Attempt to upload a malicious file to the server

Answer

Modify HTTP headers to test for cross-site scripting

Question 17

A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)

Accepted Answer

Recent access review reports. Access review reports and user account audit logs directly demonstrate access control implementation.

Answer

A network topology diagram

Answer

A list of all employees

Answer

The company's password policy

Question 18

A security analyst is collecting evidence for an upcoming compliance audit. Which three types of evidence are typically required? (Select THREE.)

Accepted Answer

Access review documentation. Auditors typically require log exports, vulnerability scan reports, and access reviews to verify controls.

Answer

Employee training attendance records

Answer

Marketing brochures

Question 19

Which three of the following are effective techniques for prioritizing vulnerabilities for remediation in a vulnerability management program? (Choose three.)

Accepted Answer

Using asset criticality ratings derived from business impact analysis (BIA). Correlating vulnerabilities with active exploit campaigns and threat intelligence feeds is effective because it prioritizes vulnerabilities that are currently being exploited in the wild, which directly reduces the risk of a breach. This approach aligns remediation with real-world attacker behavior rather than theoretical severity.

Answer

Prioritizing vulnerabilities based solely on the age of the CVE

Answer

Applying the Common Vulnerability Scoring System (CVSS) base score as the sole prioritization metric

Answer

Focusing remediation efforts exclusively on vulnerabilities with a CVSS score of 9.0 or higher

Question 20

An analyst is creating a YARA rule to detect a specific malware family that uses the string 'evil' in its PE file. Which of the following rule structures is correct?

Accepted Answer

rule detect_malware { strings: $a = "evil" condition: $a }. The standard YARA rule structure includes rule name, meta section, strings section, and condition section. The condition must reference the string.

Answer

rule detect_malware { strings: "evil" condition: $a }

Answer

rule detect_malware { condition: $a = "evil" }

Answer

if "evil" in file then alert