CS0-003 Practice Test 5 — 25 Questions

Question 1

A security analyst has identified a large number of false positives in a vulnerability scan report. Which of the following is the BEST way to reduce false positives in future scans?

Accepted Answer

Tune the vulnerability scanner's configuration. Tuning the vulnerability scanner's configuration (option D) is the best approach because it allows the analyst to adjust scan parameters such as credential settings, plugin thresholds, and network timeouts to match the target environment. This reduces false positives by ensuring the scanner accurately identifies real vulnerabilities rather than reporting benign deviations or configuration mismatches. For example, enabling authenticated scans with valid credentials eliminates many false positives related to missing patches that are actually installed.

Answer

Manually verify each vulnerability before reporting

Answer

Increase the frequency of vulnerability scans

Answer

Exclude the false positives from the report

Question 2

A security analyst suspects an insider threat based on unusual data access patterns by an employee. According to best practices, which TWO actions should the analyst take FIRST?

Accepted Answer

Restrict the employee's access to sensitive data.. Restricting the employee's access to sensitive data (A) is a correct first action because it immediately reduces the risk of further data exfiltration or damage while preserving the ability to investigate. Collecting additional evidence without alerting the employee (D) is also correct because it allows the analyst to build a forensic case covertly, preventing the insider from destroying evidence or altering behavior. Both actions align with the incident response principle of containment before eradication and the need to avoid tipping off a potential adversary.

Answer

Suspend the employee's accounts outright.

Answer

Immediately notify law enforcement.

Answer

Confront the employee about the behavior.

Question 3

Order the steps to perform a vulnerability scan using a tool like Nessus.

Accepted Answer

Define targets, then choose a scan policy, then configure settings, then execute the scan, then analyze results. Vulnerability scanning typically involves defining targets, choosing a policy, configuring settings, executing, and analyzing results.

Answer

Define targets, then configure settings, then choose a scan policy, then execute the scan, then analyze results

Answer

Choose a scan policy, then define targets, then configure settings, then execute the scan, then analyze results

Answer

Define targets, then choose a scan policy, then execute the scan, then configure settings, then analyze results

Question 4

An analyst wants to capture all traffic to and from a specific IP address for analysis. Which command-line tool is most appropriate?

Accepted Answer

tcpdump host 10.0.0.1. `tcpdump host 10.0.0.1` captures all packets where the source or destination IP address matches 10.0.0.1, making it the ideal tool for capturing all traffic to and from a specific IP for analysis. It operates at the packet level, using libpcap to intercept raw network frames, and the `host` filter instructs it to match both directions of traffic without additional parsing or state tracking.

Answer

nmap -sS 10.0.0.1

Answer

netstat -ant | grep 10.0.0.1

Answer

iptables -L -v

Question 5

Arrange the steps for conducting a risk assessment in the correct order.

Accepted Answer

1. Identify assets, 2. Identify threats and vulnerabilities, 3. Analyze likelihood and impact, 4. Calculate risk, 5. Prioritize risks. Risk assessment involves asset identification, threat/vulnerability identification, likelihood/impact analysis, risk calculation, and prioritization.

Answer

1. Identify threats and vulnerabilities, 2. Identify assets, 3. Analyze likelihood and impact, 4. Calculate risk, 5. Prioritize risks

Answer

1. Identify assets, 2. Identify threats and vulnerabilities, 3. Calculate risk, 4. Analyze likelihood and impact, 5. Prioritize risks

Answer

1. Identify assets, 2. Identify threats and vulnerabilities, 3. Analyze likelihood and impact, 4. Prioritize risks, 5. Calculate risk

Question 6

A security engineer needs to implement a baseline configuration for all new Linux servers. Which of the following should be included in the baseline to reduce the attack surface?

Accepted Answer

Disable all unnecessary services and daemons.. Disabling all unnecessary services and daemons directly reduces the attack surface by eliminating potential entry points for exploitation. Each running service represents a vector for attacks, such as buffer overflows or misconfigurations, and removing them minimizes the number of listening ports and active processes. This aligns with the principle of least functionality, a core security baseline for Linux servers.

Answer

Enable strong password policies for all users.

Answer

Enable comprehensive audit logging.

Answer

Configure disk encryption for all data volumes.

Question 7

After a risk assessment, a security analyst recommends accepting a low-risk finding. The system owner disagrees. Which communication strategy should the analyst use?

Accepted Answer

Present the risk assessment data and cost-benefit analysis to justify acceptance. The security analyst should use data-driven communication to resolve disagreements over risk acceptance. By presenting the risk assessment data and a cost-benefit analysis, the analyst provides objective evidence that the low-risk finding does not warrant mitigation, aligning with the NIST risk management framework's emphasis on informed decision-making. This approach respects the system owner's concerns while justifying the acceptance based on technical and business rationale.

Answer

Escalate the disagreement to the CISO immediately

Answer

Agree with the system owner and change the recommendation

Answer

Insist that the finding must be mitigated due to policy

Question 8

A security team discovers a critical vulnerability in a widely used software component. The vulnerability has a CVSS score of 9.0, but there is no known exploit or patch available yet. However, the software vendor has released a workaround. According to the vulnerability management lifecycle, which action should the team prioritize first?

Accepted Answer

Apply the workaround as a compensating control. Since no patch is available, the team should apply compensating controls to mitigate the risk. Remediation typically involves patching, but if not possible, compensating controls are the next best step.

Answer

Wait for the vendor to release a patch before taking any action

Answer

Remove the affected component from all systems immediately

Answer

Increase monitoring of the affected systems but take no other action

Question 9

After a data breach incident, a post-incident review team is collecting lessons learned. Which THREE items should be included in the lessons learned documentation?

Accepted Answer

Timeline of events during the incident. The timeline of events is a critical component of lessons learned documentation. It provides a chronological sequence of actions, detections, and responses during the incident, which is essential for identifying gaps in detection, delays in response, and opportunities for improvement. Without a precise timeline, the team cannot accurately assess the effectiveness of their incident response procedures or the speed of containment.

Answer

Individual performance evaluations of team members

Answer

Legal liability of the organization

Question 10

During a network traffic analysis, a security analyst observes repeated connections from an internal host to a known malicious IP on port 4444. The payload appears to be encrypted. Which type of activity is most likely indicated?

Accepted Answer

Command and control beaconing. Repeated connections to a known malicious IP on a non-standard port with encrypted payloads strongly suggest command and control (C2) beaconing.

Answer

Port scanning activity

Answer

Data exfiltration via DNS tunnelling

Answer

Lateral movement using SMB

Question 11

A cloud security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The instance is part of an auto-scaling group. What is the best immediate action?

Accepted Answer

Isolate the instance by modifying its security group to deny all traffic.. Isolating the instance by removing it from the security group or using a quarantine VPC prevents further communication while preserving forensic data.

Answer

Terminate the instance immediately to stop the threat.

Answer

Ignore the alert because auto-scaling groups are ephemeral.

Answer

Update the GuardDuty threat list to ignore that IP.

Question 12

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a finance workstation to a known malicious IP address at 2:00 AM. The analyst checks the firewall logs and sees a single connection. Which action should the analyst take FIRST according to NIST SP 800-61?

Accepted Answer

Validate the incident by reviewing additional data sources.. NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.

Answer

Run a full antivirus scan on the workstation.

Answer

Isolate the workstation from the network immediately.

Answer

Notify law enforcement per the incident response plan.

Question 13

A security analyst is triaging an alert indicating that a user's workstation has been infected with ransomware. The file server shows signs of encryption. The analyst needs to contain the incident. Which action should the analyst take FIRST to minimize damage?

Accepted Answer

Disconnecting the workstation from the network. Disconnecting the infected workstation from the network stops the ransomware from spreading to other systems via network shares.

Answer

Running a full antivirus scan on the workstation

Answer

Disabling the user's Active Directory account

Answer

Rebuilding the workstation from a known good image

Question 14

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Accepted Answer

Notify all affected data subjects without undue delay if high risk. GDPR requires notification to the supervisory authority within 72 hours, documentation of the breach, and notification to affected individuals if high risk.

Answer

Publish a public notice in the local newspaper

Answer

Notify law enforcement within 24 hours

Question 15

During forensic analysis of a compromised server, an analyst needs to preserve evidence in order of volatility. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Acquire a memory dump using WinPmem. The order of volatility dictates collecting the most perishable evidence first. RAM contents — running processes, network connections, encryption keys, and injected code — vanish on reboot or power loss, so acquiring a memory dump with a tool like WinPmem must be the first action. Only after memory is captured should the analyst move to less volatile sources.

Answer

Collect log files from the system

Answer

Create a forensic image of the hard drive

Answer

Run antivirus scan

Question 16

Which metric would best indicate the effectiveness of an organization's patch management program?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage directly measures whether patches were applied within the organization's defined remediation windows (for example, critical patches within 14 days), which is the clearest indicator that the patch management program is working as designed. It ties patch deployment outcomes to policy requirements, making it the most direct effectiveness metric.

Answer

Phishing simulation click rates

Answer

Open vulnerability counts by severity

Answer

Mean time to detect (MTTD)

Question 17

During a security incident, a SOC analyst identifies that customer PII has been exfiltrated. The company operates in multiple states and processes EU residents' data. Which of the following is the MOST critical immediate communication requirement?

Accepted Answer

Notify the relevant data protection authority within 72 hours. Notifying the relevant data protection authority within 72 hours is the most critical immediate communication requirement because the GDPR mandates that organizations report personal data breaches to the supervisory authority within 72 hours of becoming aware of the breach, especially when EU residents' data is involved. This is a legal obligation with strict timelines. Other notifications may be required but are not as immediately critical or universally mandated within that timeframe.

Answer

Notify law enforcement within 24 hours

Answer

Notify affected customers within 48 hours

Answer

Issue a press release within 24 hours

Question 18

Which of the following is a key performance indicator (KPI) for measuring the efficiency of patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance % directly measures how efficiently the patch management process meets its defined service-level targets — the percentage of patches applied within the agreed remediation window. This is a process-efficiency KPI because it evaluates the speed and consistency of the patching workflow against a defined benchmark. MTTR measures incident response, not patch throughput, and open vulnerability count reflects exposure rather than process efficiency.

Answer

Mean time to respond (MTTR)

Answer

Number of open vulnerabilities

Answer

Phishing simulation click rate

Question 19

An analyst suspects DNS tunnelling but wants to avoid over-escalating normal CDN behaviour. Which comparisons help? (Choose two.)

Accepted Answer

Baseline query length, entropy, and subdomain uniqueness for the host. DNS tunnelling encodes non-DNS data (e.g., file exfiltration or C2 commands) into DNS queries, often producing abnormally long, high-entropy subdomains. Comparing current query length, entropy, and subdomain uniqueness against a baseline for the same host helps distinguish tunnelling from legitimate CDN traffic, which typically uses short, predictable subdomains. This approach focuses on the structural characteristics of the queries themselves, avoiding false positives from normal CDN behaviour.

Answer

Check whether the user likes the website

Answer

Count the number of icons on the desktop

Question 20

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. The most reliable way to validate whether TLS 1.0 is truly disabled is to perform an active, negotiated test using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to connect using only TLS 1.0. This bypasses any potential misconfiguration in the scanner's service detection or version negotiation logic, and directly confirms whether the server accepts a TLS 1.0 handshake. Relying solely on the scanner's banner grab or the owner's assertion can miss cases where the server still supports the protocol on certain ports or under specific cipher suites.

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Answer

Close the finding because the owner disagrees