CS0-003 Practice Test 26 — 15 Questions

Question 1

A cybersecurity analyst is preparing a vulnerability report for the IT manager. Which section should summarize the most critical risks for the organization?

Accepted Answer

Executive summary. The executive summary provides a high-level overview of the most critical risks and recommended actions for management.

Answer

Remediation timeline

Answer

Risk acceptance

Answer

Findings by severity

Question 2

A security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address on port 4444. The analyst checks the VPC Flow Logs and confirms the traffic. Which of the following is the most appropriate immediate action?

Accepted Answer

Apply a restrictive security group to isolate the instance. Isolating the EC2 instance by applying a restrictive security group stops the malicious communication and allows further investigation.

Answer

Create a new IAM role for the instance

Answer

Terminate the EC2 instance immediately

Answer

Update the route table to blackhole the traffic

Question 3

A security analyst reviews a vulnerability scan report and identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and all three CIA impacts are 'High'. Which additional factor should the analyst prioritize when deciding whether to apply a patch or a compensating control?

Accepted Answer

The EPSS score for the vulnerability. The EPSS score estimates the likelihood of exploitation in the wild, which helps prioritize remediation. CVSS alone does not indicate active exploitation.

Answer

The number of affected hosts

Answer

The OS type of the affected system

Answer

The vendor's patch release date

Question 4

A security analyst is configuring a vulnerability scanner for internal network scanning. The analyst wants to ensure the scanner can identify missing patches and software configurations that require administrative privileges to read. Which scan type should the analyst configure?

Accepted Answer

Credentialed scan. Credentialed scans use administrative credentials to access systems and retrieve detailed configuration information, including missing patches.

Answer

Non-credentialed scan

Answer

External scan

Answer

Passive scan

Question 5

During a network traffic review, an analyst notices encrypted traffic to an unusual external IP address on TCP port 53. What is the most likely anomaly this indicates?

Accepted Answer

Data exfiltration via DNS tunnelling. Port 53 is used for DNS, which typically uses UDP. Encrypted traffic on TCP/53 suggests DNS tunnelling, where data is exfiltrated inside DNS queries and responses.

Answer

Normal DNS resolution

Answer

Beaconing to command and control

Answer

HTTP smuggling attack

Question 6

A security analyst is investigating a Kubernetes cluster and finds that a container is running with securityContext.privileged: true. The container also has a hostPath mount that allows writing to the host filesystem. Which of the following best describes the primary risk of this configuration?

Accepted Answer

The container can break out of the container environment and gain root access to the host node.. A privileged container with hostPath mount can escape the container and compromise the host. The container can access host resources, potentially allowing full host compromise.

Answer

The container can only read host files, but not modify them.

Answer

The container can only affect other containers in the same pod, not the host.

Answer

The container can be used to launch a denial-of-service attack on the Kubernetes API server.

Question 7

During a network traffic analysis, a security analyst observes repeated TCP SYN packets sent to a host that responds with SYN-ACK, but the connection never completes. What type of anomaly is this?

Accepted Answer

SYN flood. A half-open TCP handshake (SYN flood) is a common DoS technique where the attacker sends many SYN packets without completing the handshake, exhausting server resources.

Answer

DNS amplification

Answer

ARP spoofing

Answer

Port scan

Question 8

During a configuration compliance scan using OpenSCAP, a security analyst finds that several Windows servers have the 'Network access: Do not allow anonymous enumeration of SAM accounts' setting set to 'Disabled'. This finding corresponds to a CIS Benchmark recommendation. Which of the following describes the most appropriate remediation step for this finding?

Accepted Answer

Enable the policy 'Network access: Do not allow anonymous enumeration of SAM accounts' via Group Policy.. The setting should be enabled to prevent anonymous enumeration of SAM accounts. The remediation is to change the policy setting via Group Policy or local security policy.

Answer

Disable the Guest account on all servers.

Answer

Apply a registry key to disable anonymous enumeration.

Answer

Restrict anonymous access using IPsec rules.

Question 9

A security analyst uses Wireshark to capture traffic and notices an unusually high number of DNS queries for random-looking subdomains under a single domain, such as 'a1b2c3.malicious.com'. The TTL values are very low. The analyst suspects DNS tunneling. Which of the following additional indicators would most strongly support this hypothesis?

Accepted Answer

DNS queries with unusually large TXT record response sizes. DNS tunneling often uses TXT records to encode data, and the packet sizes can be larger than normal DNS queries.

Answer

Large number of NXDOMAIN responses

Answer

High number of A record queries

Answer

Queries originating from a DNS server

Question 10

A security analyst is tuning a SIEM correlation rule that triggers on failed login attempts. The rule is generating a high number of alerts from a specific user who frequently mistypes passwords. The analyst wants to reduce false positives while maintaining detection of brute-force attacks. Which TWO actions should the analyst take?

Accepted Answer

Exclude the specific user account from the rule. Increasing the threshold to require more failed attempts in the time window helps ignore simple mistypes, and excluding the specific user account from the rule prevents alerts for that benign behavior.

Answer

Delete the correlation rule and create a new one from scratch

Answer

Change the rule to alert on every single failed login

Answer

Increase the severity of the rule to trigger an immediate response

Question 11

After a data breach involving customer PII, the incident response team has contained the incident and eradicated the malware. What is the NEXT step in the remediation process?

Accepted Answer

Close the vulnerability that was exploited.. After containment and eradication, the next step in the remediation process is to close the vulnerability that was exploited. This prevents the attacker from re-entering through the same vector. Conducting a root cause analysis (C) is part of the post-incident review, not the immediate next step. Notifying affected customers (D) is a legal/compliance step that occurs later in the process. Restoring systems from clean backups (B) is part of the recovery phase, which typically occurs after closing the vulnerability.

Answer

Restore systems from clean backups.

Answer

Conduct a root cause analysis.

Answer

Notify all affected customers.

Question 12

During a network traffic analysis, a security analyst notices a host communicating with an external IP address over TCP port 443 using a self-signed certificate. The traffic flows are consistent in size and occur every 60 seconds. The external IP is not on any threat intelligence feeds. What does this pattern most likely indicate?

Accepted Answer

Command and control beaconing. Regular, periodic connections of consistent size to an external host over HTTPS suggest beaconing, often used by malware for command and control.

Answer

Lateral movement attempt

Answer

Data exfiltration via DNS tunneling

Answer

Normal web browsing

Question 13

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from an internal IP address to a domain controller at 3:00 AM. The user associated with the account is on vacation. Which classification best describes this alert?

Accepted Answer

True positive. The alert is triggered by a real failed login attempt from an internal IP, but the user is on vacation, so it likely indicates a malicious attempt. Since it is a confirmed security incident, it is a true positive.

Answer

False positive

Answer

False negative

Answer

True negative

Question 14

A security analyst is performing static analysis on a suspicious PE file. Which initial step should the analyst take to understand the file's imports and potential capabilities?

Accepted Answer

Analyze the PE header and import table.. Analyzing the import table reveals which Windows API functions the file uses, providing insight into its functionality (e.g., network, file, or registry operations).

Answer

Create a YARA rule based on hash characteristics.

Answer

Run the file in a sandbox and observe behavior.

Answer

Extract strings from the file.

Question 15

A cybersecurity analyst is preparing a threat intelligence report for the SOC team. Which type of intelligence should be included to provide actionable indicators of compromise (IoCs)?

Accepted Answer

Tactical intelligence. Tactical intelligence includes IoCs such as IP addresses, domain names, and hashes that can be used for detection and blocking.

Answer

Strategic intelligence

Answer

Technical intelligence

Answer

Operational intelligence