CS0-003 Practice Test 26 — 15 Questions

Question 1

While supporting a hybrid workforce, a user reports approving an unexpected OAuth consent prompt for an app named 'Invoice Reader'. The app now has mailbox read permissions. What should the incident responder do first? During detection and analysis, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Revoke the app grant, review mailbox access, and identify other users who consented. Option D is correct because the immediate priority is to revoke the malicious OAuth grant to stop the attacker's access, then review the mailbox for any data exfiltration or abuse, and finally identify other users who may have consented to the same app to contain the incident. This follows the NIST SP 800-61 incident response process for detection and analysis, where the most defensible decision is to remove the attacker's foothold and assess the scope of compromise. Ignoring the issue or taking non-targeted actions like password resets or email deletion fails to address the root cause—the OAuth consent grant—which persists independently of user credentials.

Answer

Ignore it if MFA is enabled

Answer

Delete all emails from the mailbox

Answer

Only reset the user's Windows password

Question 2

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. Option D is correct because when a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance. This includes the risk owner, the reason for acceptance, any compensating controls in place, a scheduled review date, and an expiry date for the exception. This ensures traceability, accountability, and that the risk is not forgotten, aligning with governance frameworks like NIST SP 800-37 or ISO 27001.

Answer

Only the analyst's personal opinion

Answer

A permanent exception with no review

Answer

No mention of the accepted risk

Question 3

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it automatically scans the project's dependencies against known vulnerability databases (e.g., NVD, GitHub Advisory Database) to identify vulnerable open-source libraries before deployment. Integrating SCA into the CI/CD pipeline ensures that vulnerabilities are caught early in the development lifecycle, aligning with the shift-left security principle without suppressing or masking risk.

Answer

Wireless spectrum analysis

Answer

Physical badge access reviews

Answer

Database transaction log backups

Question 4

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. Option D is correct because the best validation method is to manually test the service using a TLS client (e.g., OpenSSL s_client) or a scanner profile that explicitly attempts to negotiate TLS 1.0. This directly verifies whether the server truly rejects TLS 1.0 handshakes, eliminating false positives from scanner misconfiguration or version negotiation quirks. Relying on the owner's assertion or altering the finding without technical proof would violate vulnerability management best practices.

Answer

Close the finding because the owner disagrees

Answer

Change the severity to informational automatically

Answer

Delete the server from the scan scope

Question 5

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. Option D is correct because the scenario describes a potential account takeover or lateral movement, where an impossible travel event (logins from London and Singapore within 12 minutes) is followed by a suspicious mailbox forwarding rule. The analyst must first verify the sign-in logs for authentication details, MFA results to check if the MFA was bypassed or prompted, device details to identify if a known or managed device was used, and mailbox audit events to confirm the forwarding rule creation and its origin. These combined data sources provide the most direct evidence to determine if the activity is malicious or a false positive.

Answer

Only DHCP logs from the London office

Answer

The organisation's public DNS zone file

Answer

Only the user's browser cache

Question 6

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software Composition Analysis (SCA) is the correct control because it specifically scans open-source libraries for known vulnerabilities (CVEs) and license compliance issues. Integrating SCA into the CI/CD pipeline ensures vulnerabilities are detected and blocked before the code is deployed, aligning with the 'shift left' security principle. This directly addresses the team's goal of finding vulnerable open-source libraries pre-deployment.

Answer

Database transaction log backups

Answer

Physical badge access reviews

Answer

Wireless spectrum analysis

Question 7

A security analyst is reviewing alerts from multiple security tools. Which three of the following are key indicators of a potential credential-based attack in the environment? (Choose three.)

Accepted Answer

Multiple failed logon attempts followed by a single successful logon from the same source IP address.. Multiple failed logon attempts followed by a single successful logon from the same source IP address is a classic indicator of a password spraying or brute-force attack. The attacker tries many usernames or passwords, and when one succeeds, the pattern shifts from failures to a success. This sequence is a key sign of credential compromise.

Answer

A spike in outbound DNS traffic from a workstation during business hours.

Answer

An increase in the number of TCP SYN packets sent to a single external IP address.

Answer

A system event log showing a successful logon after a scheduled patch reboot.

Question 8

An organization has detected a ransomware outbreak that has encrypted critical file servers. The incident response team has activated the plan. Which three of the following actions should be taken during the containment and eradication phases? (Choose three.)

Accepted Answer

Isolate affected systems from the network immediately.. Isolating affected systems from the network immediately is correct because it stops the ransomware from spreading laterally to other hosts via SMB, RDP, or other network protocols. This containment step is critical to limit the scope of the outbreak and protect unencrypted assets.

Answer

Disable the antivirus software to reduce system load.

Answer

Notify law enforcement before any containment actions.

Answer

Power down all systems to prevent further encryption.

Question 9

During the post-incident analysis phase of an incident response process, which of the following activities are considered essential best practices? Choose all that apply. (There are four correct answers.)

Accepted Answer

Creating a detailed timeline of the incident from detection to containment and recovery.. A detailed timeline is essential for reconstructing the sequence of events, identifying the initial compromise vector, and measuring response effectiveness. It provides a factual basis for all subsequent analysis and reporting, ensuring that the incident response team can accurately assess the scope and impact of the incident.

Answer

Immediately deleting all logs related to the incident to free up storage space.

Answer

Notifying law enforcement and regulatory bodies before conducting any internal investigation.

Question 10

A security analyst is reviewing lessons learned after a data breach. Which three of the following are key objectives of a post-incident activity phase? (Choose three.)

Accepted Answer

Conduct a root cause analysis to identify the underlying vulnerabilities.. Conducting a root cause analysis is a key objective of the post-incident activity phase because it identifies the underlying vulnerabilities and weaknesses that allowed the breach to occur. This analysis informs the development of corrective actions to prevent recurrence, which is a core goal of lessons learned. Without this step, the organization cannot effectively harden its defenses against similar attacks.

Answer

Restore affected systems to their pre-incident state immediately.

Answer

Delete all logs to prevent future misuse of data.

Answer

Discipline the employees responsible for the breach.

Question 11

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. Option B is correct because the best next step is to validate whether the vulnerable OpenSSL binary is actually exploitable in the container's runtime context (e.g., it may be a statically linked unused library or a dead code path). If the binary is truly unused, the team should still rebuild from a patched base image where feasible to maintain a clean supply chain and avoid false-positive fatigue; if it is used, the vulnerability must be remediated. This balances security rigor with operational pragmatism, aligning with vulnerability management best practices for containerized environments.

Answer

Ship the image and document nothing

Answer

Only rename the image tag

Answer

Ignore all base-image vulnerabilities

Question 12

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. Option D is correct because when a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, including compensating controls (e.g., network segmentation, host-based firewall rules) and a migration or remediation plan. This documentation is essential for stakeholder management to demonstrate due diligence and maintain a defensible security posture against audits or compliance reviews.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 13

After containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible?

Accepted Answer

Remove persistence, rotate affected credentials, and verify no related hosts remain compromised. Option D is correct because before recovery, you must remove the persistence mechanism (the scheduled task), rotate the stolen service account credentials to prevent re-entry, and verify that no other hosts are compromised using the same foothold. This ensures the attacker cannot regain access after the host is restored to production, which is a fundamental step in the eradication phase of incident response.

Answer

Reconnect the host because users need it

Answer

Disable logging to improve performance

Answer

Close the incident after isolation

Question 14

An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)

Accepted Answer

Implementing network segmentation to prevent lateral movement.. Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.

Answer

Notifying law enforcement agencies about the incident.

Answer

Creating a forensic image of the infected systems for later analysis.

Answer

Identifying and patching the vulnerability exploited by the malware.

Question 15

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. Option D is correct because it provides a structured, factual communication that addresses the legal and privacy stakeholder's need for accountability, risk assessment, and contractual compliance. The timeline and evidence establish the sequence of events, service impact quantifies the breach of SLA, required corrective actions demonstrate remediation steps, and contractual follow-up triggers legal review of penalties or liabilities. This approach avoids speculation and focuses on verifiable data, which is critical for legal teams to assess regulatory obligations (e.g., GDPR breach notification timelines) and potential litigation.

Answer

Confidential unrelated customer data

Answer

Internal blame speculation

Answer

A public press statement draft first