CS0-003 Practice Test 27 — 15 Questions

Question 1

During an incident, the security team needs to preserve evidence for potential litigation. Which of the following actions is most critical to ensure the admissibility of digital evidence?

Accepted Answer

Establishing and maintaining a chain of custody for all evidence. Preserving the chain of custody is essential for evidence admissibility, as it documents who handled the evidence and when.

Answer

Creating a bit-for-bit forensic image of affected systems

Answer

Immediately notifying law enforcement

Answer

Encrypting all evidence files

Question 2

A security analyst is reviewing a vulnerability scan report and finds a critical vulnerability with a CVSS v3.1 base score of 9.8. The vector string is: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector and impact of this vulnerability?

Accepted Answer

Network attack vector, high impact on confidentiality, integrity, and availability. AV:N indicates network-based attack vector, meaning the vulnerability can be exploited remotely over the network. The CIA impact ratings are all High, indicating complete compromise of confidentiality, integrity, and availability.

Answer

Adjacent attack vector, high impact on availability only

Answer

Physical attack vector, medium impact on confidentiality

Answer

Local attack vector, low impact on confidentiality

Question 3

A security analyst is using the EPSS to prioritize vulnerabilities for remediation. EPSS is designed to estimate the likelihood that a vulnerability will be exploited in the wild. Which of the following best describes how EPSS should be used in vulnerability management?

Accepted Answer

EPSS should be used as one of several factors in a risk-based prioritization approach.. EPSS provides a probability score (0-1) that a vulnerability will be exploited in the wild within 30 days. It should be used alongside other factors like asset criticality and business context for prioritization.

Answer

EPSS is only relevant for high-severity vulnerabilities with a CVSS score above 9.0.

Answer

EPSS replaces the need for vulnerability scanning because it predicts exploitability.

Answer

EPSS alone should determine the remediation order, ignoring asset criticality.

Question 4

A security analyst is tuning a SIEM rule that triggers on any process creation event involving 'rundll32.exe'. The rule generates many false positives from legitimate software updates. Which tuning action would most effectively reduce false positives while maintaining detection of malicious use?

Accepted Answer

Add an exclusion list for known good command-line arguments or parent processes. Creating an exception list for known legitimate processes or command lines that use rundll32.exe reduces false positives. However, the best approach is to modify the rule to include specific conditions such as parent process or command-line arguments that indicate malicious activity.

Answer

Change the rule to trigger only on network connections from rundll32.exe

Answer

Disable the rule entirely

Answer

Increase the severity threshold of the rule

Question 5

A security analyst is investigating a series of alerts from AWS GuardDuty indicating 'UnauthorizedAccess:EC2/SSHBruteForce'. The affected EC2 instance has a high CPU load. The analyst checks the security group rules and finds that SSH (port 22) is open to 0.0.0.0/0. What is the best immediate remediation action?

Accepted Answer

Create a new security group allowing SSH only from known IPs and attach it to the instance. The instance is exposed to the internet on SSH. Restricting SSH access to known IP addresses reduces the attack surface. Creating a new security group with a narrow source range and applying it stops brute force attempts.

Answer

Terminate the EC2 instance immediately

Answer

Disable the GuardDuty alert to reduce noise

Answer

Install a host-based firewall on the instance to block SSH

Question 6

An analyst is prioritizing vulnerabilities for remediation. The vulnerability has a high CVSS score but is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and has a low EPSS score. The affected asset is a publicly accessible web server handling sensitive customer data. Which factor should the analyst consider as most critical for prioritization?

Accepted Answer

The business context of asset criticality and exposure. EPSS indicates likelihood of exploitation, but business context (asset criticality and exposure) can override low EPSS if the asset is high-value and exposed. Thus, the analyst should consider the business context.

Answer

The absence from the KEV catalog

Answer

The low EPSS score

Answer

The high CVSS score alone

Question 7

A security analyst is using Burp Suite to test an API endpoint. The analyst notices that the API returns detailed error messages when invalid input is provided, revealing database schema information. Which OWASP Top 10 category does this issue primarily relate to?

Accepted Answer

Security Misconfiguration. Detailed error messages revealing internal details are a form of security misconfiguration. The OWASP Top 10 category 'Security Misconfiguration' includes verbose error messages that leak information.

Answer

Injection

Answer

Broken Access Control

Answer

Cryptographic Failures

Question 8

A security analyst is analyzing a suspicious file using static analysis. The analyst wants to identify imported functions to determine the file's capabilities. Which tool or technique is BEST suited for this task?

Accepted Answer

Analyzing the PE header's import table. PE header analysis includes examining the import table to see which Windows API functions the executable calls, revealing its potential behavior.

Answer

Extracting strings from the file

Answer

Submitting the file to VirusTotal

Answer

Running the file in a sandbox like Cuckoo

Question 9

During dynamic analysis of a malware sample in a sandbox, the analyst observes that the malware attempts to connect to an IP address 198.51.100.23 and modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Which IOC type is the IP address an example of?

Accepted Answer

Network indicator. IP addresses are a common type of indicator of compromise, representing network-based IOCs that can be used for detection.

Answer

File hash

Answer

Email indicator

Answer

Domain name

Question 10

A security analyst is reviewing a DAST scan report for a web application. The report indicates a vulnerability where the application fails to properly validate user-supplied data before using it in a database query. This is most likely which type of vulnerability?

Accepted Answer

Injection. Failure to validate user input before using in a database query is classic SQL injection (injection flaw).

Answer

Cross-site scripting (XSS)

Answer

Security misconfiguration

Answer

Broken access control

Question 11

Refer to the exhibit. A security auditor finds this IAM policy attached to a user account. Which of the following describes the primary security concern?

Accepted Answer

The policy allows all S3 actions, which can lead to data exposure. The policy allows all S3 actions (s3:*) on all resources (Resource "*"), which means the user can read, write, delete, and modify any S3 bucket. This extreme level of access can lead to data exposure or deletion. The wildcard resource (option C) is part of the problem, but the combination of all actions is the core issue. Options A and B are incorrect; a NotAction element is not relevant here, and read-only access would be less permissive.

Answer

The policy is missing a NotAction element

Answer

The policy allows read-only access

Answer

The policy uses a wildcard resource

Question 12

An organization uses a DAST tool to test a web application for vulnerabilities. The tool sends specially crafted requests and analyzes responses. Which of the following vulnerabilities is a DAST tool most effective at identifying?

Accepted Answer

SQL injection. DAST tools are effective at finding runtime vulnerabilities like SQL injection, XSS, and other injection flaws by simulating attacks on the running application.

Answer

Outdated library versions in code

Answer

Insecure cryptographic algorithms in code

Answer

Hardcoded credentials in source code

Question 13

A web application security tester uses Burp Suite to test an API endpoint. The tester sends a request with a modified HTTP method and discovers that the API accepts DELETE requests on an endpoint that should only allow GET. This is an example of which OWASP Top 10 vulnerability?

Accepted Answer

Broken Access Control. Improper handling of HTTP methods can lead to broken access control, allowing unauthorized actions.

Answer

Injection

Answer

Security Misconfiguration

Answer

Server-Side Request Forgery (SSRF)

Question 14

A vulnerability scanner reports a plugin that identifies a web application vulnerability related to the failure to validate user input, allowing an attacker to inject malicious scripts that execute in other users' browsers. Which OWASP Top 10 category does this vulnerability fall under?

Accepted Answer

Injection. The description matches cross-site scripting (XSS), which is part of the OWASP Top 10 category 'Injection' (formerly separate, but in 2021 XSS is included in Injection).

Answer

Security Misconfiguration

Answer

Cryptographic Failures

Answer

Broken Access Control

Question 15

A vulnerability management team is prioritizing remediation of a list of vulnerabilities. They want to incorporate the likelihood of exploitation based on real-world exploit activity. Which of the following data sources should they use?

Accepted Answer

EPSS. The Exploit Prediction Scoring System (EPSS) uses real-world exploit data to predict the likelihood of exploitation. KEV lists known exploited vulnerabilities but is not a scoring system. CVSS and CVE are not probabilistic.

Answer

CVE

Answer

CVSS

Answer

KEV