CS0-003 Practice Test 28 — 15 Questions

Question 1

A phishing simulation is conducted, and the click rate is reported to management. What does a high click rate indicate?

Accepted Answer

There is a need for more security awareness training. A high click rate suggests that employees are susceptible to phishing, indicating a need for security awareness training.

Answer

Employees are well-trained in security

Answer

The phishing simulation was not realistic

Answer

The organization has strong technical controls

Question 2

Which of the following is the best data source for detecting DNS tunneling activity?

Accepted Answer

DNS logs. DNS logs contain the queries and responses; analyzing them for unusual domain patterns, large query volumes, or odd record types can reveal tunneling.

Answer

Firewall logs

Answer

EDR telemetry

Answer

NetFlow data

Question 3

A security analyst is reviewing an alert from a CASB that shows a user downloading a large volume of sensitive data from a cloud storage application to a personal device outside of business hours. The user's behavior is atypical. Which of the following is the most likely interpretation?

Accepted Answer

Indicates a compromised account being used for data exfiltration. Atypical data download from a cloud service to a personal device outside business hours is a strong indicator of data exfiltration.

Answer

True positive - but only if the user has been phished

Answer

False positive - the user is working overtime

Answer

Indicates a misconfigured CASB policy

Question 4

A security analyst is prioritizing vulnerabilities for remediation. One vulnerability has a CVSS v3.1 score of 7.5, an EPSS score of 0.02, and is not in the CISA KEV catalog. Another vulnerability has a CVSS score of 5.0, an EPSS score of 0.85, and is listed in the KEV catalog. Which vulnerability should be prioritized FIRST?

Accepted Answer

The vulnerability with CVSS 5.0. EPSS and KEV catalog provide real-world exploit intelligence. The vulnerability with high EPSS and KEV is more likely to be exploited, so it should be prioritized despite lower CVSS.

Answer

The vulnerability with CVSS 7.5

Answer

Both should be prioritized equally

Answer

Neither should be prioritized until a full risk assessment is done

Question 5

A security analyst is reviewing the results of a container image scan using Trivy. The scan reports a critical vulnerability in a base image layer. The development team states that the vulnerability is not exploitable because the affected library is not used in the application. According to vulnerability management best practices, what should the analyst do?

Accepted Answer

Request that the development team remove the unused library and rebuild the image.. Even if the library is not used, it is best practice to rebuild the image with a patched base image to eliminate the vulnerability and ensure compliance.

Answer

Accept the risk and close the finding.

Answer

Ignore the finding since it is not exploitable.

Answer

Apply a compensating control at the network level to block exploitation.

Question 6

During a compliance audit, the auditor requests evidence of access reviews. Which of the following would be the MOST appropriate evidence to provide?

Accepted Answer

Completed access review sign-off sheets with manager approvals. Access review documentation, such as sign-off sheets or reports showing review and approval of user access rights, directly demonstrates that periodic access reviews are conducted.

Answer

Vulnerability scan reports

Answer

A list of all user accounts and their creation dates

Answer

Logs of successful and failed login attempts

Question 7

An organization uses OpenSCAP to perform compliance scanning against STIGs for DoD environments. A scan reveals that several systems are non-compliant with STIG ID: V-XXXXX requiring 'The system must disable the guest account.' The configuration drift detection tool shows that the guest account was re-enabled after a recent patch. What is the MOST effective course of action?

Accepted Answer

Update the system baseline to enforce the guest account disabled state via Group Policy.. Configuration drift indicates that patches or changes are reverting settings. The most effective action is to update the baseline configuration management tool (e.g., Group Policy) to enforce the setting automatically.

Answer

Apply an exception to the STIG requirement for these systems.

Answer

Re-run the OpenSCAP scan after the next patch cycle.

Answer

Manually disable the guest account on each non-compliant system.

Question 8

A vulnerability scan report shows a critical vulnerability with a CVSS score of 9.8 on an internal web server. The server is not internet-facing and is protected by a compensating control: a web application firewall (WAF) that blocks the attack vector. What should the analyst recommend?

Accepted Answer

Document the compensating control and reduce the risk rating. The vulnerability has a high CVSS score, but the compensating control (WAF) reduces the risk. The analyst should document the control and adjust the risk rating rather than patching immediately if patching would cause downtime.

Answer

Schedule an immediate emergency patch

Answer

Remove the WAF to ensure the vulnerability is addressed

Answer

Ignore the finding because it is a false positive

Question 9

A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to an external IP address on port 22. Upon investigation, the analyst finds the workstation is used by a developer who frequently transfers large files to a remote server via SCP. What is the most appropriate classification for this alert?

Accepted Answer

False positive. The alert is triggered by legitimate administrative activity (SCP file transfer), so it is a false positive. The analyst should tune the SIEM to reduce similar alerts.

Answer

True positive

Answer

True negative

Answer

False negative

Question 10

A SOC analyst is triaging a SIEM alert for a registry modification on a workstation. The alert indicates a new Run key was added under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Which of the following is the most likely purpose of this modification?

Accepted Answer

To establish persistence. Run keys are a common persistence mechanism used by malware to ensure execution at user logon.

Answer

To change the desktop wallpaper

Answer

To disable Windows Defender

Answer

To update the system time

Question 11

An analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The analyst checks the VPC Flow Logs and confirms the communication. What is the next best step in the investigation?

Accepted Answer

Isolate the EC2 instance from the network.. Since the EC2 instance is compromised, isolating it (e.g., by modifying security groups or stopping the instance) prevents further malicious activity while preserving evidence.

Answer

Run a vulnerability scan on the instance.

Answer

Ignore the alert because GuardDuty often produces false positives.

Answer

Delete the EC2 instance immediately.

Question 12

A security analyst is evaluating a containerized application for vulnerabilities. The analyst runs Trivy on the container image and finds several high-severity vulnerabilities in the base image. Which of the following is the most effective remediation strategy?

Accepted Answer

Rebuild the image using a patched base image and redeploy. Rebuilding the container image with a patched base image addresses the root cause by eliminating vulnerable components.

Answer

Use a runtime security tool to monitor the container

Answer

Apply a host-based firewall to block exploitation attempts

Answer

Disable the container until a patch is available

Question 13

A security analyst discovers a critical vulnerability in a web application that allows an attacker to trigger server-side requests from the application server. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

Server-Side Request Forgery (SSRF). Server-Side Request Forgery (SSRF) is a distinct category in OWASP Top 10 (A10:2021).

Answer

Broken Access Control

Answer

Security Misconfiguration

Answer

Injection

Question 14

During a vulnerability scan, a security analyst identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which component of this vector indicates that the vulnerability can be exploited without any user interaction?

Accepted Answer

UI:N. The UI (User Interaction) metric in the CVSS vector is set to N (None), meaning no user action is required for exploitation.

Answer

AC:L

Answer

AV:N

Answer

PR:N

Question 15

A vulnerability management team is evaluating a critical vulnerability in a legacy application that cannot be patched. The application is used by a small number of users internally. Which of the following is the best compensating control to reduce risk?

Accepted Answer

Implement network segmentation to restrict access to the application. When patching is not possible, compensating controls like network segmentation can limit exposure. Disabling the application would impact business. Application whitelisting might be too broad. Encryption doesn't prevent exploitation of the vulnerability.

Answer

Enable application whitelisting on all endpoints

Answer

Encrypt all data in transit

Answer

Disable the application until a patch is available