CS0-003 Practice Test 29 — 15 Questions

Question 1

What is the net effect of the policy shown in the exhibit on requests from an IP address in the 10.0.0.0/8 range?

Accepted Answer

Denies all S3 actions from all IP addresses.. The exhibit shows an AWS S3 bucket policy with a Deny effect for all S3 actions (s3:*) from any IP address (the condition block uses a NotIpAddress condition with the value 10.0.0.0/8, meaning the deny applies to all IPs that are NOT in that range). However, because the policy explicitly denies all actions for all IPs not in 10.0.0.0/8, and there is no corresponding Allow statement for the 10.0.0.0/8 range, the net effect is that all S3 actions are denied from all IP addresses, including those in 10.0.0.0/8. This is because AWS IAM policies default to implicit deny, and an explicit deny overrides any allow, so without an explicit allow for the 10.0.0.0/8 range, the deny applies universally.

Answer

Allows all S3 actions from the 10.0.0.0/8 range and denies from other IPs.

Answer

Denies all S3 actions except GetObject from the 10.0.0.0/8 range.

Answer

Allows GetObject requests from the 10.0.0.0/8 range and denies all other S3 actions.

Question 2

A security analyst is conducting a vulnerability assessment of a web application. The assessment reveals that the application is vulnerable to SQL injection. Which of the following is the MOST effective remediation?

Accepted Answer

Use parameterized queries in the application code. Parameterized queries (also known as prepared statements) are the most effective remediation for SQL injection because they separate SQL logic from user-supplied data by using placeholders. The database engine treats the input strictly as data, not executable code, which prevents an attacker from altering the query structure. This addresses the root cause at the application layer, unlike other controls that only mitigate or detect the attack.

Answer

Upgrade the web application framework to the latest version

Answer

Deploy a web application firewall (WAF)

Answer

Implement client-side input validation

Question 3

A vulnerability scan report shows a critical vulnerability on a web server with a CVSS score of 9.8. The IT manager wants to know the risk to the organization. Which of the following factors should the analyst consider FIRST?

Accepted Answer

The asset value and business criticality. The CVSS score of 9.8 indicates a critical severity vulnerability, but risk is a function of both severity and business context. The analyst must first assess the asset value and business criticality of the web server because a critical vulnerability on a non-essential server poses lower risk than the same vulnerability on a server handling sensitive data or core business processes. Without this context, the organization cannot prioritize remediation effectively.

Answer

The vendor's patch release schedule

Answer

The number of exploit attempts in the logs

Answer

The number of other vulnerabilities on the server

Question 4

During a penetration test, an analyst successfully exploits a privilege escalation vulnerability to gain root access on a Linux server. The server is used for application development. Which of the following remediation actions would be MOST effective in preventing similar attacks?

Accepted Answer

Apply the principle of least privilege to user accounts. The principle of least privilege ensures that users and processes have only the minimum permissions necessary to perform their tasks. By applying this to user accounts, the attack surface for privilege escalation is reduced because even if an account is compromised, the attacker cannot easily escalate to root. This directly addresses the root cause of the vulnerability exploited in the scenario.

Answer

Deploy a host intrusion detection system

Answer

Harden the kernel using sysctl parameters

Answer

Implement application whitelisting

Question 5

A hospital's IT department has been receiving reports from nursing staff that the electronic medical record (EMR) system is responding slowly during peak hours. The network team has verified that the local area network is operating normally and there is no bandwidth congestion. The security analyst reviews the firewall logs and observes repeated outbound connections from the EMR server to an external IP address 198.51.100.23 on TCP port 443 at regular 5-minute intervals. Each connection transfers a small amount of data. The analyst also notes that the EMR server's antivirus software is up to date and no malware has been detected. The hospital's security policy requires that all outbound connections from critical servers be explicitly approved. Further investigation reveals that 198.51.100.23 is associated with a hosting provider in a foreign country. The analyst suspects a data exfiltration. Which of the following actions should the analyst take FIRST?

Accepted Answer

Capture and analyze the network traffic between the EMR server and the external IP.. Option B is correct because the analyst must first confirm whether the outbound connections are actually exfiltrating data or are legitimate (e.g., software updates, license checks). Capturing and analyzing the network traffic (e.g., using tcpdump or Wireshark) allows the analyst to inspect the payload and determine the nature of the data being sent, which is a standard step in incident response before taking more disruptive actions.

Answer

Install a network-based intrusion detection system to monitor the server.

Answer

Isolate the EMR server from the network and run a full forensic analysis.

Answer

Block all outbound traffic from the EMR server to the internet immediately.

Question 6

A security analyst is configuring a vulnerability scan for a demilitarized zone (DMZ) containing public-facing web servers. The analyst wants to minimize the risk of causing a denial-of-service condition on the servers. Which of the following scan settings should be configured?

Accepted Answer

Limit the number of concurrent checks.. Limiting the number of concurrent checks (option D) reduces the simultaneous requests sent to the target servers, which prevents overwhelming the web server's connection pool or CPU. This is the most direct way to minimize the risk of a denial-of-service condition during a vulnerability scan, especially in a DMZ with public-facing servers that may have limited resources.

Answer

Enable a full port scan.

Answer

Disable safe checks to speed up the scan.

Answer

Increase the scan timeout values.

Question 7

The analyst sees this alert from a vulnerability scanner. What is the MOST immediate action?

Accepted Answer

Investigate if any exploit code exists. The correct answer is C because the most immediate action when a vulnerability scanner alert is received is to investigate whether any exploit code exists for the identified vulnerability. This determines the urgency and risk level: if exploit code is publicly available, the vulnerability is likely to be actively targeted, requiring rapid remediation. Without this investigation, the team cannot prioritize the response effectively, as the vulnerability may be theoretical or require complex exploitation.

Answer

Report the finding to management

Answer

Isolate web01 from the network

Answer

Upgrade web01 to version 2.3.4

Question 8

A security analyst reviews this S3 bucket policy. Which vulnerability is present?

Accepted Answer

Public read access to all objects. The S3 bucket policy grants public read access to all objects via the `Principal: "*"` and `Action: "s3:GetObject"` statement. This means any unauthenticated user on the internet can list and download objects in the bucket, exposing sensitive data. The vulnerability is explicitly public read access, not missing encryption or application-layer flaws.

Answer

Missing encryption

Answer

Cross-site scripting

Answer

Insecure direct object reference

Question 9

A large enterprise with a centralized SOC is responding to a suspected data exfiltration incident. The incident response plan designates the SOC manager as the primary point of contact for all communication. However, during the incident, the marketing department independently publishes a social media post acknowledging the incident, stating that customer data was not compromised, and that the company has everything under control. The SOC analyst discovers this post. The actual investigation is still ongoing, and it is unclear whether customer data was exfiltrated. The company has a strict communication policy that all external statements regarding security incidents must be approved by the incident commander. The marketing department was not aware of the ongoing investigation and acted based on incomplete information. The analyst must consider the potential legal and regulatory implications of the inaccurate statement. The incident commander is currently in a meeting with the CISO and is unavailable. What should the analyst do FIRST?

Accepted Answer

Report the unauthorized communication to the SOC manager and recommend updating the incident communication plan to require approval from the incident commander before any external communication.. Option A is correct because the SOC manager is designated as the primary point of contact for all communication per the incident response plan, and the analyst must first report the unauthorized communication to the SOC manager to ensure proper escalation and documentation. This aligns with the strict communication policy requiring incident commander approval for external statements, and it preserves the chain of command while the incident commander is unavailable. Reporting the breach of protocol allows the SOC manager to initiate corrective actions, such as updating the communication plan, without the analyst exceeding their authority or making unauthorized statements.

Answer

Inform the marketing department that their post was premature and potentially inaccurate, and ask them to remove it immediately.

Answer

Post a correction on the company's social media account to clarify that the investigation is ongoing.

Answer

Ignore the post because it helps maintain customer confidence.

Question 10

A mid-sized e-commerce company uses a multi-cloud environment with AWS and Azure. The vulnerability management team performs monthly authenticated scans using a commercial scanner. During the last scan, a critical remote code execution vulnerability (CVE-2023-XXXX) was identified on an EC2 instance running a legacy application. The application owner states that the instance cannot be patched immediately because the patch would break compatibility with a third-party API. The instance has direct internet access and handles PCI data. The CISO wants to reduce risk to an acceptable level within 48 hours. Which course of action should the analyst recommend?

Accepted Answer

Place the EC2 instance behind a web application firewall (WAF) and restrict inbound access to known IPs using security groups.. Option A is correct because placing the EC2 instance behind a WAF and restricting inbound access to known IPs via security groups provides immediate, compensating controls that reduce the attack surface for the critical RCE vulnerability. Since the instance cannot be patched within 48 hours, this network-layer isolation (WAF filtering malicious payloads, security groups limiting source IPs) aligns with the CISO's risk reduction requirement while maintaining business operations and PCI compliance.

Answer

Decommission the instance and remove the legacy application from service immediately.

Answer

Apply the vendor-recommended patch after testing in a dev environment within two weeks.

Answer

Disable TLS 1.0 and enable TLS 1.2 on the instance to reduce the attack surface.

Question 11

A security analyst is reviewing vulnerability scan results and sees a critical vulnerability on a web server with a CVSS score of 9.8. The server is a legacy system that cannot be patched without causing application downtime. The business requires the application to remain available. Which of the following is the BEST course of action?

Accepted Answer

Implement a virtual patch using a web application firewall.. Option D is correct because a virtual patch via a web application firewall (WAF) can inspect and block exploit attempts against the vulnerability without modifying the legacy server's code or binaries. This allows the business-critical application to remain available while mitigating the 9.8 CVSS risk at the network layer, typically using signature-based or behavioral rules to intercept malicious payloads targeting the flaw.

Answer

Remove the system from the network.

Answer

Disable the vulnerable service on the server.

Answer

Accept the risk and do nothing.

Question 12

A vulnerability management team uses OpenVAS to scan a network of 500 hosts weekly. The scans are causing network congestion and generating false positives. Which of the following would BEST reduce the impact while maintaining effective vulnerability detection?

Accepted Answer

Schedule scans during off-peak hours and limit concurrent scans.. Scheduling scans during off-peak hours and limiting concurrent scans directly reduces network congestion by shifting traffic to low-utilization periods and capping the number of simultaneous connections. This approach maintains the weekly scan frequency and full vulnerability coverage, unlike other options that degrade detection effectiveness.

Answer

Disable the vulnerable host discovery phase.

Answer

Increase the scan interval to monthly.

Answer

Use credential-based scanning to reduce false positives.

Question 13

A company wants to prioritize vulnerabilities based on exploitability and impact. Which industry standard framework should the analyst use?

Accepted Answer

CVSS v3. CVSS v3 (Common Vulnerability Scoring System) is the industry-standard framework for prioritizing vulnerabilities based on exploitability and impact. It provides a numerical score (0-10) derived from metrics such as Attack Vector, Attack Complexity, Privileges Required, User Interaction, and Scope, along with Confidentiality, Integrity, and Availability impact. This allows analysts to objectively rank vulnerabilities for remediation.

Answer

OWASP Top 10

Answer

CVE

Answer

NIST SP 800-53

Question 14

A security analyst is reviewing the results of a vulnerability scan. The scan identified several critical vulnerabilities on a web server that were previously reported three months ago. Which TWO actions should the analyst take to improve the vulnerability management process?

Accepted Answer

Increase the frequency of vulnerability scans from quarterly to monthly.. Option B is correct because increasing scan frequency from quarterly to monthly reduces the window of exposure for newly introduced vulnerabilities. Since the same critical vulnerabilities were present for three months, more frequent scanning ensures faster detection and remediation, aligning with continuous monitoring best practices in vulnerability management.

Answer

Exclude the web server from future scans to reduce the number of false positives.

Answer

Implement a policy to automatically close vulnerabilities after 90 days if no remediation action is taken.

Answer

Schedule the next scan to occur during peak business hours to capture real-world traffic.

Question 15

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Accepted Answer

Check the baseline behavior of the source IP. Option B is correct because the first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.

Answer

Immediately block the source IP at the firewall

Answer

Update the signature database

Answer

Isolate the affected system for forensic analysis

CS0-003 Practice Test 29 — 15 Questions

Exhibit

CS0-003 Practice Test 29 — 15 Questions

Exhibit