CS0-003 Practice Test 29 — 15 Questions

Question 1

An organization uses MISP as its threat intelligence platform. After a security incident, the team wants to share IOCs with other trusted organizations. Which standard should they use to package and exchange the threat intelligence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is the standard for describing threat intelligence, and TAXII is the protocol for sharing it.

Answer

SNMP

Answer

NetFlow

Answer

SMTP

Question 2

A threat hunter is creating a hypothesis based on the MITRE ATT&CK framework. The hunter wants to detect adversaries using PowerShell to download files from remote servers. Which ATT&CK technique should the hunter focus on?

Accepted Answer

T1059.001 (PowerShell). T1059.001 is PowerShell, which is commonly used for file downloads. The hunter should create detection rules for PowerShell download cradles.

Answer

T1078 (Valid Accounts)

Answer

T1053.005 (Scheduled Task)

Answer

T1047 (WMI)

Question 3

An analyst uses Trivy to scan a container image in a CI/CD pipeline. The scan identifies a vulnerability in an open-source library included in the image. The library is not used by the application code. Which of the following actions should the analyst recommend?

Accepted Answer

Remove the unused library from the image. Unused components should be removed to reduce attack surface. Patching the library might be unnecessary if not used. Adding a WAF doesn't fix container image vulnerabilities. Accepting risk may be justified but removal is better.

Answer

Accept the risk because the library is not used

Answer

Add a web application firewall (WAF) to protect the container

Answer

Patch the library to the latest version

Question 4

An analyst is examining a disk image acquired from a compromised Linux server. The analyst needs to verify that the image is an exact bit-for-bit copy of the original drive. Which forensic sound procedure should the analyst perform?

Accepted Answer

Compare the hash of the image to the hash of the original drive.. Hash verification ensures the image matches the original by comparing cryptographic hashes (e.g., MD5, SHA-256) generated during acquisition.

Answer

Use a write blocker when acquiring the image.

Answer

Mount the image in read-only mode.

Answer

Analyze the image with a hex editor.

Question 5

A security analyst notices a high number of alerts from a new detection rule that triggers on 'any outbound connection to a known malicious IP'. After investigation, the analyst finds that the IP address is from a threat intelligence feed but the connections are actually from a legitimate security scanner that was recently deployed. How should the analyst handle this?

Accepted Answer

Add the scanner's IP to an allowlist in the rule. The alerts are false positives because the traffic is legitimate. The analyst should tune the rule to exclude the scanner's source IP addresses.

Answer

Disable the rule permanently

Answer

Report the scanner as compromised

Answer

Increase the severity of the rule

Question 6

During memory analysis of a compromised host, an analyst finds a process that appears to be 'svchost.exe' but with an unusual parent process (not 'services.exe'). The process also has injected code in its memory. What is the most likely explanation?

Accepted Answer

The svchost.exe is a hollowed process used for malicious purposes. Svchost.exe should always have services.exe as parent. A different parent suggests process hollowing where an attacker replaced the legitimate process memory.

Answer

The process is a legitimate svchost.exe but spawned by a different service

Answer

The process is a DLL injection into svchost.exe

Answer

The svchost.exe process is a false positive due to a known Windows bug

Question 7

A security analyst is reviewing logs from multiple sources to investigate a potential intrusion. Which log source would provide the most reliable evidence of successful authentication from an unusual location?

Accepted Answer

Authentication logs. Authentication logs record login events including source IP, timestamp, and success/failure status, making them the best source for identifying successful authentication from unusual locations.

Answer

Endpoint detection and response (EDR) logs

Answer

Firewall logs

Answer

DNS logs

Question 8

An analyst is investigating a suspected data breach. The analyst needs to identify which files were exfiltrated and preserve evidence. According to the order of volatility, which of the following should the analyst capture FIRST?

Accepted Answer

CPU registers and cache. Order of volatility prioritizes capturing volatile data first. CPU registers and cache are the most volatile, then RAM, swap, disk, etc.

Answer

Contents of the hard drive

Answer

Network connections and listening ports

Answer

System logs

Question 9

An analyst is reviewing NetFlow data and notices a large amount of data being transferred from an internal database server to an external IP address on port 443 during non-business hours. The database server is not expected to initiate outbound connections. Which type of activity is most likely occurring?

Accepted Answer

Data exfiltration. The data transfer is large, to an external IP, on an encrypted port, outside business hours, and from a server that shouldn't initiate outbound connections. This strongly suggests data exfiltration.

Answer

Domain generation algorithm (DGA)

Answer

Lateral movement

Answer

Normal backup activity

Question 10

A security analyst receives a threat intelligence report containing detailed Indicators of Compromise (IoCs) such as IP addresses, file hashes, and domain names. What is the MOST appropriate audience for distributing this type of report?

Accepted Answer

The Security Operations Center (SOC) team. Tactical intelligence, such as IoCs, is most useful for frontline technical teams like the SOC, who can use it to detect and block threats. Executives typically receive strategic intelligence.

Answer

External auditors

Answer

All employees in the organization

Answer

Senior executives and the board of directors

Question 11

A security analyst is reviewing a vulnerability scan of a Kubernetes cluster. The scan reports that a container is running with privileged mode enabled. Which CIS Kubernetes Benchmark recommendation does this violation relate to?

Accepted Answer

Ensure that containers are not running with privileged access. The CIS Kubernetes Benchmark includes a recommendation to avoid running containers with privileged access, as it increases security risks. This is a common misconfiguration.

Answer

Ensure that the cluster-admin role is not used

Answer

Ensure that the API server is not exposed to the internet

Answer

Ensure that etcd is configured with TLS

Question 12

A vulnerability management analyst is reviewing scan results from a recent Nessus scan. The analyst notices a plugin with the output: 'The remote host is missing a security patch for CVE-2023-1234. The patch was released by the vendor on 2023-05-01.' Which phase of the vulnerability lifecycle is the analyst currently performing?

Accepted Answer

Discovery. The analyst is reviewing scan results to identify vulnerabilities, which is the discovery phase of the vulnerability lifecycle.

Answer

Prioritization

Answer

Remediation

Answer

Verification

Question 13

During the detection and analysis phase of an incident, an analyst identifies a file with a hash that matches a known malware signature. The analyst wants to enrich this IOC with additional context. Which resource is BEST suited for this enrichment?

Accepted Answer

VirusTotal. VirusTotal aggregates antivirus scan results and provides additional context such as file metadata, behavior, and community comments.

Answer

Shodan

Answer

WHOIS lookup

Answer

Passive DNS

Question 14

A vulnerability scan report shows a critical vulnerability on a web server. The server is behind a WAF that blocks the relevant exploit payloads. According to the organization's risk management policy, what should the analyst do?

Accepted Answer

Accept the risk and document the compensating control. Compensating controls like a WAF can justify accepting the risk rather than immediately patching if it would cause downtime.

Answer

Remove the WAF to allow the vulnerability to be exploited

Answer

Immediately patch the server

Answer

Mark the vulnerability as a false positive

Question 15

During a threat hunting exercise, the hunter creates a hypothesis based on recent threat intelligence about a new ransomware variant that uses scheduled tasks for persistence. Which ATT&CK technique should the hunter focus on?

Accepted Answer

T1053.005 (Scheduled Task). Scheduled tasks are a persistence technique (T1053.005). The hunter should focus on the persistence tactic and the specific technique for scheduled tasks.

Answer

T1566.001 (Spearphishing Attachment)

Answer

T1059.001 (PowerShell)

Answer

T1547.001 (Registry Run Keys)