CS0-003 Practice Test 3 — 10 Questions

Question 1

An analyst is reviewing a packet capture and observes a series of TCP SYN packets sent to a server, each followed by a SYN-ACK from the server, but no ACK from the client. The source IP is spoofed. What type of attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP SYN flood attack. The scenario describes a TCP SYN flood attack, where an attacker sends a series of TCP SYN packets with spoofed source IPs to a server. The server responds with SYN-ACK to the spoofed IP, but the client never sends the final ACK, leaving half-open connections that exhaust the server's connection table. This is a classic denial-of-service attack.

Answer

Man-in-the-middle attack

Answer

DNS amplification attack

Answer

TCP reset attack

Question 2

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Accepted Answer

Check the baseline behavior of the source IP. The first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.

Answer

Immediately block the source IP at the firewall

Answer

Update the signature database

Answer

Isolate the affected system for forensic analysis

Question 3

A security analyst is reviewing a NetFlow record that shows a large amount of data being transferred from an internal server to an external IP address on port 443 during non-business hours. Which type of activity should the analyst suspect?

Accepted Answer

Data exfiltration. Data exfiltration is correct because the pattern — a large volume of data transferred from an internal server to an external IP on port 443 during non-business hours — matches the classic signature of data exfiltration. Port 443 (HTTPS) is commonly used to blend in with normal encrypted web traffic, and off-hours timing plus high volume to an external destination indicates unauthorized data transfer.

Answer

Denial-of-service attack

Answer

Port scanning

Answer

Normal backup operation

Question 4

During the preparation phase of the NIST SP 800-61 incident response lifecycle, a security analyst is tasked with ensuring the team has the necessary tools and resources. Which of the following is the MOST important activity to perform during this phase?

Accepted Answer

Developing and testing incident response playbooks. In the NIST SP 800-61 preparation phase, the most important activity is establishing the capability to respond before an incident occurs, which centers on developing, documenting, and testing incident response playbooks. Playbooks codify roles, communication paths, and step-by-step procedures so the team can act consistently under pressure. Testing them (tabletop exercises, simulations) validates that tools, contacts, and escalation paths actually work.

Answer

Sharing indicators of compromise with threat intel platforms

Answer

Conducting root cause analysis of past incidents

Answer

Analyzing malware samples in a sandbox

Question 5

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies an alert indicating a high volume of outbound traffic from a critical server to an unknown IP address. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Correlate the alert with firewall logs and other security tools.. In the NIST SP 800-61 Detection and Analysis phase, the analyst's first priority is to validate and understand the alert before taking disruptive action. Correlating the alert with firewall logs and other security tools confirms whether the outbound traffic is truly malicious, identifies the destination, and establishes scope — this is the analysis step that precedes containment. Acting on an unverified alert risks unnecessary downtime and destroys evidence needed for the investigation.

Answer

Notify law enforcement immediately.

Answer

Isolate the server from the network to prevent data exfiltration.

Answer

Rebuild the server from a known good backup.

Question 6

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for a recent breach was 14 days, while the mean time to respond (MTTR) was 6 hours. Which metric should the team prioritize to improve in future incidents?

Accepted Answer

Mean time to detect (MTTD). With MTTD at 14 days and MTTR at only 6 hours, detection is clearly the bottleneck — attackers had nearly two weeks of dwell time before anyone noticed. Improving MTTD (via better logging, EDR tuning, threat hunting, or SIEM correlation) will reduce attacker dwell time and blast radius far more than shaving hours off an already-fast response.

Answer

Percentage of incidents containing malware

Answer

Number of incidents per week

Answer

Mean time to respond (MTTR)

Question 7

An analyst detects a process named 'powershell.exe' executing a base64-encoded command. Which type of analysis is most appropriate to decode and understand the command?

Accepted Answer

Process analysis. Process analysis is the most appropriate because it focuses on the live execution context of a running process, including its command-line arguments, loaded modules, and parent-child relationships. In this case, the base64-encoded command is part of the process's command line, which can be decoded to reveal the actual PowerShell script or commands being executed. Tools like Process Explorer, Process Monitor, or PowerShell's own logging (e.g., Script Block Logging) can capture and decode this information. This directly addresses the need to understand what the process is doing.

Answer

Memory analysis

Answer

Registry analysis

Answer

Network traffic analysis

Question 8

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch is intended to fix a remote code execution vulnerability in a widely used application. What is the MOST important step before deploying to production?

Accepted Answer

Perform regression testing to ensure no breakage. Regression testing is the most important step because a patch that fixes a remote code execution vulnerability can still introduce functional regressions or break dependent applications in production. Testing in staging validates that the patch resolves the vulnerability without breaking existing functionality, integrations, or workflows. This aligns with change management best practices where validation precedes production deployment.

Answer

Check the patch's CVSS score

Answer

Verify the patch's digital signature

Answer

Automatically deploy to all production servers immediately

Question 9

Which of the following tools is specifically designed for compliance scanning against security benchmarks on Linux systems?

Accepted Answer

Lynis. Lynis is an open-source security auditing tool specifically designed for Linux systems, performing compliance scans against benchmarks like CIS, HIPAA, and PCI-DSS. It checks system hardening, kernel parameters, file permissions, and installed software. OpenVAS, Nessus, and Qualys are general vulnerability scanners, not Linux-specific compliance benchmark tools.

Answer

OpenVAS

Answer

Nessus

Answer

Qualys

Question 10

A security analyst is investigating a potential DNS tunneling attack. Which of the following patterns in DNS logs would most likely indicate such activity?

Accepted Answer

Unusually long subdomain names with high query frequency to a single domain. DNS tunneling exfiltrates data or establishes command-and-control by encoding payloads into DNS query names, typically subdomains of an attacker-controlled domain. This produces unusually long subdomain labels (often near the 63-character label limit or 253-character FQDN limit) combined with high query volume to a single domain, because each query carries a chunk of encoded data. Option B captures both the encoding artifact (long names) and the beaconing pattern (high frequency to one domain) that together are the hallmark of tunneling tools like iodine, dnscat2, or DNSExfiltrator.

Answer

A high number of NXDOMAIN responses

Answer

Consistent query intervals to a known legitimate domain

Answer

Queries to domains that are less than 24 hours old