CS0-003 Practice Test 30 — 15 Questions

Question 1

A security analyst must present a risk assessment to the board of directors. Which approach is most effective for communicating technical risks?

Accepted Answer

Translate technical risk into business impact. Translating technical risks into business impact (e.g., financial, reputational) helps non-technical stakeholders understand and prioritize risks.

Answer

Focus solely on CVSS scores

Answer

Provide raw log data

Answer

Use technical jargon to demonstrate expertise

Question 2

A security analyst is hunting for signs of lateral movement in the network. Which THREE indicators are most consistent with lateral movement techniques?

Accepted Answer

An RDP connection from a domain controller to a workstation. Lateral movement often involves remote execution tools (PsExec), remote service creation, and suspicious RDP connections.

Answer

Unusual outbound DNS queries to known malicious domains

Answer

Multiple failed logins from a single workstation to many servers

Question 3

A cybersecurity analyst is preparing a report for the executive leadership team. Which type of report is most appropriate for communicating high-level security posture and risk to non-technical stakeholders?

Accepted Answer

Executive dashboard. Executive dashboards provide a high-level overview of security posture, using metrics and visualizations that are easily understood by non-technical stakeholders. Technical reports are too detailed.

Answer

Threat intelligence feed

Answer

Technical vulnerability report

Answer

Incident response playbook

Question 4

A security analyst is configuring a vulnerability scan using OpenVAS. The scan should identify missing patches on Windows servers. Which of the following scan types should the analyst select?

Accepted Answer

Credentialed scan. OpenVAS uses authenticated scans to check for missing patches. Unauthenticated scans only detect open ports and services. A credentialed scan with valid credentials allows checking patch levels.

Answer

Passive scan

Answer

Unauthenticated scan

Answer

Port scan

Question 5

During a threat hunt, an analyst uses osquery to query endpoints for processes that have spawned from Microsoft Word but have network connections. Which of the following TTPs does this technique most likely detect?

Accepted Answer

Spearphishing attachment leading to macro execution. Attackers often use macro-enabled documents to execute code, making Word spawn abnormal child processes like PowerShell or cmd.exe, which then connect outbound.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

Data exfiltration over DNS

Question 6

A vulnerability scan of a segmented OT network must avoid disrupting fragile devices. Which controls are appropriate? (Choose two.)

Accepted Answer

Use approved safe-check profiles or passive discovery where required. Safe-check profiles (e.g., Nessus 'safe checks' mode) disable active exploits and denial-of-service tests, while passive discovery (e.g., using NetFlow or SNMP traps) never sends packets to fragile OT devices. This prevents disruption to legacy PLCs, RTUs, or other industrial controllers that may crash under aggressive scanning.

Answer

Scan from random external hosts

Answer

Run aggressive exploit checks without approval

Question 7

During a vulnerability scan of internal hosts, a security analyst finds a critical vulnerability with a CVSS score of 9.8. The affected system is a legacy application that cannot be patched immediately. What should the analyst do next?

Accepted Answer

Apply compensating controls and document the risk. The analyst should document the finding and apply compensating controls, such as network segmentation or firewall rules, to mitigate risk until a patch can be applied.

Answer

Increase scan frequency to monitor the vulnerability

Answer

Mark the vulnerability as a false positive

Answer

Immediately shut down the system

Question 8

A security analyst is performing a vulnerability scan on an internal network. The analyst wants to ensure the scanner can identify vulnerabilities in applications that require authentication. Which TWO scan configurations should be used?

Accepted Answer

Agent-based scan. Credentialed scans allow the scanner to authenticate to systems and perform deeper checks, while authenticated scans (agent-based) can also provide access.

Answer

Scan with default credentials

Answer

Non-credentialed scan

Answer

External scan

Question 9

After a phishing simulation, the security team wants to report the results to management. Which metric is most appropriate to include in the report?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate measures the percentage of users who clicked a simulated phishing link, a key metric for security awareness.

Answer

Total number of employees

Answer

Number of phishing emails blocked at the gateway

Answer

Mean time to detect phishing emails

Question 10

During an incident, the SOC team identifies indicators of compromise (IoCs) that may affect partners. According to best practices, what should the analyst do first?

Accepted Answer

Follow the incident response communication plan. An incident response plan should define communication procedures; typically, the team should escalate internally to leadership who can authorize external notifications.

Answer

Wait until the incident is fully resolved

Answer

Post the IoCs on a public threat sharing platform

Answer

Directly notify all affected partners

Question 11

A threat hunter is creating a hypothesis based on recent threat intelligence about a new ransomware variant that uses scheduled tasks for persistence. Which of the following MITRE ATT&CK techniques should the hunter focus on?

Accepted Answer

T1053.005 - Scheduled Task. Scheduled tasks are a persistence technique (T1053.005) in the MITRE ATT&CK framework. The hunter should look for unusual scheduled tasks.

Answer

T1547.001 - Registry Run Keys / Startup Folder

Answer

T1071.001 - Web Protocols

Answer

T1059.001 - PowerShell

Question 12

Which of the following is the best example of a Key Performance Indicator (KPI) for patch management?

Accepted Answer

Patch SLA compliance percentage. Patch SLA compliance percentage measures how often patches are applied within the agreed timeline, a key performance indicator.

Answer

Mean time to detect vulnerabilities

Answer

Number of security incidents

Answer

Number of vulnerabilities discovered

Question 13

A security analyst is reviewing SIEM alerts and notices a high volume of alerts for a specific event ID that has been determined to be benign. Which action should the analyst take to reduce noise?

Accepted Answer

Create a suppression rule for that event ID. True positive alerts are genuine threats; false positives are benign. Tuning the SIEM to suppress known false positives reduces alert fatigue.

Answer

Increase the severity of the alert

Answer

Reclassify the alert as a true positive

Answer

Disable the SIEM correlation engine

Question 14

Which of the following is the correct order of volatility for digital evidence?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility: CPU registers and cache (most volatile), then RAM, then swap/page file, then disk, then network logs, then archived media (least volatile).

Answer

Swap, RAM, CPU registers, disk, logs

Answer

Disk, RAM, swap, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Question 15

Which tool would best allow a security analyst to capture and analyze packets in real time to investigate a network anomaly?

Accepted Answer

Wireshark. Wireshark is a network protocol analyzer that captures and inspects packets in real time, making it ideal for real-time traffic analysis.

Answer

Metasploit

Answer

Nmap

Answer

Nikto