CS0-003 Practice Test 30 — 15 Questions

Question 1

A company uses a SIEM platform that ingests logs from various sources. The SOC team receives an alert for a high number of failed login attempts (over 100 in 5 minutes) on the domain controller from a single IP address. The analyst investigates and finds that the failed attempts are for multiple different usernames, including some disabled accounts. The source IP is traced to an external VPN service. The analyst also notices that a few accounts had successful logins from the same IP after the failed attempts. Which of the following is the MOST likely attack type?

Accepted Answer

Password spraying.. The attack involves a single external IP attempting logins with multiple different usernames (including disabled accounts) and eventually succeeding on a few. This is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid triggering account lockout policies. The use of an external VPN service indicates the attacker is anonymizing their origin, and the successful logins after failures confirm the attack's objective.

Answer

Brute-force attack.

Answer

Kerberoasting.

Answer

Pass-the-hash.

Question 2

A security operations center (SOC) analyst is investigating an alert from the endpoint detection and response (EDR) system indicating that a process named "svchost.exe" spawned from a parent process "cmd.exe" on a user workstation. The user is a software developer who frequently uses command-line tools. The analyst checks the command line arguments: "cmd.exe /c powershell -EncodedCommand ...". The encoded command decodes to a script that downloads a payload from a remote server and executes it. The analyst also sees that the workstation has established an outbound connection to the same server on port 443. Which of the following is the BEST immediate action?

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation is the best immediate action because the EDR alert confirms active compromise: a malicious encoded PowerShell command executed via cmd.exe spawned svchost.exe (a process commonly abused for masquerading), and an outbound connection to the same C2 server on port 443 (HTTPS) indicates ongoing data exfiltration or further payload delivery. Network isolation stops all communication with the attacker while preserving forensic evidence on the endpoint, which is critical for containment in a SOC response.

Answer

Disable the user account.

Answer

Kill the svchost.exe process.

Answer

Block the remote server IP at the firewall.

Question 3

An incident responder is collecting evidence from a compromised Linux server. The server is still running. Which order of collection adheres to the order of volatility?

Accepted Answer

Memory → network connections → swap space → disk.. Option C is correct because the order of volatility (OOV) dictates that the most volatile data (memory/registers) must be collected first, followed by network connections, then swap space, and finally disk. Memory contains running processes and encryption keys that vanish on power loss; network connections change rapidly; swap space persists longer but is still more volatile than disk. This sequence ensures maximum preservation of ephemeral evidence before it is lost.

Answer

Memory → network connections → disk → swap space.

Answer

Disk → memory → network connections → swap space.

Answer

Network connections → memory → disk → swap space.

Question 4

After a data breach involving customer PII, the incident response team has contained the incident and eradicated the malware. What is the NEXT step in the remediation process?

Accepted Answer

Close the vulnerability that was exploited.. Option D is correct because closing the vulnerability prevents recurrence. Root cause analysis is part of post-incident, customer notification is legal/compliance, and system restoration is part of recovery.

Answer

Restore systems from clean backups.

Answer

Conduct a root cause analysis.

Answer

Notify all affected customers.

Question 5

A large e-commerce site is under a DDoS attack targeting its web servers. The incident response team is activated. Which goal should receive the HIGHEST priority during the response?

Accepted Answer

Maintain availability of the service.. During a DDoS attack targeting web servers, the highest priority is maintaining availability of the service because the primary goal of incident response in this scenario is to preserve business continuity and minimize disruption to legitimate users. The incident response team must first focus on mitigating the attack (e.g., rate-limiting, blackholing traffic, or scaling resources) before any forensic or attribution steps, as service downtime directly impacts revenue and customer trust.

Answer

Implement attribution.

Answer

Identify the attacker's identity.

Answer

Quantify the financial loss.

Question 6

During a phishing investigation, an employee reports clicking a link and entering credentials. Which of the following should be the first step?

Accepted Answer

Reset the employee's password. The immediate priority after credential compromise is to secure the account and prevent unauthorized access. Resetting the employee's password (Option D) invalidates the stolen credentials, stopping the attacker from using them to log in. This aligns with the NIST Incident Response Framework's containment phase, which must occur before any remediation or analysis steps.

Answer

Conduct user awareness training

Answer

Block the phishing domain

Answer

Analyze the email headers

Question 7

Refer to the exhibit. A security auditor finds this IAM policy attached to a user account. Which of the following describes the primary security concern?

Accepted Answer

The policy allows all S3 actions, which can lead to data exposure. Option B is correct because the policy allows all S3 actions on all resources (s3:* on Resource "*"), which means the user can read, write, delete, and modify any S3 bucket. This extreme level of access can lead to data exposure or deletion. The wildcard resource (C) is part of the problem but the combination of all actions is the core issue.

Answer

The policy is missing a NotAction element

Answer

The policy allows read-only access

Answer

The policy uses a wildcard resource

Question 8

Which TWO of the following are key phases of the incident response process as defined by NIST?

Accepted Answer

Preparation. The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four key phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Option C (Preparation) is correct because it is the foundational phase where policies, tools (e.g., SIEM, EDR), and communication plans are established before any incident occurs. Option E (Post-Incident Activity) is correct because it includes lessons learned, evidence retention, and report generation to improve future response efforts.

Answer

Recovery

Answer

Containment

Answer

Eradication

Question 9

The SOC receives an alert from a network sensor showing an internal host communicating with a known malicious IP over HTTPS. The analyst cannot find any process making outbound connections on the host. What should the analyst do next?

Accepted Answer

Check for hidden processes or rootkits using specialized tools. Option D is correct because the absence of a visible process suggests the presence of a rootkit or hidden process that requires deep analysis. Other options may be premature or incomplete.

Answer

Capture a memory dump of the host

Answer

Block the IP at the firewall

Answer

Reimage the host immediately

Question 10

A company's incident response team is handling a ransomware incident that has encrypted all files on the file server and spread to several workstations. The team has isolated the affected systems and obtained memory dumps and disk images. The CEO demands immediate restoration of operations and suggests paying the ransom to decrypt files quickly. The company has recent backups but they are stored on a network share that was also encrypted. The CISO wants to ensure that the root cause is identified before restoration. As the lead incident responder, which of the following actions should you take NEXT?

Accepted Answer

Analyze the memory dumps to identify the infection vector and check for persistence mechanisms. Option C is correct because analyzing the memory dumps will help identify the initial infection vector (e.g., phishing email, exploited vulnerability) and any persistence mechanisms. This information is critical to prevent reinfection after restoration. Options A and D skip root cause analysis, risking reinfection. Option B is ill-advised and may not work.

Answer

Pay the ransom and then restore from the decrypted files

Answer

Restore the backups to a clean environment and then reimage the affected systems

Answer

Immediately reimage all affected systems and restore from the most recent clean backups

Question 11

During a post-incident review, the team finds that the detection was delayed by 4 hours because the SIEM rule had a low priority and was not monitored after hours. Which improvement is most effective?

Accepted Answer

Implement 24/7 SOC operations. Option B is correct because implementing 24/7 SOC coverage directly addresses the lack of after-hours monitoring. Other options do not resolve the root cause of off-hours detection gaps.

Answer

Increase the priority of the rule

Answer

Add automated response actions to the rule

Answer

Include the rule in a watchlist

Question 12

A company's IDS generated an alert for a SQL injection attempt against a web server. The web application firewall (WAF) is already in place. What is the best action?

Accepted Answer

Verify if the attack succeeded by checking server logs. Option B is correct because the first step is to verify whether the attack succeeded by checking the server logs. Premature blocking or shutdown may be unnecessary.

Answer

Update the WAF rules

Answer

Block the source IP at the firewall

Answer

Shut down the web server

Question 13

After a risk assessment, a security analyst recommends accepting a low-risk finding. The system owner disagrees. Which communication strategy should the analyst use?

Accepted Answer

Present the risk assessment data and cost-benefit analysis to justify acceptance. Option C is correct because the security analyst should use data-driven communication to resolve disagreements over risk acceptance. By presenting the risk assessment data and a cost-benefit analysis, the analyst provides objective evidence that the low-risk finding does not warrant mitigation, aligning with the NIST risk management framework's emphasis on informed decision-making. This approach respects the system owner's concerns while justifying the acceptance based on technical and business rationale.

Answer

Escalate the disagreement to the CISO immediately

Answer

Agree with the system owner and change the recommendation

Answer

Insist that the finding must be mitigated due to policy

Question 14

A security analyst needs to present vulnerability scan results to a non-technical manager. Which of the following is MOST important to include?

Accepted Answer

Summary of critical vulnerabilities with associated business risk and recommended actions. Option D is correct because risk prioritization helps managers allocate resources. Options A, B, C are too technical or lack context.

Answer

Raw scan output with IP addresses and ports

Answer

Detailed exploit code for critical vulnerabilities

Answer

List of all CVSS scores with no further explanation

Question 15

During a post-incident review, the team identifies that the incident response plan was not followed correctly due to unclear communication channels. Which recommendation BEST addresses this issue?

Accepted Answer

Update the incident response plan to define specific communication channels and escalation paths. Option A is correct because the root cause identified in the post-incident review is unclear communication channels, which directly violates the communication and escalation procedures defined in the incident response plan. Updating the plan to specify exact communication channels (e.g., dedicated Slack channel, email distribution list, or phone tree) and escalation paths (e.g., tier-1 analyst → SOC manager → CISO) ensures that all team members know how and when to communicate during an incident, preventing delays and miscoordination.

Answer

Implement multi-factor authentication for all accounts

Answer

Replace the current SIEM tool with a faster one

Answer

Conduct more frequent vulnerability scans