CS0-003 Practice Test 2 — 30 Questions

Question 1

A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol for exchanging that intelligence over HTTPS. Together, they provide a standardized format and transport mechanism for sharing threat intel between organizations, as required by the question.

Answer

REST

Answer

SOAP

Answer

SNMP

Question 2

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Answer

Give all users local admin rights

Question 3

A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?

Accepted Answer

Scope is changed, high impact on confidentiality only. The CVSS v3.1 vector AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N indicates Scope is Changed (S:C) and Confidentiality impact is High (C:H), while Integrity (I:N) and Availability (A:N) impacts are None. Therefore, the correct description is scope changed with high impact on confidentiality only. The other options misstate either the scope or the impacted security property.

Answer

Scope is unchanged, high impact on confidentiality only

Answer

Scope is changed, high impact on integrity only

Answer

Scope is unchanged, high impact on confidentiality and integrity

Question 4

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic threat intelligence focuses on high-level, long-term trends, adversary motivations, and geopolitical or business risks — exactly what senior executives need for decision-making and risk budgeting. It is typically delivered as reports or briefings rather than raw indicators, and it informs strategic planning over quarters or years. Technical, tactical, and operational intelligence are all more granular and operational in nature.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence

Question 5

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module specifically designed to acquire volatile memory from Linux systems in a forensically sound manner. It captures RAM contents and outputs them in formats like raw or lime, which can then be analyzed with tools such as Volatility. This makes it the correct answer for Linux memory acquisition.

Answer

dd

Answer

FTK Imager

Answer

WinPmem

Question 6

An organization needs to report a data breach involving personal data of EU residents. Under GDPR, what is the maximum time allowed for notifying the supervisory authority after becoming aware of the breach?

Accepted Answer

72 hours. GDPR Article 33 mandates that a controller notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is the maximum; earlier notification is encouraged. If notification is not made within 72 hours, it must be accompanied by reasons for the delay.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 7

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Accepted Answer

Lessons learned and recommendations. An after-action report exists to drive improvement, so the component that directly prevents recurrence is the lessons learned and recommendations section, which translates findings into concrete process, tooling, or training changes. While timeline, impact, and root cause feed into it, only lessons learned and recommendations prescribe the corrective actions that stop the same phishing incident from succeeding again.

Answer

Timeline of the incident

Answer

Impact assessment

Answer

Root cause analysis

Question 8

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Accepted Answer

Explain the potential financial loss and reputational damage.. When communicating risk to a board of directors, the most effective approach is to translate the technical vulnerability into business impact—potential financial loss, regulatory fines, and reputational damage—because executives prioritize strategic and financial consequences over technical detail. This framing enables informed risk acceptance or remediation decisions at the governance level. CVSS scores and technical descriptions, while useful to security teams, do not resonate with non-technical leadership.

Answer

Show the CVSS score and exploit complexity.

Answer

Recommend immediate patching without details.

Answer

Describe the vulnerability in technical terms.

Question 9

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. Under GDPR Article 33, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a core GDPR compliance requirement. The other timeframes do not match the regulation.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 10

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Benchmarks define Level 1 as essential, basic security settings that can be applied broadly with minimal impact on functionality or performance, making them suitable as a universal baseline. Level 2 settings are defense-in-depth measures intended for high-security environments; they are more restrictive and may degrade performance or break usability (e.g., disabling legacy protocols or enforcing strict password policies). The question's goal of a baseline posture maps directly to Level 1.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.

Question 11

Which of the following is the FIRST step in the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation. NIST SP 800-61 Rev. 2 defines the incident response lifecycle as four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation is the first phase because it establishes the CSIRT, tools, communications plans, and playbooks before any incident occurs. Without preparation, later phases cannot be executed effectively.

Answer

Detection and Analysis

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 12

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Accepted Answer

Financial impact. Business risk communication should focus on financial impact, reputational impact, and regulatory penalties as these resonate with business leaders. Technical impact is too detailed.

Answer

Operational impact

Answer

Technical impact

Question 13

A security analyst is investigating a potential data breach. The analyst needs to preserve evidence before containment. Which of the following actions is MOST appropriate at this stage?

Accepted Answer

Creating a forensic image of the hard drive. Creating a forensic image of the hard drive is the most appropriate action to preserve evidence before containment. A forensic image is a bit-for-bit copy of the storage media that captures the system state, including deleted files, memory remnants, and metadata, without altering the original. This preserves the integrity of evidence for later analysis and legal proceedings. Powering off, blocking IPs, or disabling accounts are containment actions that can destroy volatile evidence and should be done after imaging.

Answer

Powering off the system

Answer

Blocking the attacker's IP at the firewall

Answer

Disabling the user's account

Question 14

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. The detection of a user authenticating from geographically distant locations within 12 minutes strongly suggests credential theft or token replay, and the subsequent mailbox forwarding rule creation indicates a data exfiltration attempt. The analyst must first correlate sign-in logs (to verify the source IPs and timestamps), MFA results (to check if MFA was satisfied or bypassed), device details (to identify if a known or managed device was used), and mailbox audit events (to confirm who created the forwarding rule and when). This combination directly validates or refutes the UEBA alert by providing the evidence needed to distinguish between a legitimate user with a VPN or a compromised account.

Answer

Only the user's browser cache

Answer

Only DHCP logs from the London office

Answer

The organisation's public DNS zone file

Question 15

During an incident response, the team identifies that a workstation was compromised via a phishing email. Which of the following should be performed immediately after containment?

Accepted Answer

Eradicate the malware from the workstation.. Immediately after containment, the priority is to eradicate the malware from the workstation to prevent reinfection or lateral movement. Containment isolates the system, but eradication removes the malicious artifacts (e.g., registry keys, scheduled tasks, or malicious binaries) to ensure the system is clean before recovery. This step aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment to eliminate the threat's foothold.

Answer

Notify law enforcement about the phishing campaign.

Answer

Collect forensic evidence from the workstation.

Answer

Conduct a root cause analysis of the phishing email.

Question 16

Refer to the exhibit. The output is from a Linux system running `netstat -an`. Which of the following ports is likely being used for remote command-and-control communication?

Accepted Answer

54321. Port 54321 is a high-numbered ephemeral port that is not associated with any standard service, making it a common choice for malware or remote access tools (RATs) to establish command-and-control (C2) communication. In the netstat -an output, an established connection on a non-standard high port from the local system to a remote IP is a strong indicator of C2 activity, as legitimate services typically use well-known ports.

Answer

22

Answer

53

Answer

80

Question 17

An organization uses MISP (Malware Information Sharing Platform) to share threat intelligence with trusted partners. Which of the following standards is commonly used by MISP to structure and exchange threat intelligence data?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Answer

NetFlow

Answer

SNMP

Answer

Syslog

Question 18

A security analyst notices that a system is sending a large amount of data to an external IP address via DNS tunneling. Which containment technique is most appropriate?

Accepted Answer

Disconnect the system from the network. Disconnecting the system from the network (Option B) is the most appropriate containment technique because it immediately stops all data exfiltration, including DNS tunneling traffic, without relying on any other network component. DNS tunneling works by encoding data within DNS queries and responses, so simply changing DNS server settings or blocking the external IP may not stop the attack if the malware uses fallback resolvers or rotates IPs. Disconnecting the system ensures the threat is isolated at the host level, preventing further data loss while preserving forensic evidence.

Answer

Change the DNS server settings

Answer

Block the external IP at the firewall

Answer

Disable the DNS service on the system

Question 19

A company wants to automate the deployment of security patches to endpoints. Which of the following tools would BEST support this requirement?

Accepted Answer

Enterprise patch management tool. An enterprise patch management tool (e.g., Microsoft WSUS, SCCM, or Ivanti) is specifically designed to automate the deployment, scheduling, and reporting of security patches across endpoints. It directly addresses the requirement by pushing patches to systems based on policy, ensuring compliance, and reducing manual effort.

Answer

Vulnerability scanner

Answer

Configuration management tool

Answer

Security information and event management (SIEM) system

Question 20

During forensic acquisition, which of the following types of data is considered the MOST volatile?

Accepted Answer

RAM.. RAM (Random Access Memory) is the most volatile data because it loses its contents immediately when power is removed. In forensic acquisition, the order of volatility dictates that RAM must be captured first, as it contains running processes, open network connections, and decrypted data that cannot be recovered from disk. Network connections, while volatile, are a subset of the data stored in RAM and are less critical to capture first.

Answer

Network connections.

Answer

Disk.

Answer

Page file.