CS0-003 Practice Test 2 — 30 Questions

Question 1

During incident response, a team isolates a host but needs to preserve volatile evidence. What should be done first?

Accepted Answer

Capture a memory dump. When a host is isolated during incident response, the first priority is to capture volatile data before it is lost. A memory dump preserves the contents of RAM, which includes running processes, network connections, open files, and encryption keys. This data is critical for forensic analysis and disappears when the system is powered off. Disconnecting the network (option B) is important but should follow memory capture because network activity is part of the volatile state.

Answer

Disconnect from the network

Answer

Reimage the hard drive

Answer

Reboot the system

Question 2

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners require authenticated access to crawl and test pages behind login forms. By configuring authenticated scanning with a test account and session handling (e.g., using cookies or OAuth tokens), the scanner can traverse protected routes and detect vulnerabilities such as SQL injection or XSS on authenticated pages. This directly addresses the stated weakness without masking risk.

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Question 3

A vulnerability management team has identified a critical vulnerability with a CVSS score of 9.8. The vulnerability affects a public-facing web server that handles sensitive customer data. The team decides to apply a patch immediately without going through the normal patch testing cycle. What type of patching procedure is this?

Accepted Answer

Emergency patching. When a critical vulnerability is actively exploited or poses immediate risk, emergency patching procedures are used to expedite deployment without standard testing.

Answer

Rolling patch deployment

Answer

Patch compliance tracking

Answer

Standard patch management

Question 4

A security analyst reviews a Nessus scan result for a web server. The plugin output indicates a critical vulnerability with CVSS v3.1 base score 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack complexity?

Accepted Answer

Low. In the CVSS vector, AC:L means Attack Complexity is Low, indicating no special conditions are required for exploitation.

Answer

Critical

Answer

Medium

Answer

High

Question 5

During a threat hunting exercise, an analyst creates a hypothesis that a threat actor may be using scheduled tasks for persistence. Which Windows registry key or log source should the analyst examine to confirm the hypothesis?

Accepted Answer

Review the Windows Security Event Log for event ID 4698 (scheduled task creation). Scheduled tasks are stored in the Windows Task Scheduler and can be viewed via schtasks.exe, but the registry also contains persistence mechanisms. However, scheduled tasks are not primarily stored in the registry; they are in %SystemRoot%\Tasks. Alternatively, the analyst can use the Task Scheduler API. But among the options, examining the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule' is not standard. Actually, the correct answer is to examine the Task Scheduler logs or the tasks folder. However, the question specifies registry key or log source. The best answer is to review the Windows Security Event Log for event ID 4698 (scheduled task creation).

Answer

Check the Run registry keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run)

Answer

Examine the System event log for driver loading events

Answer

Analyze the application event log for error messages

Question 6

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires that data breaches be reported to the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Answer

24 hours

Answer

7 days

Answer

48 hours

Question 7

An analyst is using AWS GuardDuty and sees a finding that an EC2 instance is communicating with a known command-and-control (C2) IP address. What type of alert is this?

Accepted Answer

Threat intelligence finding. GuardDuty detects threats based on known malicious IPs, so communication with a C2 IP is a security finding indicating a potential compromise.

Answer

CASB alert investigation

Answer

Vulnerability scan result

Answer

Cloud audit log analysis

Question 8

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Correlating DNS query logs with endpoint process and network connection telemetry (Option D) provides direct evidence of command-and-control (C2) beaconing by linking the algorithmically generated domain (AGD) queries to a specific process initiating outbound connections. This cross-referencing validates whether the DNS activity is part of a malware's C2 channel, as legitimate applications rarely generate hundreds of NXDOMAIN responses at fixed intervals. The SOC analyst can confirm the detection by identifying the parent process (e.g., a suspicious executable) and matching its network connections to the queried domains.

Answer

Search only for successful HTTP 200 responses

Answer

Delete the host from the SIEM asset inventory

Answer

Block all DNS traffic from the subnet

Question 9

You are a senior incident responder for a large technology company. During a routine threat hunting exercise, you detect unusual network traffic from a Linux web server to an external IP address that is known to be associated with an advanced persistent threat (APT) group. The web server runs a custom PHP application and is not in the DMZ; instead, it's on the internal network serving a management dashboard. You have captured a memory dump of the web server and analyzed it with volatility. The output shows a suspicious process running with the name 'apache2' but with an invalid parent process (PID 1 is 'apache2' itself). Additionally, you find a kernel module loaded called 'hideproc.ko' that is not part of the standard kernel. The network connections show a reverse shell to the external IP. You need to determine the most effective containment and eradication strategy that minimizes data loss and maintains business continuity while preserving evidence for law enforcement involvement.

Accepted Answer

Isolate the web server from the network immediately, capture a full disk and memory image, then reimage the server from a trusted backup or OS image, and restore application data from a known clean backup.. The presence of a kernel rootkit ('hideproc.ko') and a reverse shell indicates deep, persistent compromise that cannot be cleaned by patching or scanning. Isolating the server preserves volatile evidence (memory, disk) for law enforcement, while reimaging from a trusted backup ensures complete removal of the attacker's foothold, minimizing data loss and restoring business continuity.

Answer

Revert the web server to a previous snapshot from before the suspected compromise date, then run a full antivirus scan on the restored system.

Answer

Perform a live forensic analysis of the PHP application logs and database to identify the specific vulnerability used, then apply a hotfix to the application code.

Answer

Block the external IP address at the firewall and block all outbound traffic from the web server except to specific internal IPs, then continue monitoring for other compromised hosts.

Question 10

A hospital's IT department has been receiving reports from nursing staff that the electronic medical record (EMR) system is responding slowly during peak hours. The network team has verified that the local area network is operating normally and there is no bandwidth congestion. The security analyst reviews the firewall logs and observes repeated outbound connections from the EMR server to an external IP address 198.51.100.23 on TCP port 443 at regular 5-minute intervals. Each connection transfers a small amount of data. The analyst also notes that the EMR server's antivirus software is up to date and no malware has been detected. The hospital's security policy requires that all outbound connections from critical servers be explicitly approved. Further investigation reveals that 198.51.100.23 is associated with a hosting provider in a foreign country. The analyst suspects a data exfiltration. Which of the following actions should the analyst take FIRST?

Accepted Answer

Capture and analyze the network traffic between the EMR server and the external IP.. The analyst must first confirm whether the outbound connections are actually exfiltrating data or are legitimate (e.g., software updates, license checks). Capturing and analyzing the network traffic (e.g., using tcpdump or Wireshark) allows the analyst to inspect the payload and determine the nature of the data being sent, which is a standard step in incident response before taking more disruptive actions.

Answer

Install a network-based intrusion detection system to monitor the server.

Answer

Isolate the EMR server from the network and run a full forensic analysis.

Answer

Block all outbound traffic from the EMR server to the internet immediately.

Question 11

A mid-sized e-commerce company uses a multi-cloud environment with AWS and Azure. The vulnerability management team performs monthly authenticated scans using a commercial scanner. During the last scan, a critical remote code execution vulnerability (CVE-2023-XXXX) was identified on an EC2 instance running a legacy application. The application owner states that the instance cannot be patched immediately because the patch would break compatibility with a third-party API. The instance has direct internet access and handles PCI data. The CISO wants to reduce risk to an acceptable level within 48 hours. Which course of action should the analyst recommend?

Accepted Answer

Place the EC2 instance behind a web application firewall (WAF) and restrict inbound access to known IPs using security groups.. Placing the EC2 instance behind a WAF and restricting inbound access to known IPs via security groups provides immediate, compensating controls that reduce the attack surface for the critical RCE vulnerability. Since the instance cannot be patched within 48 hours, this network-layer isolation (WAF filtering malicious payloads, security groups limiting source IPs) aligns with the CISO's risk reduction requirement while maintaining business operations and PCI compliance.

Answer

Decommission the instance and remove the legacy application from service immediately.

Answer

Apply the vendor-recommended patch after testing in a dev environment within two weeks.

Answer

Disable TLS 1.0 and enable TLS 1.2 on the instance to reduce the attack surface.

Question 12

A medium-sized company has experienced a ransomware attack that encrypted critical file servers. The incident response team has contained the outbreak and restored data from backups. The CISO has requested a post-incident report. The report must include a timeline, root cause analysis, lessons learned, and recommendations. The security team is currently overwhelmed with recovery tasks. The CISO wants the report delivered in 24 hours. Which of the following is the BEST course of action for the security analyst assigned to write the report?

Accepted Answer

Use the incident response playbook template to draft the report immediately, incorporating available information and noting gaps. The CISO needs a timely post-incident report within 24 hours, and using the incident response playbook template allows the analyst to immediately draft the report with available information while noting gaps. This approach balances the urgency of the deadline with the need for structured documentation, even though recovery tasks are ongoing. It ensures that critical findings are captured promptly without waiting for full recovery, which could delay lessons learned and recommendations.

Answer

Wait until all recovery tasks are complete to ensure accurate information

Answer

Delegate the report writing to a junior analyst while focusing on technical recovery

Answer

Request an extension from the CISO due to resource constraints

Question 13

During a penetration test, a tester successfully exploits a vulnerability in a web application and gains a shell on the backend server. The tester then attempts to pivot to other hosts. Which of the following security controls would be most effective in limiting lateral movement in this scenario?

Accepted Answer

Network segmentation with strict firewall rules. Network segmentation with strict firewall rules (C) is the most effective control because it directly restricts the ability of an attacker who has compromised one host to initiate connections to other hosts. By enforcing least-privilege network access between segments (e.g., using VLANs and ACLs), lateral movement techniques such as port scanning, SMB relay, or RDP brute force are blocked at the network layer, regardless of the attacker's shell access.

Answer

Host-based intrusion prevention system (HIPS)

Answer

Full disk encryption

Answer

Application whitelisting

Question 14

A vulnerability scanner reports that an internal web application is vulnerable to SQL injection. The development team says they fixed it by input sanitization. Which of the following should the analyst do FIRST?

Accepted Answer

Rescan the application to confirm remediation. The first step after a claimed fix is to verify the remediation by rescanning the application with the same vulnerability scanner. This provides objective evidence that the SQL injection vector is no longer exploitable, confirming the input sanitization was effective before any further actions are taken.

Answer

Update the vulnerability report

Answer

Perform a manual penetration test

Answer

Review the code changes

Question 15

A security operations center (SOC) analyst is investigating an alert from the endpoint detection and response (EDR) system indicating that a process named "svchost.exe" spawned from a parent process "cmd.exe" on a user workstation. The user is a software developer who frequently uses command-line tools. The analyst checks the command line arguments: "cmd.exe /c powershell -EncodedCommand ...". The encoded command decodes to a script that downloads a payload from a remote server and executes it. The analyst also sees that the workstation has established an outbound connection to the same server on port 443. Which of the following is the BEST immediate action?

Accepted Answer

Isolate the workstation from the network.. Isolating the workstation is the best immediate action because the EDR alert confirms active compromise: a malicious encoded PowerShell command executed via cmd.exe spawned svchost.exe (a process commonly abused for masquerading), and an outbound connection to the same C2 server on port 443 (HTTPS) indicates ongoing data exfiltration or further payload delivery. Network isolation stops all communication with the attacker while preserving forensic evidence on the endpoint, which is critical for containment in a SOC response.

Answer

Disable the user account.

Answer

Kill the svchost.exe process.

Answer

Block the remote server IP at the firewall.

Question 16

A security analyst is reviewing vulnerability scan results and sees a critical vulnerability on a web server with a CVSS score of 9.8. The server is a legacy system that cannot be patched without causing application downtime. The business requires the application to remain available. Which of the following is the BEST course of action?

Accepted Answer

Implement a virtual patch using a web application firewall.. A virtual patch via a web application firewall (WAF) can inspect and block exploit attempts against the vulnerability without modifying the legacy server's code or binaries. This allows the business-critical application to remain available while mitigating the 9.8 CVSS risk at the network layer, typically using signature-based or behavioral rules to intercept malicious payloads targeting the flaw.

Answer

Remove the system from the network.

Answer

Disable the vulnerable service on the server.

Answer

Accept the risk and do nothing.

Question 17

A security analyst discovers a server that is missing multiple critical patches. The server hosts a legacy application that cannot be patched immediately due to compatibility issues. Which of the following is the BEST approach to manage the vulnerability risk?

Accepted Answer

Implement network segmentation and increase monitoring. The best approach because network segmentation isolates the vulnerable legacy server from critical assets, reducing the attack surface, while increased monitoring allows the security team to detect and respond to any exploitation attempts in real time. This balances risk acceptance with active defense, which is a core principle of vulnerability management when patching is not immediately feasible.

Answer

Apply a virtual patch using a WAF

Answer

Disable the server until a patch is available

Answer

Remove the server from the network

Question 18

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Cloud audit logs for identity, policy, and key-management API calls. Cloud audit logs (e.g., AWS CloudTrail, Azure Activity Log) capture control-plane API calls such as IAM policy changes, key creation, and authentication failures. These logs directly record the identity and resource management actions that indicate a compromise of the cloud management plane, whereas endpoint or network telemetry only reflects data-plane activity and cannot see API-level administrative actions.

Answer

Endpoint antivirus quarantine reports only

Answer

Packet captures from user laptops only

Answer

Web server access logs from the public website

Question 19

During a ransomware attack, several workstations have been encrypted. The incident response team has identified the ransomware variant and determined it does not have a known decryption tool. Which containment strategy is MOST appropriate?

Accepted Answer

Disconnect the affected workstations from the network, but leave them powered on.. Disconnecting the affected workstations from the network (but leaving them powered on) preserves volatile evidence in memory (e.g., encryption keys, process artifacts) and prevents the ransomware from spreading to other hosts via SMB, RDP, or other lateral movement protocols. Powering off would destroy this critical forensic data, while leaving them connected risks further encryption of network shares.

Answer

Power off all affected workstations immediately.

Answer

Run a full antivirus scan on the affected workstations.

Answer

Restore all affected workstations from backups immediately.

Question 20

A security team is reviewing firewall logs and identifies traffic to a known malicious IP address from an internal workstation running a critical business application that cannot be interrupted. Which of the following is the most appropriate immediate action?

Accepted Answer

Add a firewall rule to block the malicious IP. Adding a firewall rule to block the malicious IP is the most appropriate immediate action because it stops the outbound traffic to the known malicious address without disrupting the critical business application running on the workstation. This approach maintains availability (a key CIA triad principle) while mitigating the threat at the network layer, which is faster and less invasive than host-level changes. It also preserves the workstation's state for potential forensic analysis.

Answer

Shut down the workstation

Answer

Disconnect the network cable

Answer

Run an antivirus scan