CS0-003 Practice Test 31 — 15 Questions

Question 1

An organization is implementing an incident response plan. Which phase of the NIST SP 800-61 lifecycle includes activities such as creating policies, establishing IR teams, and acquiring necessary tools?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preparation. Preparation involves all proactive measures to enable effective incident response, including policy, team, and tool readiness.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 2

A security analyst is configuring a compliance scan for a Linux server using CIS Benchmarks. The analyst must ensure the server meets Level 1 benchmarks. Which of the following is a characteristic of CIS Level 1 benchmarks?

Accepted Answer

They are practical and prudent, with a low impact on business functionality. Level 1 benchmarks are foundational and designed to have minimal impact on business operations while improving security.

Answer

They are only applicable to cloud environments

Answer

They provide specific STIG requirements for DoD systems

Answer

They are intended for high-security environments and may impact performance

Question 3

Which three of the following are best practices for integrating vulnerability scanning into a continuous integration/continuous deployment (CI/CD) pipeline? (Choose three.)

Accepted Answer

Embedding static application security testing (SAST) into the build phase to catch code-level vulnerabilities early. Embedding SAST into the build phase is a best practice because it allows developers to identify and fix code-level vulnerabilities (e.g., SQL injection, buffer overflows) early in the development lifecycle, reducing remediation cost and preventing insecure code from progressing further down the pipeline. This shift-left approach aligns with DevSecOps principles by catching flaws before they reach integration or production environments.

Answer

Scanning dependencies only when a new vulnerability disclosure is published

Answer

Disabling all vulnerability scanning during development to accelerate build times

Answer

Scanning only the production environment after deployment to ensure real-world security

Question 4

Which of the following vulnerability scanning tools is open source and commonly used for network vulnerability assessment?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Nessus

Answer

Qualys

Answer

Rapid7 InsightVM

Question 5

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request?

Accepted Answer

A software bill of materials. A Software Bill of Materials (SBOM) provides a formal, machine-readable inventory of all third-party and open-source components, libraries, and their versions used in a software product. In a regulated environment, this is essential for vulnerability management and compliance, as it enables the security team to quickly identify known vulnerabilities (e.g., CVEs) in specific library versions and prioritize remediation based on risk.

Answer

A DNS MX record report

Answer

A password complexity screenshot only

Answer

A building floor plan

Question 6

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. B is correct because SLA compliance by severity, asset owner, and business unit directly maps to the requirement of showing whether critical findings are fixed within policy timelines. This report filters by severity (e.g., critical), includes time-bound metrics (SLA compliance), and can be broken down by asset owner and business unit to demonstrate accountability and policy adherence. For legal/privacy stakeholders, this content provides auditable evidence of remediation timelines, which is essential for regulatory compliance and risk management.

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Answer

A report sorted only by scanner plugin ID

Question 7

In a regulated payment environment, an incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Specific playbook updates, escalation triggers, owners, and due dates. It addresses all three aspects implicitly. A post-incident review in a regulated payment environment must produce actionable improvements (specific playbook updates, escalation triggers, owners, due dates) to prevent recurrence and reduce dwell time. During eradication, the most defensible decision is to follow the updated playbook, ensuring actions are documented and repeatable. The action that reduces risk without losing evidence is to implement defined escalation triggers and owners, ensuring prompt containment while preserving forensic data—avoiding deletion or blame.

Answer

A generic statement that security is important

Answer

Deletion of all incident tickets

Answer

A blame list of individual analysts

Question 8

An organization's incident response playbook specifies that after a confirmed malware infection, the infected system should be isolated from the network. Which action best achieves isolation?

Accepted Answer

Disable the network interface card (NIC) via software.. Disabling the network interface card (NIC) via software immediately stops all network traffic to and from the infected system, effectively isolating it from the network while preserving the system's state for forensic analysis. This action aligns with the incident response playbook's requirement for network isolation without destroying volatile data or evidence.

Answer

Uninstall the operating system and reimage.

Answer

Pull the power cord from the infected system.

Answer

Delete the infected user's account.

Question 9

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. When a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance decision. This includes the risk owner (who accepted the risk), the reason for acceptance, any compensating controls in place, a review date to reassess the risk, and an expiry date for the acceptance. This aligns with risk management frameworks like NIST SP 800-37 and ISO 27005, which require traceability and accountability for accepted risks.

Answer

Only the analyst's personal opinion

Answer

No mention of the accepted risk

Answer

A permanent exception with no review

Question 10

A security analyst is prioritizing vulnerabilities from a scan. Which TWO factors should be considered to determine the remediation priority? (Select TWO)

Accepted Answer

Exploit code availability. Exploit code availability is a critical factor because if working exploit code is publicly available, the vulnerability is far more likely to be actively exploited, increasing the risk and urgency for remediation. This directly impacts the likelihood of a breach, making it a key priority driver beyond just the CVSS score.

Answer

Vendor patch availability

Answer

CVSS base score

Answer

Age of the vulnerability

Question 11

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. A failed alert integration represents a gap in detection capability that must be formally remediated. Assigning a named owner ensures accountability, a due date enforces timely resolution, acceptance criteria define what constitutes success, and a retest plan verifies that the fix works. Without these elements, the same failure could recur, leaving the SOC blind to future incidents.

Answer

No action because the incident is closed

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Question 12

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans rely on network-visible services and banners, which miss registry-level patch data, OS configuration details, and installed updates. Authenticated scans with least-privilege credentials (e.g., using WMI, WinRM, or the Windows Update API) provide deep visibility into missing patches by querying the actual patch database (e.g., via the Microsoft Update Catalog or WSUS). This directly addresses the security manager's suspicion of missing patch data, making option C the correct choice.

Answer

Increase only the port range

Answer

Trust the unauthenticated result as complete

Answer

Disable host firewalls permanently

Question 13

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as?

Accepted Answer

MFA fatigue or push-bombing attack. Repeated MFA prompts that the user eventually approves out of frustration or habit is the hallmark of MFA fatigue (also called push-bombing). The attacker sends a flood of push notifications to the user's device, hoping the user will mistakenly approve one to stop the annoyance. This bypasses the MFA control without needing to compromise the second factor.

Answer

Password spraying only

Answer

DNS tunnelling

Answer

SSL certificate expiry

Question 14

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. An SLA compliance report by severity, asset owner, and business unit directly maps to the requirement of showing whether critical findings are fixed within policy timelines. This report allows the vulnerability program to track remediation against defined service-level agreements (SLAs), and the breakdown by business unit and asset owner provides the business service owner with actionable, ownership-specific data to drive accountability and resource allocation.

Answer

A report sorted only by scanner plugin ID

Answer

A vendor price comparison

Answer

A list of all closed tickets with no dates

Question 15

During a security assessment, you discover that an organization's web application is vulnerable to SQL injection because it concatenates user input directly into SQL queries. Which of the following is the BEST remediation strategy?

Accepted Answer

Use parameterized queries or prepared statements.. Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders, ensuring that user input is always treated as data, not executable code. This directly prevents SQL injection by eliminating the ability to alter the query structure, regardless of the input content.

Answer

Encode all output data.

Answer

Deploy a web application firewall (WAF).

Answer

Implement input validation using a whitelist.