CS0-003 Practice Test 31 — 15 Questions

Question 1

A security analyst reviews the above bucket policy. Which of the following BEST describes the risk associated with this policy?

Accepted Answer

The bucket is publicly readable, potentially exposing sensitive data. Option A is correct because the policy allows any anonymous user to read objects. Option B is wrong because it's a GET, not PUT. C is wrong because the policy does not require authentication. D is wrong because encryption is not addressed.

Answer

The bucket allows anyone to upload malicious files

Answer

The bucket enforces encryption in transit

Answer

The bucket requires authentication for access

Question 2

A small business with 50 employees has been hit by ransomware. All files on the file server and local workstations are encrypted, and the ransom note demands $5,000 in Bitcoin for the decryption key. The CEO is panicking and wants to know the impact on operations and how to proceed. The security analyst has been tasked with preparing a report for the CEO. The company does not have cyber insurance, has minimal IT staff, and relies heavily on email and shared drives for daily operations. The analyst has identified that there is a one-week-old backup but is unsure of its integrity. The analyst must consider that the CEO has limited technical knowledge and that the report will form the basis for critical business decisions. The company's reputation and customer trust are at stake. The analyst must balance transparency with clear, actionable guidance. Which of the following is the BEST approach for the analyst to take in communicating with the CEO?

Accepted Answer

Summarize the situation in non-technical terms, explain the business impact (e.g., inability to access customer data, potential revenue loss), outline recovery options (e.g., restore from backups or pay ransom with risks), and recommend immediate steps.. Summarizing business impact and recovery options in non-technical terms is best for the CEO to make informed decisions.

Answer

Provide a detailed technical timeline of the ransomware infection, including the malware variant and encryption algorithm used.

Answer

Tell the CEO that the incident is being handled and not to worry, then proceed with recovery without further updates.

Answer

Immediately contact law enforcement and advise the CEO to wait for their instructions without providing additional information.

Question 3

An analyst runs a command to check active network connections on a Linux host and sees many ESTABLISHED connections to an external IP on port 443. Which command was most likely used?

Accepted Answer

netstat -anp. The `netstat -anp` command displays all active network connections (`-a`), shows numeric addresses and port numbers (`-n`), and includes the process ID and program name (`-p`). This makes it the correct tool for an analyst to quickly identify established TCP connections to an external IP on port 443, as it directly lists the state (ESTABLISHED), remote address, and associated process.

Answer

ipconfig /all

Answer

nmap -sT

Answer

tcpdump -i eth0

Question 4

Which SIEM component is responsible for centralizing and correlating logs from multiple sources?

Accepted Answer

Correlation engine. The correlation engine is the SIEM component specifically designed to centralize and analyze logs from multiple sources, applying rules and statistical analysis to identify relationships and patterns indicative of security incidents. It ingests normalized data from the aggregation tier and uses correlation rules to detect complex threats like multi-stage attacks or lateral movement across different systems.

Answer

Data retention system

Answer

Aggregation tier

Answer

Normalization component

Question 5

During a forensic investigation, an analyst finds a suspicious registry key that runs a program at startup. What is the best way to determine if the program is malicious?

Accepted Answer

Compute the hash of the executable and query threat intelligence. Computing the hash of the executable and querying threat intelligence (e.g., VirusTotal, AlienVault OTX) provides a definitive, objective indicator of known maliciousness by comparing the file's cryptographic fingerprint against global threat databases. This is the fastest and most reliable method to determine if the program is malicious without risking execution or relying on circumstantial evidence.

Answer

Search the startup folder for the file

Answer

Execute the program in a sandbox and observe behavior

Answer

Check the file's last modified timestamp

Question 6

An organization uses a SIEM with a rule that triggers when a user fails to authenticate five times within 10 minutes. Last night, the rule fired for a service account from an internal IP. What should be the first triage step?

Accepted Answer

Review the account's recent activity and correlate with system logs. Option B is correct. The analyst should check the account's normal behavior; service accounts may have automated login attempts. Disabling could cause outages. Blocking IP may be premature. Resetting password might lock out legitimate use.

Answer

Disable the service account immediately

Answer

Block the internal IP address at the firewall

Answer

Reset the service account password

Question 7

A security analyst receives an alert from the HIDS indicating that a critical configuration file was modified unexpectedly. What is the best immediate action?

Accepted Answer

Check the change management system to see if the change was approved. Option C is correct because the best immediate action when a HIDS alerts on a critical configuration file change is to first verify whether the change was authorized through the change management system. This aligns with the incident response process of validation before remediation; reverting or restoring without checking could disrupt approved maintenance or patch deployments. HIDS monitors file integrity via checksums (e.g., SHA-256), but it cannot distinguish approved changes from malicious ones without external context.

Answer

Ignore the alert as HIDS false positives are common

Answer

Immediately revert the file and block any similar changes

Answer

Restore the file from a known good backup

Question 8

A SOC analyst receives an alert about a potential data exfiltration via DNS tunneling. Which of the following tools would best help the analyst investigate the alert?

Accepted Answer

PCAP capture. PCAP capture (D) is the correct tool because DNS tunneling involves encoding data within DNS queries and responses, which can only be fully analyzed by inspecting the raw packet payloads. PCAP files allow the analyst to examine the actual DNS packet contents, including query names, response records, and timing patterns, which are essential for detecting anomalous DNS traffic indicative of tunneling.

Answer

Endpoint Detection and Response (EDR)

Answer

Antivirus logs

Answer

NetFlow

Question 9

A company is implementing a security monitoring solution for its cloud infrastructure. The security team wants to detect attempts to disable logging on critical instances. Which of the following should be configured?

Accepted Answer

CloudTrail (API logging). CloudTrail (API logging) is the correct choice because it records all API calls made to the cloud provider's control plane, including actions that modify logging configurations such as disabling or stopping logging on critical instances. By monitoring CloudTrail events, the security team can detect attempts to disable logging via API calls like `StopLogging` or `UpdateTrail`, enabling timely alerting and response.

Answer

VPC Flow Logs

Answer

Host-based intrusion detection (HIDS)

Answer

Scheduled vulnerability scans

Question 10

A security analyst is configuring a SIEM correlation rule to detect multiple failed login attempts followed by a successful login from the same source IP within a short time window. This pattern suggests a successful brute-force attack. Which of the following correlation types should the analyst use?

Accepted Answer

Sequential correlation. Sequential correlation is the correct choice because it detects a specific ordered sequence of events: multiple failed logins followed by a successful login from the same source IP within a defined time window. This pattern is characteristic of a brute-force attack, where an attacker attempts many passwords before succeeding. SIEM tools like Splunk or QRadar use sequential correlation to match event chains where the order matters, not just the count or aggregation of events.

Answer

Thresholding

Answer

Aggregation

Answer

Time-based correlation

Question 11

A security analyst is reviewing a suspicious email attachment. Which THREE of the following are safe analysis techniques? (Choose THREE)

Accepted Answer

Submit the file to a public online scanner. Option B is correct because submitting a suspicious file to a public online scanner (e.g., VirusTotal) allows the analyst to check the file against multiple antivirus engines and threat intelligence feeds without executing it on a live system. This technique is safe as it avoids direct exposure of the production environment to potential malware while leveraging community-sourced detection data.

Answer

Open the attachment on a production machine

Answer

Extract and examine the source code of the attachment

Question 12

A security analyst at a small company notices that several workstations in the finance department are communicating with an external IP address known to be associated with a command-and-control server. The analyst checks the host-based firewall logs and sees that outbound connections to that IP are allowed. Which of the following is the BEST immediate action to take?

Accepted Answer

Disconnect the workstations from the network.. Option B is correct because disconnecting the workstations immediately contains the incident, stopping any ongoing C2 traffic and preventing lateral movement. Option A is wrong because blocking a single IP may not be sufficient if the malware uses multiple IPs or domain generation algorithms. Options C and D are slower and do not address the immediate threat.

Answer

Block the IP at the perimeter firewall.

Answer

Update the antivirus definitions.

Answer

Run a full antivirus scan on the affected workstations.

Question 13

An organization's incident response playbook specifies that after a confirmed malware infection, the infected system should be isolated from the network. Which action best achieves isolation?

Accepted Answer

Disable the network interface card (NIC) via software.. Disabling the network interface card (NIC) via software immediately stops all network traffic to and from the infected system, effectively isolating it from the network while preserving the system's state for forensic analysis. This action aligns with the incident response playbook's requirement for network isolation without destroying volatile data or evidence.

Answer

Uninstall the operating system and reimage.

Answer

Pull the power cord from the infected system.

Answer

Delete the infected user's account.

Question 14

A security analyst is reviewing logs from a network intrusion detection system (NIDS) and sees the following alert: "ET TROJAN Possible ZeuS/Poison Ivy Activity". The analyst wants to verify if the traffic is malicious. Which TWO of the following actions should the analyst take? (Select two.)

Accepted Answer

Check the source IP against threat intelligence feeds.. Option C is correct because checking the source IP against threat intelligence feeds (e.g., AlienVault OTX, VirusTotal, or commercial feeds) allows the analyst to determine if the IP is known for hosting ZeuS/Poison Ivy command-and-control (C2) infrastructure. This action directly validates whether the alert corresponds to a known malicious entity, reducing reliance on signature-based detection alone.

Answer

Disable the NIDS signature to prevent false positives.

Answer

Perform a packet capture of the session for further analysis.

Answer

Restart the NIDS service.

Question 15

An organization has identified a ransomware outbreak on several workstations. Which TWO actions should the incident response team take immediately?

Accepted Answer

Disconnect all network shares to prevent encryption.. Isolating affected systems prevents further spread, and disconnecting network shares stops lateral movement. Contacting law enforcement can be done later; paying ransom is not recommended; reimaging may destroy evidence before investigation.

Answer

Pay the ransom to recover data quickly.

Answer

Contact law enforcement for guidance.

Answer

Reimage all affected systems immediately.

CS0-003 Practice Test 31 — 15 Questions

Exhibit

CS0-003 Practice Test 31 — 15 Questions

Exhibit