CS0-003 Practice Test 32 — 15 Questions

Question 1

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is technical remediation owner, which content choice is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. A is correct because a failed alert integration indicates a gap in operational ownership, which must be resolved by assigning a named owner, setting a due date, defining acceptance criteria, and planning a retest. This ensures accountability and verifies that the integration is properly restored and monitored, preventing recurrence. Without these elements, the corrective action lacks closure and measurable success criteria.

Answer

No action because the incident is closed

Answer

Deletion of the integration record

Answer

A vague recommendation to improve security

Question 2

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans only enumerate open ports and services visible without credentials, missing the patch status of installed software because they cannot query the Windows registry or WMI for installed updates. Running authenticated scans with least-privilege credentials allows the scanner to log into each target and retrieve detailed patch data via the Windows Update Agent API or registry keys, revealing missing patches that were previously invisible. This directly addresses the security manager's suspicion of missing patch data without introducing unnecessary risk.

Answer

Increase only the port range

Answer

Disable host firewalls permanently

Answer

Trust the unauthenticated result as complete

Question 3

A SOC analyst receives an alert about a potential data exfiltration via DNS tunneling. Which of the following tools would best help the analyst investigate the alert?

Accepted Answer

PCAP capture. PCAP capture (D) is the correct tool because DNS tunneling involves encoding data within DNS queries and responses, which can only be fully analyzed by inspecting the raw packet payloads. PCAP files allow the analyst to examine the actual DNS packet contents, including query names, response records, and timing patterns, which are essential for detecting anomalous DNS traffic indicative of tunneling.

Answer

Endpoint Detection and Response (EDR)

Answer

Antivirus logs

Answer

NetFlow

Question 4

A security analyst receives an alert from the HIDS indicating that a critical configuration file was modified unexpectedly. What is the best immediate action?

Accepted Answer

Check the change management system to see if the change was approved. The best immediate action when a HIDS alerts on a critical configuration file change is to first verify whether the change was authorized through the change management system. This aligns with the incident response process of validation before remediation; reverting or restoring without checking could disrupt approved maintenance or patch deployments. HIDS monitors file integrity via checksums (e.g., SHA-256), but it cannot distinguish approved changes from malicious ones without external context.

Answer

Ignore the alert as HIDS false positives are common

Answer

Immediately revert the file and block any similar changes

Answer

Restore the file from a known good backup

Question 5

Which evidence helps distinguish a true brute-force attack from a misconfigured service account? (Choose two.)

Accepted Answer

Source distribution and timing of failed logons. A true brute-force attack typically originates from multiple source IP addresses or a single source with a high frequency of failed logons over a short time window, whereas a misconfigured service account usually fails from a consistent source at regular intervals. Analyzing the source distribution and timing of failed logons helps distinguish automated attack patterns from predictable service account behavior, such as retry intervals defined in application configuration.

Answer

The number of monitors used by the administrator

Answer

The brand of the office router only

Question 6

A malware alert shows a signed binary performing suspicious actions. Which facts help decide whether it is living-off-the-land abuse? (Choose two.)

Accepted Answer

The binary is normally administrative but launched from an unusual parent process. Living-off-the-land (LotL) abuse often involves legitimate administrative binaries (e.g., PowerShell, certutil, wmic) being executed from an unexpected parent process, such as a Microsoft Office application or a script host. This deviation from the normal process tree (e.g., cmd.exe or explorer.exe spawning the binary) is a strong indicator of malicious intent, as attackers leverage trusted tools to evade detection.

Answer

The binary has a familiar vendor name only

Answer

The endpoint wallpaper is unchanged

Question 7

Which metrics best show SOC detection and response effectiveness? (Choose two.)

Accepted Answer

Mean time to detect. Mean time to detect (MTTD) directly measures how quickly the SOC identifies a security incident from the initial compromise, reflecting the efficiency of detection tools like SIEM and EDR. A lower MTTD indicates faster threat discovery, which is critical for minimizing dwell time and reducing potential damage.

Answer

Number of office printers

Answer

Total number of email signatures

Question 8

A vulnerability appears critical but the vulnerable feature is disabled. What should the analyst document before downgrading? (Choose two.)

Accepted Answer

Approval and rationale for the severity change. When a vulnerability is critical but the vulnerable feature is disabled, the analyst must document the approval and rationale for the severity change to maintain an accurate risk register and audit trail. This ensures that the decision to downgrade is justified, traceable, and compliant with organizational change management policies, preventing arbitrary adjustments that could obscure true risk posture.

Answer

Deletion of the original scanner finding

Answer

The analyst's personal preference for fewer tickets

Question 9

What should be included in incident scoping for ransomware? (Choose three.)

Accepted Answer

Initial infected host and user context. Identifying the initial infected host and user context is critical for understanding the attack vector, containing the threat, and preventing further spread. In ransomware incidents, the first compromised system often reveals the entry point (e.g., phishing email, RDP brute force) and the user account used, which helps scope the blast radius and prioritize remediation.

Answer

The brand of office chairs near the server room

Question 10

Which sources improve asset criticality context for vulnerability prioritization? (Choose two.)

Accepted Answer

CMDB or asset inventory with business service mapping. A CMDB or asset inventory with business service mapping provides direct context about which assets support critical business functions, enabling prioritization of vulnerabilities based on potential business impact. This aligns with the FAIR model for risk quantification, where asset criticality is a key factor in determining the likelihood and magnitude of loss.

Answer

Random public IP reputation of unrelated hosts

Answer

Employee lunch preferences

Question 11

A security analyst is reviewing a suspicious email attachment. Which THREE of the following are safe analysis techniques? (Choose THREE)

Accepted Answer

Submit the file to a public online scanner. Submitting a suspicious file to a public online scanner (e.g., VirusTotal) allows the analyst to check the file against multiple antivirus engines and threat intelligence feeds without executing it on a live system. This technique is safe as it avoids direct exposure of the production environment to potential malware while leveraging community-sourced detection data.

Answer

Open the attachment on a production machine

Answer

Extract and examine the source code of the attachment

Question 12

A vulnerability scan of an internal web server shows a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF and is only accessible from internal IPs. Which of the following is the best next step?

Accepted Answer

Perform a risk assessment considering compensating controls. CVSS score reflects severity but not exploitability in the specific environment. Considering compensating controls (WAF, network ACLs) may reduce risk, so a risk assessment is needed before patching.

Answer

Apply the patch immediately regardless of impact

Answer

Disable the server until a patch is available

Answer

Ignore the finding because the server is internal

Question 13

A security analyst is reviewing logs from a network intrusion detection system (NIDS) and sees the following alert: "ET TROJAN Possible ZeuS/Poison Ivy Activity". The analyst wants to verify if the traffic is malicious. Which TWO of the following actions should the analyst take? (Select two.)

Accepted Answer

Check the source IP against threat intelligence feeds.. Checking the source IP against threat intelligence feeds (e.g., AlienVault OTX, VirusTotal, or commercial feeds) allows the analyst to determine if the IP is known for hosting ZeuS/Poison Ivy command-and-control (C2) infrastructure. This action directly validates whether the alert corresponds to a known malicious entity, reducing reliance on signature-based detection alone.

Answer

Disable the NIDS signature to prevent false positives.

Answer

Perform a packet capture of the session for further analysis.

Answer

Restart the NIDS service.

Question 14

A SOC wants to measure whether alert enrichment is improving operations. Which metrics are useful? (Choose two.)

Accepted Answer

Reduction in analyst triage time for enriched alerts. A primary goal of alert enrichment is to reduce the time analysts spend investigating alerts. By automatically populating context such as asset owner, criticality, and vulnerability data, enrichment eliminates manual lookup steps, directly lowering mean time to triage (MTTT). This metric quantifies operational efficiency gains from enrichment.

Answer

Amount of storage used by desktop screenshots

Answer

Number of unused browser bookmarks

Question 15

A Kubernetes audit alert shows a service account creating privileged pods. Which checks are most relevant? (Choose two.)

Accepted Answer

Pod spec fields such as privileged mode, hostPath, and hostNetwork. Privileged pods can bypass container security boundaries, and hostPath or hostNetwork access can lead to host-level compromise. The audit alert specifically flags a service account creating such pods, which violates the principle of least privilege and indicates a potential security incident that requires immediate investigation of the pod spec fields.

Answer

The number of comments in application code

Answer

User profile pictures in the HR system