CS0-003 Practice Test 34 — 15 Questions

Question 1

After containing a ransomware outbreak, the incident response team needs to restore encrypted files. They have verified clean backups from two weeks ago, but some critical files were modified on the day of the attack. What is the best approach?

Accepted Answer

Restore critical files from backup and manually update them using change logs. Option B is correct because restoring critical files from backup and manually updating them using change logs preserves the modifications made on the day of the attack, which are not present in the two-week-old backups. This approach ensures data integrity by combining the clean baseline from backups with the legitimate changes recorded in change logs, avoiding data loss while maintaining security.

Answer

Restore from backups and then apply all available updates

Answer

Attempt to decrypt files using the ransom key

Answer

Restore all files from backups

Question 2

Refer to the exhibit. An analyst sees this output from a workstation. Which of the following is the most likely explanation?

Accepted Answer

The workstation is infected with malware connecting to a C2 server. The output shows repeated outbound TCP connections to a single external IP address on port 443 (HTTPS) with varying source ports, which is characteristic of beaconing behavior. Malware often establishes periodic connections to a command-and-control (C2) server to receive instructions or exfiltrate data, and the pattern of multiple connections from different ephemeral ports to the same destination is a common indicator of such activity.

Answer

The workstation is receiving NTP time synchronization

Answer

The workstation is performing a port scan

Answer

The workstation is a web server

Question 3

A security analyst notices that a system is sending a large amount of data to an external IP address via DNS tunneling. Which containment technique is most appropriate?

Accepted Answer

Disconnect the system from the network. Disconnecting the system from the network (Option B) is the most appropriate containment technique because it immediately stops all data exfiltration, including DNS tunneling traffic, without relying on any other network component. DNS tunneling works by encoding data within DNS queries and responses, so simply changing DNS server settings or blocking the external IP may not stop the attack if the malware uses fallback resolvers or rotates IPs. Disconnecting the system ensures the threat is isolated at the host level, preventing further data loss while preserving forensic evidence.

Answer

Change the DNS server settings

Answer

Block the external IP at the firewall

Answer

Disable the DNS service on the system

Question 4

A security analyst needs to report a critical vulnerability to the executive team. The report should balance technical details with business impact. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in terms of potential business impact and recommended risk treatment. Option C is correct because it directly addresses the core requirement of balancing technical details with business impact. For a critical vulnerability, the executive team needs to understand the potential financial, operational, and reputational risks, not just the technical flaw. This approach aligns with the NIST risk management framework, which emphasizes communicating risk in terms of business context to enable informed decision-making on risk treatment (e.g., accept, mitigate, transfer, avoid).

Answer

Simply state the vulnerability exists and a patch is available

Answer

Write a 50-page report covering every technical detail and mitigation option

Answer

Provide a full technical analysis of the vulnerability and remediation steps

Question 5

A company policy requires that all security incidents be reported to management within one hour of detection. An analyst discovers a low-severity incident (a single malware download attempt blocked by antivirus) at 4:55 PM on a Friday. The analyst is about to leave for the weekend. What should the analyst do?

Accepted Answer

Report the incident immediately according to policy, even if it means staying late.. Option B is correct because the company policy explicitly requires reporting all security incidents within one hour of detection, regardless of severity. The analyst must report the incident immediately, even if it means staying late, as policy compliance is mandatory and low-severity incidents still represent a security event that could indicate broader compromise or be part of a larger attack chain. Delaying reporting violates the policy and could lead to disciplinary action or missed escalation windows.

Answer

Document the incident in the ticketing system and report it the next business day.

Answer

Report the incident via email and ignore it until Monday.

Answer

Wait until Monday morning to report, as it is low severity.

Question 6

An analyst is preparing a report that includes Personally Identifiable Information (PII) from a data breach. The report will be shared with external auditors. Which of the following is the BEST practice for handling PII in the report?

Accepted Answer

Use tokenization or pseudonymization to mask PII while preserving analytical value. Option C is correct because tokenization or pseudonymization replaces PII with non-sensitive placeholders that retain referential integrity and analytical utility, allowing auditors to perform their review without exposing actual personal data. This approach balances transparency requirements with data minimization principles mandated by regulations like GDPR and PCI DSS, unlike full disclosure or simple encryption which still exposes the original data to the recipient.

Answer

Include full PII in the report for complete transparency

Answer

Encrypt the report and send it via email to auditors

Answer

Remove all PII entirely, leaving only anonymized records

Question 7

During an active incident, a security analyst discovers that the attacker has exfiltrated data. The analyst must communicate this to the incident response team. Which method of communication is MOST appropriate?

Accepted Answer

Use a predefined secure messaging channel or phone call to escalate. During an active incident, speed and security are critical. A predefined secure messaging channel or phone call ensures immediate, confidential communication without the delays or exposure risks of email or ticketing systems. This aligns with NIST SP 800-61 incident response guidelines, which prioritize real-time, out-of-band communication for sensitive updates.

Answer

Update the incident ticket and wait for the team to review

Answer

Send a detailed email to the incident response team

Answer

Post the information on a public forum for awareness

Question 8

An analyst identifies a security policy violation during a routine audit. The violation does not pose immediate risk. Which of the following is the BEST way to report this finding?

Accepted Answer

Create a formal report with the finding, policy references, and recommended remediation. A formal report is the best method for documenting a security policy violation because it provides a permanent, auditable record that includes specific policy references and recommended remediation steps. This aligns with the reporting and communication domain's emphasis on structured, traceable documentation for non-urgent findings, ensuring proper tracking and accountability without causing unnecessary alarm.

Answer

Mention it casually in a team meeting

Answer

Send an instant message to the system owner

Answer

Immediately report it to the Chief Information Security Officer

Question 9

Which THREE elements are essential components of a comprehensive post-incident report?

Accepted Answer

Root cause analysis. Root cause analysis (RCA) is essential because it identifies the underlying technical failure—such as a misconfigured firewall rule, an unpatched CVE, or a phishing campaign—that allowed the incident to occur. Without RCA, the report would only describe symptoms, not the fundamental vulnerability that must be addressed to prevent recurrence.

Answer

List of all employee usernames and passwords

Answer

Budget report for the incident response team

Question 10

After a major security incident, a post-incident review reveals that communication between the SOC and the network operations center (NOC) was slow and unclear. Which document should be updated to improve future incident response?

Accepted Answer

Communication management plan. The communication management plan defines roles, responsibilities, escalation paths, and communication channels (e.g., secure chat, phone bridges, ticketing systems) between teams like the SOC and NOC during an incident. Since the review specifically identified slow and unclear inter-team communication, updating this plan directly addresses the root cause by clarifying protocols, contact lists, and expected response times, ensuring faster and clearer coordination in future incidents.

Answer

Disaster recovery plan (DRP)

Answer

Business continuity plan (BCP)

Answer

Incident response plan (IRP)

Question 11

Refer to the exhibit. An analyst sees this alert in the SIEM console. What is the best immediate action?

Accepted Answer

Escalate the alert to the incident response team.. Option D is correct because the alert indicates a potential security incident that requires formal escalation to the incident response team for proper triage, analysis, and containment. The SIEM alert likely contains indicators of compromise (IoCs) that need expert investigation before any automated or manual remediation steps are taken, as premature actions could destroy forensic evidence or disrupt legitimate services.

Answer

Update the Suricata signature to block the traffic.

Answer

Run a full antivirus scan on destination host 10.0.0.1.

Answer

Isolate the source host 10.0.0.5 from the network.

Question 12

Which TWO methods help ensure the accuracy of security metrics reported to management?

Accepted Answer

Periodic validation of data against original logs. Option B is correct because periodic validation of security metrics against original logs (e.g., firewall logs, IDS/IPS alerts, or authentication logs) ensures data integrity by detecting discrepancies introduced during aggregation or transformation. This practice aligns with the principle of 'trust but verify,' where raw log sources serve as the authoritative baseline for metric accuracy, preventing reporting of corrupted or incomplete data.

Answer

Using colorful charts to impress stakeholders

Answer

Reporting only positive metrics to maintain confidence

Answer

Manual entry of data from multiple spreadsheets

Question 13

An analyst views the above SIEM logs from a Linux server. Which of the following attacks is MOST likely occurring?

Accepted Answer

Brute force attack leading to credential compromise and malware installation. The SIEM logs show repeated failed SSH login attempts from multiple IP addresses, followed by a successful login and then a wget command to download a suspicious file, indicating a brute force attack that succeeded, leading to credential compromise and subsequent malware installation. This pattern matches the typical lifecycle of a brute force attack against SSH services, where an attacker gains access and then stages malware.

Answer

Man-in-the-middle attack intercepting credentials

Answer

SQL injection through the web application

Answer

Denial of service attack against the SSH service

Question 14

An analyst wants to capture all traffic to and from a specific IP address for analysis. Which command-line tool is most appropriate?

Accepted Answer

tcpdump host 10.0.0.1. Option D is correct because `tcpdump host 10.0.0.1` captures all packets where the source or destination IP address matches 10.0.0.1, making it the ideal tool for capturing all traffic to and from a specific IP for analysis. It operates at the packet level, using libpcap to intercept raw network frames, and the `host` filter instructs it to match both directions of traffic without additional parsing or state tracking.

Answer

nmap -sS 10.0.0.1

Answer

netstat -ant | grep 10.0.0.1

Answer

iptables -L -v

Question 15

During incident response, a team isolates a host but needs to preserve volatile evidence. What should be done first?

Accepted Answer

Capture a memory dump. When a host is isolated during incident response, the first priority is to capture volatile data before it is lost. A memory dump preserves the contents of RAM, which includes running processes, network connections, open files, and encryption keys. This data is critical for forensic analysis and disappears when the system is powered off. Disconnecting the network (option B) is important but should follow memory capture because network activity is part of the volatile state.

Answer

Disconnect from the network

Answer

Reimage the hard drive

Answer

Reboot the system