CS0-003 Practice Test 34 — 15 Questions

Question 1

After containing a ransomware incident, the incident response team is conducting post-incident activities. Which action is MOST important to prevent a similar attack in the future?

Accepted Answer

Performing a root cause analysis and implementing remediation. Conducting a root cause analysis identifies the underlying vulnerability or weakness that allowed the attack, enabling targeted remediation.

Answer

Sharing IOCs with other organizations via a threat intelligence platform

Answer

Reimaging all affected systems

Answer

Updating the incident response plan

Question 2

A security analyst is creating a risk register. Which of the following is the most important element to include for each risk?

Accepted Answer

Likelihood and impact rating. A risk register should include risk owner, likelihood, impact, and mitigation status. Likelihood and impact help prioritize risks.

Answer

The exact date the risk was identified

Answer

The name of the person who discovered the risk

Answer

The CVSS score of related vulnerabilities

Question 3

An analyst is investigating a potential compromise on a Windows endpoint. EDR telemetry shows that 'powershell.exe' was launched by 'svchost.exe', which in turn was spawned by 'services.exe'. The analyst observes that 'powershell.exe' then executed a script that downloaded an executable. What should the analyst be most concerned about?

Accepted Answer

This indicates a potential LOLBin attack using svchost.exe to launch powershell.exe. Svchost.exe hosting a child process like powershell.exe is unusual. This parent-child relationship suggests a LOLBin (living off the land) attack, where an attacker abuses legitimate Windows binaries to execute malicious code. The script download further indicates compromise.

Answer

Services.exe spawning svchost.exe is a sign of malware infection

Answer

Powershell.exe downloading an executable is a false positive from Windows Update

Answer

Svchost.exe spawning powershell.exe is a normal Windows operation

Question 4

An analyst is evaluating the performance of the security operations center (SOC). Which metric best indicates the team's ability to contain an active threat?

Accepted Answer

Mean time to respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to contain and remediate an incident, directly reflecting containment speed.

Answer

Mean time to detect (MTTD)

Answer

Patch SLA compliance %

Answer

Open vulnerability counts by severity

Question 5

During a threat hunt, an analyst queries osquery to find processes where the 'cmdline' contains ' -e ' and the parent process is not 'explorer.exe'. This query is designed to detect which technique?

Accepted Answer

Malicious PowerShell execution. PowerShell with -e (encoded command) is often used for obfuscation; unusual parent processes suggest malicious execution.

Answer

Lateral movement via PsExec

Answer

DLL injection via rundll32

Answer

Scheduled task creation

Question 6

Which metric is commonly used to measure the average time it takes to identify that a security incident has occurred?

Accepted Answer

MTTD (Mean Time to Detect). Mean Time to Detect (MTTD) measures the average time between the start of an incident and its detection. It is a key metric for evaluating the effectiveness of monitoring and detection capabilities.

Answer

MTTRem (Mean Time to Remediate)

Answer

MTTR (Mean Time to Respond)

Answer

Patch SLA Compliance %

Question 7

An analyst runs the above command on a server. Based on the exhibit, which of the following is the MOST likely scenario?

Accepted Answer

The server may be compromised with a remote access trojan listening on port 4444. The command output shows a listening service on port 4444, which is not a standard port for any common service. Port 4444 is commonly associated with remote access trojans (RATs) such as Metasploit's Meterpreter or other malware, making a compromise the most likely scenario. The analyst should investigate further to confirm malicious activity.

Answer

The server is running a legitimate SSH service on port 4444

Answer

The server is hosting a web service on a non-standard port

Answer

The server is being used as a proxy for internal clients

Question 8

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which of the following is the most appropriate next step?

Accepted Answer

Collect additional logs and perform a deeper analysis to confirm the compromise.. After detection, the analyst should collect additional data to confirm the incident and scope the impact before proceeding to containment.

Answer

Notify law enforcement immediately.

Answer

Immediately isolate the host from the network.

Answer

Rebuild the host from a known good image.

Question 9

Which THREE of the following are common containment techniques used during incident response?

Accepted Answer

Disconnect the network cable. Disconnecting the network cable is a common containment technique because it immediately isolates the affected system from the network, preventing the spread of malware or unauthorized access. This physical disconnection ensures that no further network-based communication can occur, which is critical for containing incidents like ransomware or data exfiltration. It is a rapid, low-level action that does not rely on software or OS controls, making it effective even if the system is compromised.

Answer

Shut down the system

Answer

Reimage the system

Question 10

A SOC analyst receives an alert from a threat intelligence platform (TIP) about a new phishing campaign. The indicator is a URL. Which enrichment source is BEST for determining the URL's current hosting infrastructure?

Accepted Answer

Passive DNS. Passive DNS allows querying historical and current IP addresses associated with a domain, revealing hosting changes.

Answer

VirusTotal

Answer

WHOIS

Answer

Shodan

Question 11

A cybersecurity analyst is configuring a vulnerability scanning policy for a mixed environment of Linux servers and Windows workstations. The analyst wants to minimize disruption to production services while ensuring comprehensive coverage. Which approach is BEST?

Accepted Answer

Use separate scan windows for Linux servers and Windows workstations with appropriate credentials and performance tuning. Using separate scan windows and credentials for each OS type minimizes disruption by scanning similar systems together and reduces load, while tailored credential profiles improve scan accuracy.

Answer

Deploy agents on all systems to perform continuous scanning

Answer

Scan all systems simultaneously with minimal plugin set to avoid performance issues

Answer

Schedule a single scan of all systems using default credentials and aggressive plugin settings

Question 12

A security analyst is configuring a SIEM correlation rule to detect multiple failed login attempts followed by a successful login from the same source IP within a short time window. This pattern suggests a successful brute-force attack. Which of the following correlation types should the analyst use?

Accepted Answer

Sequential correlation. Sequential correlation is the correct choice because it detects a specific ordered sequence of events: multiple failed logins followed by a successful login from the same source IP within a defined time window. This pattern is characteristic of a brute-force attack, where an attacker attempts many passwords before succeeding. SIEM tools like Splunk or QRadar use sequential correlation to match event chains where the order matters, not just the count or aggregation of events.

Answer

Thresholding

Answer

Aggregation

Answer

Time-based correlation

Question 13

A threat hunter is creating a Sigma rule to detect a specific TTP where an attacker uses reg.exe to create a Run key for persistence. Which of the following Sigma rule event selectors would best detect this activity?

Accepted Answer

EventID: 13 (Registry Value Set) AND TargetObject: '*\CurrentVersion\Run*'. Registry persistence via Run keys is commonly achieved by modifying HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Sigma rules targeting registry add/modify events with that path will detect it.

Answer

EventID: 4688 (Process Creation) AND ParentImage: '*reg.exe*'

Answer

EventID: 4657 (Registry modification) AND ObjectName: '*\RunOnce*'

Answer

EventID: 1 (Process Creation) AND CommandLine: '*reg.exe*'

Question 14

A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Manually test the service with a TLS client or scanner profile that negotiates protocol versions. The only way to definitively resolve a discrepancy between a scanner finding and a service owner's claim is to perform an independent, manual test. Using a TLS client (e.g., OpenSSL s_client) or a scanner profile that specifically negotiates protocol versions allows you to directly verify whether the server actually accepts TLS 1.0 connections, eliminating false positives or misconfigurations.

Answer

Change the severity to informational automatically

Answer

Close the finding because the owner disagrees

Answer

Delete the server from the scan scope

Question 15

A vulnerability assessment has identified multiple issues. Which THREE actions are appropriate steps in the remediation process? (Choose three.)

Accepted Answer

Create a change request to apply the necessary patch or configuration change. In a structured remediation process, applying a patch or configuration change requires a formal change request to ensure proper testing, approval, and documentation, minimizing the risk of unintended disruptions. This aligns with change management best practices in vulnerability management, where uncoordinated changes can introduce new vulnerabilities or break existing functionality.

Answer

Rescan the system immediately to confirm the vulnerability

Answer

Uninstall the affected software or service to remove the vulnerability