CS0-003 Practice Test 36 — 15 Questions

Question 1

Which of the following BEST describes the purpose of a risk register in the context of reporting and communication?

Accepted Answer

To provide a structured way to track identified risks, their likelihood, impact, and mitigation actions. A risk register is a central document that captures identified risks, their assessments, mitigation plans, and status. It supports ongoing risk management and communication to stakeholders.

Answer

To document vulnerabilities found during scans

Answer

To record all security incidents and their outcomes

Answer

To list compliance requirements and deadlines

Question 2

During a security incident, a CySA+ analyst needs to communicate the status to the CISO. Which type of report is most appropriate for this purpose?

Accepted Answer

Executive dashboard. An executive dashboard provides a high-level, real-time view of key metrics and incident status suitable for executive communication.

Answer

Technical report with packet captures

Answer

Vulnerability scan report

Answer

Threat intelligence feed

Question 3

A security analyst discovers a critical vulnerability in a web application that stores customer payment data. The analyst needs to report this to the CISO. Which type of report is most appropriate for communicating the business impact of this vulnerability?

Accepted Answer

Executive dashboard highlighting financial risk and regulatory penalties. An executive dashboard provides high-level metrics and business impact summaries suitable for non-technical stakeholders like the CISO.

Answer

Compliance report showing PCI DSS control status

Answer

Technical vulnerability report with CVSS scores and proof of concept

Answer

Incident report detailing steps to exploit

Question 4

Which component of an incident report describes the sequence of events from detection to resolution?

Accepted Answer

Timeline. The timeline (also called the chronology or sequence of events) is the section of an incident report that documents the chronological order of activities from initial detection through containment, eradication, recovery, and closure. It provides a factual, time-stamped record that allows responders and reviewers to reconstruct exactly what happened and when. This is distinct from root cause analysis, which explains why the incident occurred, and from impact assessment, which quantifies the damage or business effect.

Answer

Root cause

Answer

Impact assessment

Answer

Lessons learned

Question 5

After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?

Accepted Answer

Implement multi-factor authentication for remote access to reduce risk.. A lesson learned is a forward-looking recommendation that changes future posture, such as implementing MFA for remote access to reduce risk. It translates incident findings into actionable improvements. The other options are factual observations or analysis, not corrective recommendations.

Answer

The ransomware encrypted 500 files.

Answer

The incident started at 2:00 AM.

Answer

The root cause was a phishing email.

Question 6

A security analyst is communicating a complex security risk about a new zero-day vulnerability to the board of directors. The board members have varying technical backgrounds. Which approach would be MOST effective?

Accepted Answer

Describe the potential financial loss, reputational damage, and regulatory fines. Board members focus on business impact, so describing potential financial loss, reputational damage, and regulatory fines translates the technical risk into terms they understand and care about. This aligns with risk communication best practices for non-technical executives. It enables informed decision-making on risk acceptance or mitigation funding.

Answer

Provide a list of all current vulnerabilities

Answer

Present the CVSS score and affected systems

Answer

Explain the technical details of the exploit chain

Question 7

A security analyst is reviewing indicators of compromise (IOCs) from a recent phishing campaign. Which of the following is an example of an email-related IOC?

Accepted Answer

Suspicious sender email address. A suspicious sender email address is an email-header-level artifact — it appears in the From, Reply-To, or Return-Path fields and is directly tied to the phishing email itself. That makes it an email-related IOC, unlike network or file artifacts.

Answer

Domain name in the URL

Answer

IP address of the sender's mail server

Answer

File hash of an attachment

Question 8

During a security incident involving a potential data breach, the CISO asks you to prepare a communication for the board of directors. What is the MOST important aspect to emphasize in this communication?

Accepted Answer

The financial impact, reputational risk, and potential regulatory penalties. When communicating with the board of directors during a data breach, the most important aspects are the business impact: financial loss, reputational damage, and potential regulatory fines. Board members are concerned with strategic and financial implications, not technical details. Emphasizing these areas helps them make informed decisions and allocate resources appropriately.

Answer

The specific malware used and its technical attributes

Answer

The names of the IT staff who first detected the incident

Answer

A step-by-step timeline of the incident response actions taken so far

Question 9

During a post-incident review, the team identifies that detection was delayed because alerts from multiple sources were not correlated. Which improvement would BEST address this issue?

Accepted Answer

Implement a SIEM solution. A SIEM solution aggregates logs and alerts from multiple sources, normalizes them, and correlates events across systems to surface related activity that individual tools would miss. This directly addresses the root cause — lack of correlation — by providing centralized detection and alerting. It is the standard architectural answer for improving cross-source detection.

Answer

Disable non-critical alerts

Answer

Increase the number of security staff

Answer

Increase logging verbosity

Question 10

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

A software bill of materials. A software bill of materials (SBOM) is a formal, machine-readable inventory of all components, libraries, and versions used in a software product. In a regulated environment, an SBOM provides the security team with the visibility needed to assess vulnerabilities, track supply chain risks, and ensure compliance with standards like NIST SP 800-53 or FDA guidance. Requesting an SBOM directly addresses the need for library and version transparency.

Answer

A DNS MX record report

Answer

A building floor plan

Answer

A password complexity screenshot only

Question 11

An organization has been experiencing repeated phishing attacks that bypass email filters. The incident response team wants to enhance detection by creating rules based on characteristics of the phishing emails. Which of the following IOCs would be most effective for detecting similar phishing campaigns?

Accepted Answer

Email subject lines and sender domain. Email subject lines and sender domains are the most effective IOCs for detecting phishing campaigns that bypass email filters, because these characteristics are directly observable at the email gateway and are commonly reused across a campaign. Attackers often reuse subject line templates and sender domains (or lookalike domains) across many messages, making them reliable detection pivots. Unlike file hashes or registry keys, these IOCs do not require the payload to execute or the attachment to be present, so they catch the phishing attempt at delivery time.

Answer

Registry keys modified by the payload

Answer

File hashes of attached malware

Answer

IP addresses of the phishing servers

Question 12

Which of the following is a persistence mechanism that involves modifying the Windows Registry to execute a program when a user logs in?

Accepted Answer

Run key. The 'Run' registry key is commonly used to launch programs automatically at user logon, making it a persistence mechanism.

Answer

Scheduled Task

Answer

Service

Answer

Startup folder

Question 13

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. It combines threat intelligence (CISA KEV and high EPSS) with environmental context (asset exposure) to prioritize the vulnerability that is actively exploited and likely to be used in attacks, even though its CVSS base score is medium. This aligns with risk-based vulnerability management, which weights exploitability and business impact over raw severity scores.

Answer

Always sort only by CVSS base score

Answer

Remediate alphabetically by CVE ID

Answer

Remediate only vulnerabilities with vendor logos in the report

Question 14

A security analyst is reviewing a containerized application for vulnerabilities. The analyst uses a container image scanner and identifies several issues. Which THREE of the following are common container and Kubernetes misconfigurations that the analyst should prioritize? (Choose three.)

Accepted Answer

Overly permissive RBAC configurations. Option A (Overly permissive RBAC configurations) is correct because Kubernetes RBAC roles bound with wildcards or cluster-admin privileges grant excessive permissions, enabling privilege escalation and lateral movement across the cluster. Option C (Running containers with the 'privileged' flag) is correct because a privileged container disables most namespace isolation and gains near-full access to host devices and kernel capabilities, effectively breaking container boundaries. Option E (Using hostPath mounts) is correct because hostPath volumes expose node filesystem paths to pods, allowing access to sensitive host files such as /var/run/docker.sock or /etc, which can lead to node compromise. Option B is not a misconfiguration but a security best practice, since updating images remediates known CVEs rather than introducing risk. Option D is also a recommended hardening control, as network policies restrict pod-to-pod traffic and reduce lateral movement, so it is not a misconfiguration to prioritize.

Answer

Keeping container images up to date

Answer

Implementing network policies to restrict pod communication

Question 15

Which THREE elements are essential components of a comprehensive post-incident report?

Accepted Answer

Root cause analysis. Root cause analysis (RCA) is essential because it identifies the underlying technical failure—such as a misconfigured firewall rule, an unpatched CVE, or a phishing campaign—that allowed the incident to occur. Without RCA, the report would only describe symptoms, not the fundamental vulnerability that must be addressed to prevent recurrence.

Answer

List of all employee usernames and passwords

Answer

Budget report for the incident response team