CS0-003 Practice Test 37 — 15 Questions

Question 1

A security analyst is reviewing the output of a vulnerability scan and notices that a critical vulnerability on a Linux server has been reported as 'Confirmed' by the scanner. The analyst checks the system and finds that the actual vulnerability does not exist because a kernel upgrade was applied via a yum update but the scanner did not detect the change. Which of the following is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The scanner was not configured with proper credentials for authenticated scanning. The vulnerability scanner reported a 'Confirmed' critical vulnerability that no longer exists after a kernel upgrade via yum. This indicates the scanner performed an unauthenticated scan, relying on banner grabbing or service version detection, which cannot verify the actual installed kernel version. With proper credentials (e.g., SSH keys or a service account), the scanner would have performed an authenticated scan, queried the package manager (rpm -q kernel), and correctly identified that the kernel was updated, thus not flagging the vulnerability.

Answer

The vulnerability database was not updated before the scan

Answer

The scanner is configured to alert on missing patches only

Answer

The scanner's plugins for Linux are outdated

Question 2

You are a senior security analyst at a mid-sized financial company. The SOC has been alerted by the EDR system about anomalous behavior on a domain controller (DC) that runs Windows Server 2019. The alert indicates that a process named 'svchost.exe' spawned a PowerShell process that executed a one-liner to connect to an external IP address (203.0.113.5) over TCP port 443. Further investigation shows that the DC's event logs have gaps of about 10 minutes each, and the local administrator account 'Administrator' was used to log in from a workstation named 'WKSTN-FIN-12' at the time of the event. The company has strict policies: all administrative access must be via dedicated jump hosts, and privileged accounts are monitored. Upon checking, 'WKSTN-FIN-12' is assigned to an employee in the finance department who has no administrative privileges. The employee reports that they did not log in recently. The CISO wants a swift containment and eradication without losing forensic evidence. Based on this scenario, which of the following is the BEST first course of action?

Accepted Answer

Isolate the domain controller from the network by disabling its network interface.. Isolating the domain controller by disabling its network interface is the best first step because it immediately halts any ongoing malicious communication (e.g., C2 traffic over TCP 443) while preserving the volatile state of the system for forensic acquisition. This action prevents further data exfiltration or lateral movement without destroying evidence like memory or logs, which would occur with a power-down. It also aligns with the CISO's requirement for swift containment without losing forensic evidence.

Answer

Capture a memory dump of the domain controller for offline analysis.

Answer

Power down the domain controller to prevent further damage.

Answer

Reset the password for the local Administrator account and revoke the user's access.

Question 3

An analyst is reviewing a YARA rule that triggers on a specific string pattern in memory. The rule has a high false positive rate. Which of the following actions would best reduce false positives while maintaining detection capability?

Accepted Answer

Add a condition that requires the string to appear with another indicator. YARA false positives occur when a single string pattern is too generic and matches benign files. Adding a condition that requires the string to co-occur with another indicator (for example, using 'and' or proximity operators like '2 of them' or 'all of them') increases specificity while preserving the ability to detect the malicious pattern. This is the standard YARA tuning technique because it raises the rule's precision without discarding the detection logic.

Answer

Convert the rule to a Sigma rule

Answer

Remove the rule from active use

Answer

Increase the string length in the rule

Question 4

A security analyst needs to communicate the results of a vulnerability scan to different stakeholders. Which TWO of the following are appropriate reporting formats for executive-level stakeholders?

Accepted Answer

A one-page executive summary with risk ratings and business impact. Executive-level stakeholders require high-level, business-focused information to make strategic decisions. A one-page executive summary with risk ratings and business impact (Option A) provides a concise overview of the most critical vulnerabilities, their potential effect on operations, and recommended actions without technical jargon. A dashboard showing trend analysis and high-level metrics (Option B) allows executives to quickly assess the organization's security posture over time, track remediation progress, and identify emerging risks through visual data.

Answer

A detailed remediation checklist for system administrators

Answer

A raw output from the vulnerability scanner

Answer

A technical report listing CVSS scores and exploit details

Question 5

Which THREE of the following are common indicators of a data exfiltration attempt? (Choose three.)

Accepted Answer

Outbound connections to IP addresses associated with known C2 servers. Outbound connections to IP addresses associated with known command-and-control (C2) servers are a classic indicator of data exfiltration. Once an attacker establishes a C2 channel, they can use it to tunnel stolen data out of the network. Security tools like firewalls and threat intelligence feeds flag these connections based on known malicious IP addresses or domains.

Answer

Increased use of encrypted communication protocols

Answer

Multiple failed login attempts from a single source

Question 6

A SIEM alert is generated for a user who logged into a workstation at 2:00 AM, which is outside their normal working hours. The user's manager confirms the user was on call and had legitimate reason to log in. How should the analyst classify this alert?

Accepted Answer

False positive. The alert is a false positive because the activity is legitimate despite being outside normal hours.

Answer

False negative

Answer

True positive

Answer

True negative

Question 7

During an audit, the compliance team needs to provide evidence that access reviews are performed regularly. Which of the following is the BEST evidence?

Accepted Answer

Signed and dated access review reports. Completed access review reports with timestamps and signatures provide clear evidence that reviews were conducted.

Answer

A list of user accounts with last login dates

Answer

A policy stating that access reviews should be done quarterly

Answer

Email reminders sent to managers to perform reviews

Question 8

Which findings should be included when reporting remediation performance to asset owners? (Choose two.)

Accepted Answer

Recently remediated findings awaiting validation. Option A is correct because recently remediated findings awaiting validation represent the current state of remediation work in progress, showing asset owners what has been fixed but not yet confirmed, which is essential for tracking remediation performance. Option D is correct because open critical findings past SLA by owner directly measures remediation performance against service-level agreements, highlighting overdue high-severity issues that require immediate attention and accountability. Option B is incorrect because raw scanner debug lines are low-level technical noise, not performance metrics relevant to asset owners. Option C is incorrect because unrelated physical-access badge failures fall outside the scope of remediation performance reporting and belong to a different security domain.

Answer

Every raw scanner debug line

Answer

Unrelated physical-access badge failures

Question 9

A company is implementing a security monitoring solution for its cloud infrastructure. The security team wants to detect attempts to disable logging on critical instances. Which of the following should be configured?

Accepted Answer

CloudTrail (API logging). CloudTrail (API logging) is the correct choice because it records all API calls made to the cloud provider's control plane, including actions that modify logging configurations such as disabling or stopping logging on critical instances. By monitoring CloudTrail events, the security team can detect attempts to disable logging via API calls like `StopLogging` or `UpdateTrail`, enabling timely alerting and response.

Answer

VPC Flow Logs

Answer

Host-based intrusion detection (HIDS)

Answer

Scheduled vulnerability scans

Question 10

A security analyst is reviewing vulnerability scan results and notices that several critical vulnerabilities have been reported on the same web server for three consecutive months. The server owner states that the patches cannot be applied due to application compatibility issues. Which of the following is the BEST course of action?

Accepted Answer

Implement compensating controls to reduce the risk. When a known vulnerability cannot be patched due to application compatibility issues, the standard risk management approach is to implement compensating controls. These controls (e.g., Web Application Firewall rules, network segmentation, or host-based IPS) reduce the likelihood or impact of exploitation without modifying the vulnerable application. This aligns with the NIST SP 800-40 Rev. 4 guidance on vulnerability handling, which explicitly recommends compensating controls when patching is not feasible.

Answer

Escalate the issue to senior management and move on

Answer

Remove the web server from service until patches are applied

Answer

Schedule a rescan to verify if the vulnerabilities still exist

Question 11

An organization is preparing evidence for a compliance audit. Which of the following pieces of evidence would BEST demonstrate that a security control is effective?

Accepted Answer

A control effectiveness report with test results and metrics. A control effectiveness report with test results and metrics provides objective, measurable evidence that the control actually works as intended, which is what auditors require. Configuration screenshots and policy documents only show intent or design, not operational effectiveness.

Answer

A screenshot of the control configuration

Answer

A policy document describing the control

Answer

An email from the system owner stating the control is working

Question 12

During post-incident activities, the security team reviews metrics. Which metric measures the average time taken to detect an incident?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) is the metric that measures the average time between when an incident actually occurs and when it is detected by the security team. It is a core SOC effectiveness metric used in post-incident reviews to evaluate detection capability.

Answer

MTTR

Answer

SLA

Answer

RTO

Question 13

A security analyst is performing memory acquisition on a compromised Linux server using LiME. The analyst needs to capture the memory image with minimal impact on the system. Which of the following parameters should the analyst use to ensure the output is forensically sound?

Accepted Answer

Ensure the output path is on a write-blocked device. Using a write blocker ensures the memory capture does not alter the storage media, preserving forensic integrity.

Answer

Use the --digest option to calculate a SHA256 hash during acquisition

Answer

Specify a format that compresses the output to reduce size

Answer

Use the --reload option to reload the original kernel module after acquisition

Question 14

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, an analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which step should the analyst perform next to validate the alert?

Accepted Answer

Correlate the alert with other logs and endpoint data to confirm malicious activity.. During the detection and analysis phase, the primary goal is to validate the alert by correlating it with additional data sources (e.g., firewall logs, DNS logs, endpoint detection and response (EDR) telemetry) to confirm whether the traffic is truly malicious or a false positive. Simply searching external threat intelligence (Option A) provides context but does not confirm activity on the host; escalation (Option C) and containment (Option D) are premature without validated evidence.

Answer

Search for the IP address on VirusTotal and Shodan.

Answer

Escalate the alert to the incident response team for containment.

Answer

Contain the host immediately by disconnecting it from the network.

Question 15

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. The immediate priority is to restrict public read access to the storage bucket to prevent further unauthorized exposure, then determine whether sensitive customer data was accessed by reviewing access logs (e.g., AWS CloudTrail or S3 server access logs). This aligns with incident response best practices: contain the threat first, then assess impact. Without confirming data access, the team cannot properly scope the breach or notify affected parties.

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Answer

Delete all audit logs to reduce liability