CS0-003 Practice Test 38 — 15 Questions

Question 1

Which THREE activities are typically performed during the post-incident activity phase of the incident response lifecycle?

Accepted Answer

Root cause analysis.. Root cause analysis (B) is performed during the post-incident activity phase to identify the underlying vulnerability or misconfiguration that allowed the incident to occur. This analysis informs remediation steps and helps prevent recurrence, making it a core activity of this phase.

Answer

System restoration from backups.

Answer

Implementation of new security awareness training.

Question 2

Which THREE of the following are essential tools and technologies used in a Security Operations Center (SOC) for monitoring and detection?

Accepted Answer

Endpoint Detection and Response (EDR). Endpoint Detection and Response (EDR) is essential in a SOC because it provides continuous monitoring and analysis of endpoint activities, enabling detection of advanced threats such as fileless malware and ransomware. EDR tools collect telemetry data from endpoints, correlate it with threat intelligence, and allow for automated response actions, which are critical for real-time incident detection and investigation.

Answer

Firewall

Answer

Vulnerability scanner

Question 3

During a forensic investigation, an analyst needs to acquire disk images from multiple suspect drives. Which THREE practices ensure forensic soundness? (Select THREE)

Accepted Answer

Documenting the chain of custody for each drive. Option A is correct because documenting the chain of custody for each drive creates an auditable record of who handled the evidence, when, and under what conditions, which is essential for the evidence to be admissible and for forensic soundness. Option C is correct because computing and verifying cryptographic hashes such as SHA-256 (or MD5) of both the original drive and the resulting image proves the image is a bit-for-bit duplicate and that no alteration occurred during acquisition. Option D is correct because a hardware write blocker enforces a read-only connection to the source drive at the hardware level, preventing any writes or metadata changes that would taint the original evidence. Option B is not appropriate because speed without verification sacrifices integrity; forensic imaging must prioritize accuracy and validation over raw throughput. Option E is not appropriate because live acquisition alters the running system's state and memory, introduces volatility and potential contamination, and is generally reserved for situations where a dead-box acquisition is impossible.

Answer

Using the fastest available imaging method without verification

Answer

Acquiring the image while the system is running (live acquisition)

Question 4

An analyst is performing static analysis on a suspicious executable file. Which of the following would be MOST useful to identify potential malicious behavior without executing the file?

Accepted Answer

Analyzing the import table.. Static analysis involves examining the file without executing it. The import table shows which Windows API functions the executable uses, which can indicate capabilities such as network communication, file operations, or registry modifications.

Answer

Running the file in a sandbox.

Answer

Monitoring network connections during execution.

Answer

Checking the file's digital signature.

Question 5

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. A high volume of Kerberos service ticket requests for many SPNs, followed by no actual service access, is characteristic of Kerberoasting reconnaissance. In this attack, an adversary with valid domain credentials requests TGS tickets for service accounts to extract the NTLM hash embedded in the ticket, which can then be cracked offline. The lack of subsequent service access confirms the tickets were obtained solely for offline brute-force cracking, not legitimate use.

Answer

DNS cache poisoning

Answer

Pass-the-hash using NTLM only

Answer

ARP spoofing

Question 6

A cloud security analyst is reviewing a misconfiguration in an AWS S3 bucket that allows public read access. The bucket contains sensitive customer data. Which of the following CIS AWS Foundations Benchmark checks would most likely identify this issue?

Accepted Answer

Ensure S3 buckets do not allow public read access. CIS AWS Foundations Benchmark includes a control for ensuring S3 buckets do not allow public read access. The control is typically '1.5 Ensure S3 bucket policy restricts public read access'. 'Enable S3 bucket logging' is about logging, not access. 'Enable default encryption' is about encryption. 'Enable versioning' is about data protection.

Answer

Enable default encryption for S3 buckets

Answer

Enable S3 bucket logging

Answer

Enable versioning on S3 buckets

Question 7

An organization uses OpenSCAP for compliance scanning. What is the primary purpose of OpenSCAP?

Accepted Answer

Compliance scanning and configuration assessment. OpenSCAP is a tool for automated compliance checking against security policies like SCAP content.

Answer

Vulnerability scanning

Answer

Intrusion detection

Answer

Penetration testing

Question 8

A cloud workload identity begins accessing secrets outside its normal application scope. Which evidence should be reviewed? (Choose two.)

Accepted Answer

Cloud audit logs for secret-read operations. Cloud audit logs record all API calls, including secret-read operations. If a workload identity is accessing secrets outside its normal scope, the audit logs will show the specific secret-read API calls (e.g., GetSecretValue in AWS Secrets Manager or accessSecretVersion in Google Cloud Secret Manager) made by that identity. Reviewing these logs directly confirms the anomalous access pattern and identifies which secrets were retrieved, providing the primary evidence of the breach.

Answer

Legacy fax transmission logs

Answer

The colour of the application logo

Question 9

A security analyst is reviewing a Kubernetes cluster configuration. Which of the following misconfigurations poses the MOST severe security risk?

Accepted Answer

Privileged containers with unrestricted host access. Privileged containers bypass all security restrictions and can access the host system, posing the most severe risk.

Answer

Using hostPath mounts with read-only access

Answer

Using ConfigMaps for non-sensitive data

Answer

Running containers as non-root user

Question 10

A penetration testing team has completed an internal assessment and provided a report with several high-risk findings. One finding indicates that a web application is vulnerable to SQL injection. The application is used by external customers to submit orders. The development team has reviewed the finding and states that it will take three weeks to fix the code and deploy a patch. The security operations center (SOC) has observed increased scanning activity targeting the application's IP address from external sources. The company's risk tolerance for web application vulnerabilities is low. Which of the following should the analyst recommend as the immediate next step?

Accepted Answer

Deploy a web application firewall (WAF) with rules to block SQL injection attempts.. Deploying a WAF with rules to block SQL injection attempts is the immediate next step because it provides a virtual patch that mitigates the vulnerability while the development team works on the permanent code fix. Given the low risk tolerance and active external scanning, this reduces the attack surface without taking the application offline, which would disrupt customer order submissions.

Answer

Increase logging and monitoring for SQL injection attempts.

Answer

Disable the web application until the patch is deployed.

Answer

Request the development team to expedite the patch within one week.

Question 11

During a forensic investigation, an analyst must acquire digital evidence while maintaining forensic soundness. Which THREE practices should the analyst follow? (Choose three.)

Accepted Answer

Verify the hash of the image against the original. Option C is correct because hashing the acquired image (e.g., with MD5 or SHA-256) and comparing it to the hash of the original source proves the copy is a bit-for-bit duplicate and has not been altered, which is essential to forensic soundness and admissibility. Option D is correct because a hardware or software write blocker prevents any write operations from reaching the suspect drive during imaging, preserving the integrity of the original evidence. Option E is correct because maintaining a detailed chain of custody and documenting every action (tools, timestamps, hashes, personnel) ensures the acquisition is reproducible, defensible, and legally admissible. Option A is not appropriate because using the suspect's operating system can modify file metadata (MAC times) and alter the evidence, violating forensic soundness. Option B is not appropriate as a general acquisition practice because powering on the system can change volatile and non-volatile data; volatile data should only be captured under a documented, justified order of volatility when necessary, not as a blanket first step.

Answer

Use the suspect's operating system to copy files

Answer

Power on the system to capture volatile data first

Question 12

A security analyst is responding to a potential data exfiltration incident. As part of the containment strategy, the analyst must preserve evidence. Which TWO actions should the analyst take before containment? (Select two.)

Accepted Answer

Capture a forensic image of the affected systems. Option A is correct because capturing a forensic image of the affected systems creates a bit-for-bit copy of volatile and non-volatile data (using tools like dd, FTK Imager, or EnCase) that preserves evidence in its original state before any containment actions alter the system. Option D is correct because recording current active network connections (e.g., via netstat, ss, or Get-NetTCPConnection) captures volatile evidence such as established sessions, remote IP addresses, and ports that would be lost once the system is isolated or processes are terminated. Option B is not appropriate because changing passwords modifies system state and can destroy evidence of credential compromise or attacker persistence. Option C is a containment action itself, not an evidence-preservation step, and would eliminate live network artifacts. Option E is also a containment/remediation action that destroys volatile memory evidence such as running processes and their associated network connections.

Answer

Change passwords for affected accounts

Answer

Disconnect the system from the network

Answer

Kill malicious processes

Question 13

An organization's incident response team is classifying an incident based on severity and priority. Which TWO factors should the team consider when determining the priority of an incident? (Select TWO.)

Accepted Answer

The potential business impact of the incident.. Option B is correct because incident priority is driven primarily by the potential business impact — how severely the incident could disrupt operations, revenue, reputation, or regulatory obligations — which determines how urgently the response must be escalated. Option C is correct because the criticality of the affected systems or data (for example, a domain controller, PII database, or payment processing system) directly shapes priority, since a compromise of high-value assets warrants faster and more aggressive response than one on a low-value endpoint. Together, business impact and asset criticality are the standard inputs for priority scoring in frameworks such as NIST SP 800-61, which separates severity (technical impact) from priority (business-driven urgency). Option A is not a priority factor per se; the number of users reporting an issue may indicate scope but does not by itself establish business urgency. Option D is not a defining factor, since time of day may affect staffing but not the inherent priority of the incident. Option E is also not a priority determinant; the type of threat actor is relevant to threat intelligence and attribution, not to how urgently the business must respond.

Answer

The number of users reporting the issue.

Answer

The time of day the incident occurred.

Answer

The type of threat actor involved.

Question 14

Which TWO of the following are indicators of potential data exfiltration via DNS?

Accepted Answer

High volume of TXT record queries. TXT records are commonly used in DNS tunneling to encode exfiltrated data. Attackers embed data in TXT record queries or responses, and a high volume of such queries is a strong indicator of data exfiltration via DNS.

Answer

Unusual TLS handshake patterns

Answer

Traffic to known malicious IPs over HTTP

Answer

Large number of NXDOMAIN responses

Question 15

A security analyst is using Qualys to perform a vulnerability scan on a public-facing web server. The scan results show that the server is running an outdated version of Apache HTTP Server with multiple known vulnerabilities. The analyst checks the vendor security advisories and finds that a patch was released three months ago. However, the server is in a staging environment and not yet in production. What should the analyst recommend?

Accepted Answer

Patch the server immediately because it poses a risk to the staging network.. Even in staging, an unpatched public-facing web server with known Apache vulnerabilities is exploitable and can serve as a pivot point into the staging network or be used to attack other environments. Best practice is to patch immediately regardless of environment, because staging often shares credentials, network paths, or data with production. Deferring patching until production migration compounds risk.

Answer

Only patch if the vulnerability is rated critical.

Answer

Do not patch because the server is not in production.

Answer

Wait until the server moves to production to patch.