CS0-003 Practice Test 39 — 15 Questions

Question 1

A security analyst is preparing a compliance report for an upcoming audit. The auditor has requested evidence of access controls. Which TWO of the following would provide appropriate evidence? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recent access review reports. Option A (Recent access review reports) is correct because access reviews document the periodic recertification of user permissions, directly demonstrating that access controls are being enforced and validated, which is exactly the type of evidence an auditor seeks for access control compliance. Option C (User account audit logs showing privilege changes) is correct because audit logs provide a verifiable, timestamped record of when privileges were granted, modified, or revoked, serving as concrete technical evidence that access control mechanisms are functioning. Option B (A network topology diagram) is not correct because it illustrates infrastructure layout and data flows, not access control enforcement or user permissions. Option D (A list of all employees) is not correct because it merely enumerates personnel and does not show how access is granted, restricted, or reviewed. Option E (The company's password policy) is not correct because a policy is a documented intent or requirement, not evidence that access controls are actually implemented or operating effectively.

Answer

A network topology diagram

Answer

A list of all employees

Answer

The company's password policy

Question 2

A threat hunter analyzes NetFlow data and observes a host communicating with multiple external IP addresses on high-numbered ports (e.g., 49300-49500) during off-hours. The communications are short-lived and occur in burst patterns. The hunter suspects data exfiltration. Which of the following analysis techniques would best confirm or refute this suspicion?

Accepted Answer

Perform a full packet capture on the host's traffic. A full packet capture provides the actual payload and protocol details of the suspicious traffic, allowing the hunter to confirm whether data is being exfiltrated (e.g., via HTTP POST, DNS tunneling, or custom protocols) and to identify the destination and content. NetFlow only provides metadata (IPs, ports, bytes, timestamps), so packet-level inspection is required to validate the exfiltration hypothesis. This is the most direct confirmatory technique.

Answer

Correlate with authentication logs to see if the user is logged in

Answer

Check the host's registry for persistence mechanisms

Answer

Review DNS logs for domain generation algorithm patterns

Question 3

A security analyst is reviewing the results of a recent vulnerability scan. The analyst needs to prioritize remediation efforts effectively. Which four of the following factors should the analyst consider when prioritizing vulnerabilities? (Choose four.)

Accepted Answer

The asset's criticality to the organization's mission. The Common Vulnerability Scoring System (CVSS) base score provides a standardized numerical rating (0-10) of a vulnerability's severity, factoring in exploitability and impact metrics. This score helps analysts compare vulnerabilities across different systems and prioritize those with higher potential damage. It is a foundational input for risk-based prioritization, not the sole deciding factor.

Answer

The number of times a vendor has released a patch for the vulnerability

Answer

The color of the vulnerability in the scan report

Question 4

When performing digital forensics, which of the following represents the correct order of volatility from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs, archived media. The order of volatility, per RFC 3227, runs from most volatile to least: CPU registers and cache, RAM, swap/pagefile, disk (local), logs (remote), and archived media. Option D follows this sequence exactly. Capturing the most volatile data first preserves evidence that would otherwise be lost when the system powers down or memory is overwritten.

Answer

RAM, CPU registers, disk, swap, logs, archived media

Answer

Swap, RAM, CPU registers, disk, logs, archived media

Answer

Archived media, logs, disk, swap, RAM, CPU registers

Question 5

An organization uses a SIEM with a rule that triggers when a user fails to authenticate five times within 10 minutes. Last night, the rule fired for a service account from an internal IP. What should be the first triage step?

Accepted Answer

Review the account's recent activity and correlate with system logs. The best first triage step. Service accounts often have automated login attempts that may trigger false positives. Reviewing recent activity and correlating with system logs helps determine if the failures are legitimate (e.g., a script using wrong credentials) or indicate compromise. Disabling the account (A) could disrupt critical services. Blocking the IP (B) might be premature without confirmation. Resetting the password (D) could lock out the legitimate service if the account is not compromised.

Answer

Disable the service account immediately

Answer

Block the internal IP address at the firewall

Answer

Reset the service account password

Question 6

A security analyst discovers that a data breach involving personally identifiable information (PII) of European Union citizens occurred two weeks ago but was not detected until now due to a monitoring gap. The company is subject to GDPR, which requires notification to the relevant supervisory authority within 72 hours of becoming aware of the breach. The analyst reports this to the CISO, who decides to delay notification for another week to prepare a more comprehensive response. The analyst believes this violates regulatory requirements. The analyst has documented the breach details and is concerned about the legal and financial penalties for non-compliance. The company's legal department has a strong compliance focus. The analyst has a duty to escalate within the organization. The organization has a whistleblower policy and an ethics hotline. What should the analyst do?

Accepted Answer

Escalate the matter to the company's legal department and explain the regulatory requirement for timely notification.. The analyst has a duty to escalate within the organization, and the legal department is the appropriate internal authority to address compliance with GDPR's 72-hour notification requirement. By escalating to legal, the analyst ensures the regulatory obligation is formally raised without bypassing internal hierarchy, which aligns with the company's compliance focus and whistleblower policy. This approach balances the CISO's decision with the legal imperative to notify the supervisory authority within the mandated timeframe.

Answer

Document the decision and the delay, then proceed with the notification after one week as instructed.

Answer

Report the incident to the data protection authority (DPA) immediately, bypassing the CISO, as required by GDPR.

Answer

Follow the CISO's orders and delay the notification.

Question 7

A security analyst is reviewing a vulnerability scan report and sees a critical finding with a CVSS v3.1 base score of 9.8. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector component (AV:N)?

Accepted Answer

The attacker can exploit the vulnerability over a network from a remote system. In CVSS v3.1, the Attack Vector (AV) metric describes how the vulnerability is exploited. AV:N (Network) means the vulnerable component is reachable over a network layer (e.g., the internet or a LAN) and the attacker does not need local or physical access. This is the most severe AV value and contributes to the high base score of 9.8 in the given vector.

Answer

The attacker must be on the same physical network segment

Answer

The attacker requires local access to the target system

Answer

The attacker must be physically present at the device

Question 8

An incident responder is documenting the root cause of a data breach. Which THREE components are essential to include in the root cause analysis section of the incident report? (Select THREE.)

Accepted Answer

The technical vulnerability exploited. Option A is correct because the root cause analysis must identify the specific technical vulnerability that was exploited, such as an unpatched CVE, misconfigured service, or weak authentication mechanism, since this is the direct technical weakness enabling the breach. Option D is correct because human factors like insufficient security awareness training or failure to follow procedures are legitimate root causes that explain why the initial compromise succeeded. Option E is correct because process failures, such as missing patch management, inadequate access reviews, or absent change control, describe the systemic conditions that allowed the vulnerability to persist and are central to root cause analysis. Option B is not part of root cause analysis; the number of records affected is an impact or scope metric reported elsewhere in the incident report. Option C is not essential to root cause analysis; naming the specific employee who clicked the phishing email assigns individual blame rather than identifying the underlying human-factor or process cause, and may raise privacy concerns.

Answer

The number of records affected

Answer

The name of the employee who clicked the phishing email

Question 9

An organization uses Qualys for vulnerability scanning. After a scan, the security team identifies a vulnerability with an EPSS score of 0.95 and that appears in the CISA KEV catalog. However, the affected asset is a non-critical development server with no internet access. According to the vulnerability lifecycle, what should be the analyst's NEXT action?

Accepted Answer

Document the finding and schedule remediation during the next regular maintenance window.. Despite high EPSS and KEV listing, the asset's low business context (non-critical, no internet access) reduces risk; the analyst should prioritize based on business context, likely scheduling remediation with lower urgency.

Answer

Apply a compensating control, such as a firewall rule blocking access to the server.

Answer

Escalate the vulnerability to management for emergency patching.

Answer

Immediately patch the server within 48 hours due to the high EPSS score.

Question 10

A security team is using EPSS scores and CISA KEV catalog to prioritize vulnerabilities. Which combination of factors would indicate the HIGHEST priority for remediation?

Accepted Answer

High EPSS score and presence in KEV catalog. CISA KEV catalog contains vulnerabilities known to be exploited in the wild, and a high EPSS score indicates a high probability of exploitation. Together, they indicate the highest priority.

Answer

Medium CVSS score and high asset criticality

Answer

High CVSS score and low EPSS score

Answer

Low CVSS score and presence in KEV catalog

Question 11

An analyst runs a command to check active network connections on a Linux host and sees many ESTABLISHED connections to an external IP on port 443. Which command was most likely used?

Accepted Answer

netstat -anp. The `netstat -anp` command displays all active network connections (`-a`), shows numeric addresses and port numbers (`-n`), and includes the process ID and program name (`-p`). This makes it the correct tool for an analyst to quickly identify established TCP connections to an external IP on port 443, as it directly lists the state (ESTABLISHED), remote address, and associated process.

Answer

ipconfig /all

Answer

nmap -sT

Answer

tcpdump -i eth0

Question 12

An incident responder is performing containment of a ransomware incident that has encrypted files on several file servers. Which THREE actions are appropriate for long-term containment and recovery? (Select THREE)

Accepted Answer

Patching the vulnerability exploited by the ransomware. Patching the exploited vulnerability (B) is correct because it removes the initial access vector, preventing the ransomware from re-infecting systems during long-term containment and recovery. Rebuilding affected servers from known-good backups (C) is correct because encrypted systems cannot be trusted after compromise; restoring from clean backups ensures integrity and enables recovery. Rotating all service account credentials (D) is correct because ransomware often harvests credentials for lateral movement and persistence, so rotating them invalidates stolen secrets and blocks re-entry. Blocking the C2 IP (A) and isolating the affected segment (E) are valid immediate/short-term containment measures, but they do not address the root cause or restore operations, so they are not the long-term containment and recovery actions requested.

Answer

Blocking the ransomware's command-and-control IP at the firewall

Answer

Isolating the affected network segment

Question 13

A SIEM correlation rule for impossible travel is creating noise from VPN users. Which refinements should improve fidelity? (Choose two.)

Accepted Answer

Require a second signal such as new device, failed MFA, or mailbox rule creation. Requiring a second signal—such as a new device, failed MFA, or mailbox rule creation—adds an additional layer of verification that helps confirm the user's identity and intent. This reduces false positives from VPN users whose IP addresses may change rapidly, as the SIEM can now correlate the impossible travel event with other suspicious activities that indicate a genuine compromise rather than a legitimate VPN connection.

Answer

Disable all identity alerts

Answer

Treat every VPN login as malicious

Question 14

An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?

Accepted Answer

Disconnect the network cable from the server.. Disconnecting the network cable (Option B) is the correct short-term containment strategy because it immediately isolates the compromised database server from the network, preventing further lateral movement or data exfiltration, while preserving the volatile system state (memory, running processes, open network connections) for forensic analysis. This action stops active network-based attacks without altering the contents of RAM or disk, which is critical for evidence integrity.

Answer

Reboot the server into safe mode.

Answer

Power off the server to freeze the system state.

Answer

Run a memory dump with WinPmem before any action.

Question 15

Which three metrics are commonly used to measure the effectiveness of a security operations center (SOC)? (Select THREE.)

Accepted Answer

Mean Time to Respond (MTTR). Option C, Mean Time to Respond (MTTR), is correct because it measures how quickly the SOC reacts to a validated incident after detection, directly reflecting operational responsiveness. Option D, Mean Time to Remediate (MTTRem), is correct because it captures how long it takes to fully resolve or contain the threat, showing the SOC's effectiveness in restoring normal operations. Option E, Mean Time to Detect (MTTD), is correct because it measures the time from the initial compromise or event to detection, which is a core indicator of monitoring and detection capability. Options A and B are not correct: the number of firewall rules is a configuration or hygiene metric rather than a SOC performance measure, and the number of SOC employees is a staffing/resource metric, not an effectiveness outcome.

Answer

Number of firewall rules

Answer

Number of employees in the SOC