CS0-003 Practice Test 4 — 10 Questions

Question 1

A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol for exchanging that intelligence over HTTPS. Together, they provide a standardized format and transport mechanism for sharing threat intel between organizations, as required by the question.

Answer

REST

Answer

SOAP

Answer

SNMP

Question 2

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This approach transparently acknowledges the residual risk rather than hiding it, aligning with the principle of risk treatment as defined in NIST SP 800-53 and ISO 27005.

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Answer

Give all users local admin rights

Question 3

A security analyst is evaluating a vulnerability with CVSS v3.1 base score: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N. Which of the following best describes the scope and impact of this vulnerability?

Accepted Answer

Scope is changed, high impact on confidentiality only. The CVSS v3.1 vector AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N indicates Scope is Changed (S:C) and Confidentiality impact is High (C:H), while Integrity (I:N) and Availability (A:N) impacts are None. Therefore, the correct description is scope changed with high impact on confidentiality only. The other options misstate either the scope or the impacted security property.

Answer

Scope is unchanged, high impact on confidentiality only

Answer

Scope is changed, high impact on integrity only

Answer

Scope is unchanged, high impact on confidentiality and integrity

Question 4

Which type of threat intelligence report is most appropriate for communicating long-term trends and strategic risks to senior executives?

Accepted Answer

Strategic intelligence. Strategic threat intelligence focuses on high-level, long-term trends, adversary motivations, and geopolitical or business risks — exactly what senior executives need for decision-making and risk budgeting. It is typically delivered as reports or briefings rather than raw indicators, and it informs strategic planning over quarters or years. Technical, tactical, and operational intelligence are all more granular and operational in nature.

Answer

Technical intelligence

Answer

Tactical intelligence

Answer

Operational intelligence

Question 5

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module specifically designed to acquire volatile memory from Linux systems in a forensically sound manner. It captures RAM contents and outputs them in formats like raw or lime, which can then be analyzed with tools such as Volatility. This makes it the correct answer for Linux memory acquisition.

Answer

dd

Answer

FTK Imager

Answer

WinPmem

Question 6

An organization needs to report a data breach involving personal data of EU residents. Under GDPR, what is the maximum time allowed for notifying the supervisory authority after becoming aware of the breach?

Accepted Answer

72 hours. GDPR Article 33 mandates that a controller notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is the maximum; earlier notification is encouraged. If notification is not made within 72 hours, it must be accompanied by reasons for the delay.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 7

A security analyst is preparing an after-action report for a phishing incident. Which component is MOST critical to include to prevent recurrence?

Accepted Answer

Lessons learned and recommendations. An after-action report exists to drive improvement, so the component that directly prevents recurrence is the lessons learned and recommendations section, which translates findings into concrete process, tooling, or training changes. While timeline, impact, and root cause feed into it, only lessons learned and recommendations prescribe the corrective actions that stop the same phishing incident from succeeding again.

Answer

Timeline of the incident

Answer

Impact assessment

Answer

Root cause analysis

Question 8

A security analyst needs to present the risk of an unpatched critical vulnerability to the board of directors. Which of the following is the most effective way to communicate the risk?

Accepted Answer

Explain the potential financial loss and reputational damage.. When communicating risk to a board of directors, the most effective approach is to translate the technical vulnerability into business impact—potential financial loss, regulatory fines, and reputational damage—because executives prioritize strategic and financial consequences over technical detail. This framing enables informed risk acceptance or remediation decisions at the governance level. CVSS scores and technical descriptions, while useful to security teams, do not resonate with non-technical leadership.

Answer

Show the CVSS score and exploit complexity.

Answer

Recommend immediate patching without details.

Answer

Describe the vulnerability in technical terms.

Question 9

Which compliance reporting requirement under GDPR mandates that organizations notify the relevant supervisory authority within a specific timeframe after becoming aware of a personal data breach?

Accepted Answer

72 hours. Under GDPR Article 33, organizations must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a core GDPR compliance requirement. The other timeframes do not match the regulation.

Answer

7 days

Answer

24 hours

Answer

48 hours

Question 10

A company uses a configuration management tool to enforce CIS Benchmarks on its servers. The security team wants to apply Level 1 benchmarks to all servers to achieve a baseline security posture. Which of the following best describes the difference between CIS Level 1 and Level 2 benchmarks?

Accepted Answer

Level 1 benchmarks are basic security measures that do not impact system performance, while Level 2 benchmarks are more restrictive and may affect performance or usability.. CIS Benchmarks define Level 1 as essential, basic security settings that can be applied broadly with minimal impact on functionality or performance, making them suitable as a universal baseline. Level 2 settings are defense-in-depth measures intended for high-security environments; they are more restrictive and may degrade performance or break usability (e.g., disabling legacy protocols or enforcing strict password policies). The question's goal of a baseline posture maps directly to Level 1.

Answer

Level 1 benchmarks are for Linux systems, while Level 2 benchmarks are for Windows systems.

Answer

Level 1 benchmarks are for servers, while Level 2 benchmarks are for workstations.

Answer

Level 1 benchmarks are mandatory, while Level 2 benchmarks are optional.