CS0-003 Practice Test 40 — 15 Questions

Question 1

During a security incident, the incident response team has identified that a phishing email led to credential theft and lateral movement. Which component of the incident report should detail the sequence of events from initial compromise to containment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Timeline. The timeline component of an incident report details the chronological sequence of events from initial compromise to containment, including the phishing email, credential theft, and lateral movement. This provides a clear narrative for understanding the incident's progression. The timeline is specifically designed to capture the sequence of events.

Answer

Root cause analysis

Answer

Impact assessment

Answer

Lessons learned

Question 2

A legal hold is issued during an investigation. Which actions support it? (Choose two.)

Accepted Answer

Preserve relevant logs, mailboxes, images, and tickets. A legal hold (litigation hold) requires preservation of all potentially relevant electronically stored information (ESI). Preserving logs, mailboxes, images, and tickets ensures that data is not altered or deleted, maintaining its integrity for forensic analysis and legal proceedings. This action directly supports the hold by preventing spoliation and ensuring compliance with discovery obligations.

Answer

Let each team decide informally what to delete

Answer

Purge audit logs to save storage

Question 3

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. The immediate priority is to contain the data exposure by restricting public access to the storage bucket, then investigate whether sensitive data was actually accessed by unauthorized parties. This aligns with the vulnerability management principle of 'contain first, investigate second' and addresses the risk of data exfiltration without waiting for a scheduled review or performing unrelated actions.

Answer

Delete all audit logs to reduce liability

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Question 4

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Accepted Answer

Overall risk posture summary. The executive summary is written for management, so it must translate technical findings into business-relevant information. Option D (Overall risk posture summary) is correct because it gives leadership a high-level view of the organization's aggregate exposure and whether risk is increasing or decreasing. Option E (Key findings that require management attention) is correct because it highlights the critical issues that need decisions, resources, or remediation prioritization from leadership. Options A and B are incorrect because raw CVSS scores and detailed technical descriptions belong in the technical body of the report, not the executive summary. Option C is also incorrect because network topology diagrams are supporting technical artifacts, not executive-level summary content.

Answer

Raw CVSS scores for all vulnerabilities

Answer

Detailed technical description of each vulnerability

Answer

Network topology diagrams

Question 5

A server team needs to fix an OpenSSL vulnerability across Linux hosts. What should the technical remediation section include? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Affected assets, package versions, patch commands or vendor guidance, validation method, and rollback notes. A technical remediation section must provide actionable steps for the remediation owner. This includes identifying affected assets and package versions, specifying patch commands or vendor guidance, outlining a validation method to confirm the fix, and including rollback notes in case the patch causes issues. Without these details, the remediation owner cannot execute the fix reliably or verify its success.

Answer

Only a red/yellow/green chart

Answer

Only the CVE headline

Answer

Only estimated financial loss

Question 6

An organization is experiencing a distributed denial-of-service (DDoS) attack targeting its web servers. The incident response team is implementing containment strategies. Which TWO actions are appropriate for short-term containment of a DDoS attack? (Choose TWO.)

Accepted Answer

Rerouting traffic through a DDoS mitigation service or scrubbing center. Option A is correct because rerouting traffic through a DDoS mitigation service or scrubbing center filters and absorbs malicious volumetric traffic before it reaches the web servers, providing immediate short-term relief during an active attack. Option E is correct because blocking the attacking IP addresses at the firewall quickly drops traffic from known malicious sources, reducing the immediate impact on the targeted web servers. Option B is not appropriate because DDoS attacks typically originate from botnets or spoofed sources, so disabling attacker accounts is neither feasible nor effective for containment. Option C is incorrect because applying a security patch addresses a software vulnerability, not an ongoing traffic-flooding attack, and would not stop the DDoS. Option D is incorrect because rebuilding web servers from clean images is a recovery action, not a short-term containment measure, and does nothing to stop the incoming attack traffic.

Answer

Disabling the accounts of the attackers

Answer

Applying a security patch to the web server software

Answer

Rebuilding the web servers from clean images

Question 7

Which of the following is the BEST method to prioritize vulnerabilities for remediation?

Accepted Answer

By asset criticality and exploitability. Prioritizing vulnerabilities by asset criticality and exploitability is the best method because it combines business impact with the likelihood of exploitation. Asset criticality ensures that vulnerabilities on high-value systems are addressed first, while exploitability (e.g., presence of a public exploit, active exploitation in the wild) indicates urgency. This risk-based approach is more effective than using a single metric like CVSS alone.

Answer

By availability of patch

Answer

By CVSS score

Answer

By number of affected hosts

Question 8

A security analyst reviews a SIEM alert that fired when a user successfully logged into a server from a remote IP address at 3 AM. The user is a system administrator who often works late. What is the most appropriate initial classification of this alert?

Accepted Answer

False positive. The alert is a false positive because the SIEM rule triggered on a legitimate login that matches the pattern of an authorized after-hours admin session. The user is a system administrator who often works late, so the activity is expected and benign. A true positive would require the login to be malicious or unauthorized, which is not the case here. Since the alert fired but the underlying activity is not a security incident, it is correctly classified as a false positive.

Answer

True positive

Answer

True negative

Answer

False negative

Question 9

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally document the risk acceptance, including compensating controls (e.g., network segmentation, host-based firewall rules) and a migration or remediation plan. This documentation is essential for stakeholder management to demonstrate due diligence and maintain a defensible security posture against audits or compliance reviews.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 10

During a patch management process, an organization uses a staging environment to test patches before deployment. Which of the following is the primary purpose of patch testing in a staging environment?

Accepted Answer

To validate that the patch addresses the vulnerability without causing regressions. The primary purpose of patch testing in a staging environment is to validate that the patch actually remediates the vulnerability it targets while ensuring it does not introduce regressions or break existing functionality. Staging mirrors production closely enough to catch compatibility issues before the patch reaches live systems, which is the core of a controlled patch management process.

Answer

To create a backup of production systems

Answer

To speed up the patch deployment process

Answer

To comply with licensing requirements

Question 11

After a security incident, which component of the incident report provides a chronological sequence of events from detection to recovery?

Accepted Answer

Timeline. The Timeline section of an incident report presents a chronological sequence of events — detection, containment, eradication, recovery — with timestamps. It is specifically designed to reconstruct what happened and when, which is exactly what the question asks for.

Answer

Lessons learned

Answer

Root cause

Answer

Impact assessment

Question 12

A cybersecurity analyst is preparing a post-incident report for a data breach that affected multiple business units. Which three of the following elements should be included in the report to ensure effective communication and support future prevention? (Choose three.)

Accepted Answer

Root cause analysis and contributing factors. A detailed timeline of the incident, including detection and response actions, is correct because it provides a chronological record essential for understanding the sequence of events, assessing response effectiveness, and meeting regulatory reporting requirements. Root cause analysis and contributing factors are correct because they identify the underlying technical or procedural failures (e.g., unpatched vulnerability, misconfigured firewall rule) that must be addressed to prevent recurrence. Recommendations for remediation and process improvements are correct because they translate findings into actionable steps, such as implementing multi-factor authentication or updating incident response playbooks, which directly support future prevention.

Answer

The specific usernames and passwords of affected accounts

Answer

The raw packet capture data from the breach period

Answer

A list of all employees’ personal contact information for notification

Question 13

A vulnerability dashboard for executives should avoid raw technical overload. Which views are useful? (Choose two.)

Accepted Answer

Critical exposure trend by business service. Executive dashboards must communicate risk in business terms, not technical raw data. A trend of critical exposures by business service translates vulnerability severity into operational impact, enabling prioritization of remediation resources without requiring technical expertise. This aligns with the Reporting and Communication domain's emphasis on tailoring information to the audience.

Answer

A list of scanner process IDs

Answer

Unfiltered plugin-output text

Question 14

A security analyst is conducting a vulnerability assessment of a Kubernetes cluster. Which TWO of the following are common misconfigurations that could lead to security risks? (Select TWO.)

Accepted Answer

Running containers in privileged mode. Option C is correct because running containers in privileged mode disables the container's isolation from the host, granting access to all Linux capabilities and devices (equivalent to --privileged), which allows a compromised container to escape and control the node. Option E is correct because hostPath mounts expose a file or directory from the node's filesystem directly into the pod, so a container can read or modify sensitive host paths such as /etc, /var/run/docker.sock, or /proc, enabling privilege escalation and node compromise. Options A and D are not misconfigurations but hardening measures: resource limits mitigate denial-of-service and noisy-neighbor risks, and read-only root filesystems prevent runtime tampering with container binaries. Option B is also a security control, not a risk, since Kubernetes NetworkPolicies restrict pod-to-pod traffic and enforce segmentation.

Answer

Setting resource limits on containers

Answer

Configuring network policies to restrict traffic

Answer

Using read-only root filesystems

Question 15

A security analyst is creating a correlation rule in the SIEM to detect DGA (Domain Generation Algorithm) activity. Which of the following data points would be most useful to include in the rule?

Accepted Answer

High number of DNS queries to domains with high entropy and frequent NXDOMAIN responses. DGA malware generates large volumes of pseudo-random domain names (e.g., 'aj3kf9x2qz.com') to locate its C2 server, and the vast majority of these domains are unregistered, producing NXDOMAIN responses. Correlating a high rate of DNS queries with high-entropy domain strings and a high NXDOMAIN ratio is the classic SIEM detection pattern for DGA beaconing. The other options describe behaviors that are either normal or unrelated to domain-generation activity.

Answer

Multiple successful connections to a single external IP

Answer

Large data transfers over HTTPS

Answer

Unusual parent-child process relationships