CS0-003 Practice Test 41 — 15 Questions

Question 1

A threat hunter is analyzing network traffic and observes a system making outbound connections to multiple IP addresses on port 53 (DNS) with unusually large payload sizes. The hunter suspects DNS tunneling. Which THREE characteristics are indicative of DNS tunneling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Large DNS payload sizes. Option A is correct because DNS tunneling encodes exfiltrated or command-and-control data inside DNS queries and responses, which inflates payload sizes well beyond the small packets typical of legitimate lookups. Option C is correct because attackers often abuse TXT or NULL records, which can carry arbitrary or binary data, to transport payloads that standard A record queries cannot hold. Option D is correct because tunneling tools generate a high volume of queries to a single domain (often with encoded subdomains) to move data continuously, making query frequency to one domain a strong indicator. Option B is not indicative because NXDOMAIN responses usually reflect mistyped or nonexistent domains rather than successful tunneling, which typically relies on the authoritative server answering queries. Option E is not indicative because standard A record queries are the normal, benign behavior of DNS resolution and do not by themselves suggest tunneling.

Answer

DNS responses with NXDOMAIN for most queries

Answer

Use of standard A record queries

Question 2

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured to enable the scan to test authenticated pages?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners require authenticated sessions to crawl and test pages behind login forms. Without session handling (e.g., cookies, tokens), the scanner only sees public content. Configuring authenticated scanning with a test account and proper session management (e.g., OWASP ZAP's session handling rules or Burp Suite's authentication pre-script) allows the scanner to maintain state and reach restricted pages, enabling full coverage of the application's attack surface.

Answer

Treat absence of findings as proof of security

Answer

Reduce the scan to only the landing page

Answer

Disable all application authentication

Question 3

A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?

Accepted Answer

CPU registers → RAM → Swap → Network connections → Disk → Archived media. The correct order of volatility is CPU registers, RAM, swap, network connections, disk, archived media. This sequence captures the most volatile data first: CPU registers are the most volatile, followed by RAM, then swap, then network connections, then disk, and finally archived media.

Answer

Disk → RAM → Swap → CPU registers → Network connections → Archived media

Answer

Network connections → CPU registers → RAM → Swap → Disk → Archived media

Answer

CPU registers → RAM → Swap → Disk → Network connections → Archived media

Question 4

A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed to validate the findings before closing or downgrading them?

Accepted Answer

Run authenticated scans using least-privilege scanner credentials. Unauthenticated scans rely on network-level probes and can only detect vulnerabilities visible without credentials, such as open ports or banner information. Patch status for Windows servers requires authenticated access to query the registry, WMI, or the Windows Update API. Using least-privilege scanner credentials enables the scanner to perform authenticated checks, revealing missing patches that were previously hidden.

Answer

Trust the unauthenticated result as complete

Answer

Disable host firewalls permanently

Answer

Increase only the port range

Question 5

A company's incident response team is handling a ransomware incident that has encrypted all files on the file server and spread to several workstations. The team has isolated the affected systems and obtained memory dumps and disk images. The CEO demands immediate restoration of operations and suggests paying the ransom to decrypt files quickly. The company has recent backups but they are stored on a network share that was also encrypted. The CISO wants to ensure that the root cause is identified before restoration. As the lead incident responder, which of the following actions should you take NEXT?

Accepted Answer

Analyze the memory dumps to identify the infection vector and check for persistence mechanisms. Analyzing the memory dumps will help identify the initial infection vector (e.g., phishing email, exploited vulnerability) and any persistence mechanisms. This information is critical to prevent reinfection after restoration. Options A, B, and C skip root cause analysis, risking reinfection. Option A is ill-advised and may not work. Option B involves restoring to a clean environment but still requires root cause analysis to ensure the environment is secure. Option C is premature as it does not identify the root cause.

Answer

Pay the ransom and then restore from the decrypted files

Answer

Restore the backups to a clean environment and then reimage the affected systems

Answer

Immediately reimage all affected systems and restore from the most recent clean backups

Question 6

The SOC receives an alert from a network sensor showing an internal host communicating with a known malicious IP over HTTPS. The analyst cannot find any process making outbound connections on the host. What should the analyst do next?

Accepted Answer

Check for hidden processes or rootkits using specialized tools. The absence of a visible process making outbound connections suggests the presence of a rootkit or hidden process that evades standard detection. Using specialized tools to check for hidden processes or rootkits is the appropriate next step to identify the malicious activity before taking containment or remediation actions.

Answer

Capture a memory dump of the host

Answer

Block the IP at the firewall

Answer

Reimage the host immediately

Question 7

A company's IDS generated an alert for a SQL injection attempt against a web server. The web application firewall (WAF) is already in place. What is the best action?

Accepted Answer

Verify if the attack succeeded by checking server logs. When an IDS alerts on a SQL injection attempt against a web server that already has a WAF, the WAF may have blocked it — but you cannot assume that. The best next step is to verify whether the attack succeeded by inspecting web server, application, and database logs for evidence of successful injection (e.g., unexpected queries, error messages, data exfiltration). Confirming impact drives the correct response and avoids unnecessary or disruptive actions.

Answer

Update the WAF rules

Answer

Block the source IP at the firewall

Answer

Shut down the web server

Question 8

During a post-incident review, the team finds that the detection was delayed by 4 hours because the SIEM rule had a low priority and was not monitored after hours. Which improvement is most effective?

Accepted Answer

Implement 24/7 SOC operations. Implementing 24/7 SOC coverage directly addresses the root cause of the detection delay: the lack of after-hours monitoring. Increasing rule priority (A) does not ensure monitoring outside business hours. Adding automated response actions (B) may speed up response but does not solve the detection gap. Including the rule in a watchlist (C) focuses visibility but still relies on human review, which is absent after hours.

Answer

Increase the priority of the rule

Answer

Add automated response actions to the rule

Answer

Include the rule in a watchlist

Question 9

A security analyst needs to present vulnerability scan results to a non-technical manager. Which of the following is MOST important to include?

Accepted Answer

Summary of critical vulnerabilities with associated business risk and recommended actions. When presenting vulnerability scan results to a non-technical manager, the most important information is a summary of critical vulnerabilities with associated business risk and recommended actions. This approach translates technical details into business impact, enabling the manager to understand the urgency and make informed decisions about resource allocation. Options B and C are too technical, while Option D lacks context and prioritization.

Answer

Raw scan output with IP addresses and ports

Answer

Detailed exploit code for critical vulnerabilities

Answer

List of all CVSS scores with no further explanation

Question 10

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal?

Accepted Answer

Sigma rule. Sigma rules are the correct choice because they are designed as a generic, open-source signature format for log events, making them portable across multiple SIEM platforms (e.g., Splunk, Elastic, QRadar) without vendor lock-in. For suspicious rundll32 execution, a Sigma rule can describe the specific event log patterns (e.g., Event ID 4688 with CommandLine containing 'rundll32.exe') that can be converted into each SIEM's native query language. This portability directly meets the threat hunter's goal of creating a detection that can be reused across different environments.

Answer

CVSS vector string

Answer

YARA rule

Answer

OpenIOC package only

Question 11

An analyst is reviewing network traffic logs and notices a series of connections from an internal workstation to an external IP address on TCP port 53. The traffic consists of large DNS queries with random-looking subdomains. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling is the technique of encoding non-DNS data (such as command-and-control instructions or exfiltrated data) inside DNS queries and responses, typically using large queries with random-looking subdomains to external authoritative servers controlled by the attacker. The use of TCP port 53 with large, high-entropy subdomains from an internal workstation to an external IP is a classic DNS tunneling signature.

Answer

Domain generation algorithm (DGA)

Answer

Beaconing

Answer

HTTP smuggling

Question 12

Which TWO of the following are best practices for vulnerability scanning in a PCI DSS compliant environment? (Select TWO)

Accepted Answer

Perform quarterly scans. Options A and E are correct. PCI DSS Requirement 11.2.1 mandates quarterly internal and external vulnerability scans, so option A is correct. Option E is correct because authenticated scanning provides more accurate results by identifying vulnerabilities visible only to authenticated users. Option B is incorrect because PCI DSS requires scanning both external and internal IP ranges, not just external. Option C is incorrect because PCI DSS does not require a single scanning vendor; organizations may use multiple vendors. Option D is incorrect because while scanning after significant network changes is a best practice, it is not a specific PCI DSS requirement in this context.

Answer

Scan only external IP ranges

Answer

Use a single scanning vendor

Answer

Scan after any significant network change

Question 13

A security analyst is tasked with performing a risk assessment for a new web application. The application will handle sensitive customer data. Which of the following should the analyst do FIRST to identify vulnerabilities specific to the application?

Accepted Answer

Conduct a threat model of the application.. Conducting a threat model helps identify potential vulnerabilities early in the development lifecycle, especially for a new application handling sensitive data. Option A is wrong because a network vulnerability scan is too broad and does not focus on application-specific vulnerabilities. Option B is wrong because penetration testing is typically performed later after the application is deployed. Option C is wrong because source code review is important but threat modeling should be performed first to identify risks at a higher level.

Answer

Run a network vulnerability scan against the application server.

Answer

Perform a penetration test on the application.

Answer

Perform a source code review.

Question 14

A security team is tuning a SIEM rule that alerts on all outbound connections to IP addresses classified as 'high risk' by threat intelligence. The rule generates many false positives because some legitimate services use these IPs. Which two actions should the analyst take to reduce false positives? (Select TWO.)

Accepted Answer

Increase the risk score threshold to only alert on very high risk IPs. Option B is correct because raising the risk score threshold so the rule only fires on 'very high risk' IPs narrows the alert set to indicators with stronger threat-intelligence confidence, filtering out lower-confidence 'high risk' entries that frequently match legitimate services. Option D is correct because adding the verified legitimate IP addresses to an exclusion list (allowlist) suppresses alerts for known-good destinations while keeping detection coverage for the remaining high-risk IPs. Option A is wrong because ignoring false positives leaves the rule noisy and risks missing true malicious connections. Option C is wrong because expanding the rule to include all risky IPs would increase, not reduce, false positives. Option E is wrong because disabling the rule eliminates detection entirely, creating a blind spot rather than tuning the rule.

Answer

Ignore the false positives and continue

Answer

Expand the rule to include all risky IPs

Answer

Disable the rule

Question 15

A security analyst is conducting a proactive threat hunt for lateral movement techniques. The analyst examines EDR data for unusual parent-child process relationships. Which three process chains are indicative of lateral movement? (Select THREE.)

Accepted Answer

svchost.exe spawning schtasks.exe. Option A is correct because svchost.exe normally hosts Windows services and should not directly spawn schtasks.exe; this parent-child chain indicates a service abusing the Task Scheduler to create or run a remote task for lateral movement. Option C is correct because services.exe is the Service Control Manager and spawning cmd.exe directly is anomalous, often reflecting a malicious service or PsExec-style remote service creation used to execute commands on a target host. Option D is correct because wmiprvse.exe is the WMI provider host, and a WMI provider spawning cmd.exe is a classic sign of remote WMI execution (for example, wmic /node: process call create) used for lateral movement. Option B is not indicative by itself because explorer.exe spawning cmd.exe is a common, legitimate user action such as opening a command prompt. Option E is not a reliable lateral-movement indicator because rundll32.exe spawning powershell.exe, while suspicious in some contexts, is a generic execution chain that can occur from local scripts or malware and does not specifically demonstrate lateral movement.

Answer

explorer.exe spawning cmd.exe

Answer

rundll32.exe spawning powershell.exe