CS0-003 Practice Test 42 — 15 Questions

Question 1

A security analyst is reviewing the results of a vulnerability scan. The analyst sees a plugin output that includes the CVSS vector string AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. What is the base score of this vulnerability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

9.8. The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H represents a network-exploitable vulnerability with low attack complexity, no privileges or user interaction required, unchanged scope, and high impact to confidentiality, integrity, and availability. This combination yields a base score of 9.8 (Critical), the maximum for an unchanged-scope vulnerability.

Answer

6.5

Answer

10.0

Answer

7.5

Question 2

A security analyst is reviewing a vulnerability scan report and sees a plugin with a CVSS v3.1 base score of 7.5. The attack vector is 'Network', attack complexity is 'Low', privileges required is 'None', user interaction is 'None', scope is 'Unchanged', and the confidentiality impact is 'High', but integrity and availability impacts are 'None'. This vulnerability is best described as:

Accepted Answer

An information disclosure vulnerability. The vector indicates a remote, easily exploitable vulnerability that only affects confidentiality (e.g., information disclosure).

Answer

A remote code execution vulnerability

Answer

A denial of service vulnerability

Answer

A privilege escalation vulnerability

Question 3

Based on the scan output, which vulnerability should be prioritized first for remediation?

Accepted Answer

CVE-2020-15778. CVE-2020-15778 is a critical command injection vulnerability in OpenSSH's scp utility that allows an unauthenticated remote attacker to execute arbitrary commands on the target system by crafting a malicious scp source path. This vulnerability has a CVSS score of 9.8 (Critical) and is remotely exploitable without authentication, making it the highest priority for remediation over the other listed CVEs.

Answer

CVE-2019-16905

Answer

CVE-2020-12060

Answer

Both A and B equally.

Question 4

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. The question has two parts: the best containment action and a detection/tuning approach to reduce noise without losing the signal. For the containment part, network-isolating the endpoint via EDR (e.g., using a built-in quarantine feature) stops the beaconing to the malicious IP and halts credential dumping while preserving disk and memory evidence for forensic analysis. This balances incident response needs with evidence preservation. The detection/tuning part is not directly addressed by the options, but in detection engineering, tuning EDR to alert on beaconing and credential dumping behavior—while using exclusion lists or behavioral baselines to filter false positives—would reduce noise without losing the signal. Option A is the correct containment action.

Answer

Run disk cleanup to remove temporary files

Answer

Power off the machine immediately in every case

Answer

Allow the host to run until the next maintenance window

Question 5

An analyst is performing static analysis on a suspicious executable. The analyst discovers that the PE file has a suspicious section name and a high entropy value. Which tool or technique would be MOST useful for further analyzing the packed nature of the file?

Accepted Answer

Using PEiD or similar packer identifier. PEiD or similar tools can detect packers by scanning for known signatures. High entropy and suspicious section names often indicate packing, so using a packer identifier is appropriate.

Answer

Extracting strings from the binary

Answer

Using a YARA rule to detect the packer

Answer

Running the file in a sandbox

Question 6

A laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible?

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Proper chain of custody documentation is critical for evidence admissibility in legal proceedings. The responder must record who collected the evidence, the exact date and time, the physical location, cryptographic hash values (e.g., SHA-256) to verify integrity, transfer details (e.g., chain-of-custody forms), and the secure storage location. This ensures the evidence is not tampered with and can be defended in court. For the post-incident improvement phase, the most defensible decision is to formalize and enforce the same comprehensive documentation procedures based on lessons learned, thereby strengthening the overall incident response process and ensuring evidence integrity in future investigations.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title

Question 7

During a post-compromise review, a company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible? which action should be prioritized before closure?

Accepted Answer

Tabletop exercise using a realistic ransomware scenario. A tabletop exercise is the best choice for the first question because it allows legal, PR, IT, and executives to discuss and validate their roles during a ransomware scenario without impacting production systems, aligning with NIST SP 800-61 Rev. 2 guidance. For the second question, during post-incident improvement, conducting a tabletop exercise is the most defensible decision as it tests the updated incident response plan in a low-risk environment, providing objective evidence of readiness before committing to changes. For the third question, before closure, prioritizing the scheduling of a tabletop exercise ensures that lessons learned are incorporated and stakeholders are retrained, making it a critical action to formally close the incident.

Answer

Purchasing a new SIEM without testing procedures

Answer

Annual password reset only

Answer

Full destructive malware detonation in production

Question 8

After a high-priority SOC escalation, file shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action?

Accepted Answer

Isolate the workstation and disable its active sessions to file servers. Isolating the workstation and disabling its active sessions to file servers is the best immediate containment action. This stops the encryption and lateral spread, follows NIST SP 800-61 and standard incident response procedures, and prioritizes containment before investigation or remediation.

Answer

Run vulnerability scans on every subnet first

Answer

Restore backups before isolating the host

Answer

Email all users the ransom note

Question 9

Arrange the steps for a typical digital forensics investigation process.

Accepted Answer

Step 1: Identification, Step 2: Preservation, Step 3: Collection, Step 4: Examination, Step 5: Presentation. Digital forensics follows identification, preservation, collection, examination, and presentation.

Answer

Step 1: Preservation, Step 2: Identification, Step 3: Collection, Step 4: Examination, Step 5: Presentation

Answer

Step 1: Identification, Step 2: Collection, Step 3: Preservation, Step 4: Examination, Step 5: Presentation

Answer

Step 1: Identification, Step 2: Preservation, Step 3: Examination, Step 4: Collection, Step 5: Presentation

Question 10

During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first?

Accepted Answer

Time synchronization and timezone normalization across log sources. The five-minute discrepancy between firewall and endpoint events for the same connection is a classic symptom of clock drift or misconfigured time synchronization. The analyst should first check NTP (Network Time Protocol) settings and timezone normalization across all log sources to ensure timestamps are aligned. Without synchronized time, correlation of events during incident reconstruction is unreliable, making this the foundational step in root-cause analysis.

Answer

Delete one source from the timeline

Answer

Assume the firewall logs are falsified

Answer

Prioritize only the source with the highest EPS

Question 11

A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For validation, Which action should be taken before closing or downgrading the finding?

Accepted Answer

Documented risk acceptance with compensating controls and a migration/remediation plan. When a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally accept the risk by documenting the risk acceptance, implementing compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and creating a migration or remediation plan to eventually retire or replace the system. This aligns with the NIST SP 800-53 risk management framework and ensures auditability.

Answer

Give all users local admin rights

Answer

Mark the vulnerability as fixed

Answer

Remove the system from future reports

Question 12

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. It directly maps to the requirement of showing whether critical findings are fixed within policy timelines. SLA compliance by severity, asset owner, and business unit provides the necessary metrics to track remediation against defined service-level agreements, which is exactly what a vulnerability programme needs to demonstrate adherence to policy timelines. For executive leadership, this content choice is most appropriate as it offers a high-level, actionable view of compliance status across organizational units without technical noise.

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Answer

A report sorted only by scanner plugin ID

Question 13

A security analyst needs to report a critical vulnerability to the executive team. The report should balance technical details with business impact. Which of the following is the BEST approach?

Accepted Answer

Explain the vulnerability in terms of potential business impact and recommended risk treatment. It directly addresses the core requirement of balancing technical details with business impact. For a critical vulnerability, the executive team needs to understand the potential financial, operational, and reputational risks, not just the technical flaw. This approach aligns with the NIST risk management framework, which emphasizes communicating risk in terms of business context to enable informed decision-making on risk treatment (e.g., accept, mitigate, transfer, avoid).

Answer

Simply state the vulnerability exists and a patch is available

Answer

Write a 50-page report covering every technical detail and mitigation option

Answer

Provide a full technical analysis of the vulnerability and remediation steps

Question 14

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot that balances containment with evidence preservation?

Accepted Answer

Decode the command and inspect the process tree, parent document, and network destination. The encoded PowerShell command is the most direct artifact of the attacker's intent; decoding it reveals the executed payload, while inspecting the process tree confirms the parent-child relationship (winword.exe spawning powershell.exe), the parent document identifies the phishing vector, and the network destination pinpoints the C2 server. This triage provides the evidence needed for containment without destroying forensic data.

Answer

Close the alert because HTTPS is expected traffic

Answer

Disable the SIEM parser for PowerShell events

Answer

Reimage every workstation in the department

Question 15

A business owner accepts delayed remediation for a production system. What must the report include? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Risk owner, reason, compensating controls, review date, and expiry. When a business owner accepts delayed remediation for a production system, the report must formally document the risk acceptance. This includes the risk owner, the reason for acceptance, any compensating controls in place, a scheduled review date, and an expiry date for the exception. This ensures traceability, accountability, and that the risk is not forgotten, aligning with governance frameworks like NIST SP 800-37 or ISO 27001.

Answer

Only the analyst's personal opinion

Answer

A permanent exception with no review

Answer

No mention of the accepted risk