CS0-003 Practice Test 43 — 15 Questions

Question 1

An organization's compliance dashboard shows a control effectiveness score of 85%. Which type of evidence best supports this score?

Accepted Answer

Penetration test results and audit reports. A control effectiveness score of 85% reflects how well implemented controls are actually performing against their intended objectives. Penetration test results and audit reports provide direct, independent evidence of whether controls are functioning as designed—pen tests actively attempt to bypass controls, while audits verify their operational status. These sources offer the most objective and comprehensive validation of control effectiveness, making them the best evidence to support such a score.

Answer

Incident response logs

Answer

Employee training records

Answer

Vendor documentation

Question 2

Which TWO of the following are key phases of the incident response process as defined by NIST?

Accepted Answer

Preparation. The NIST SP 800-61 Rev. 2 incident response lifecycle consists of four key phases: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Option C (Preparation) is correct because it is the foundational phase where policies, tools (e.g., SIEM, EDR), and communication plans are established before any incident occurs. Option E (Post-Incident Activity) is correct because it includes lessons learned, evidence retention, and report generation to improve future response efforts.

Answer

Recovery

Answer

Containment

Answer

Eradication

Question 3

A security analyst is reviewing SIEM alerts and sees multiple failed logon events from a single external IP address across several user accounts within two minutes. The source IP is from a known malicious geolocation. What type of attack is most likely occurring?

Accepted Answer

Password spraying attack. The scenario describes multiple failed logon attempts from a single external IP address across several different user accounts within a short timeframe. This is the classic signature of a password spraying attack, where an attacker attempts to gain access by testing a few common passwords (like 'Password123!') against many different usernames to bypass account lockout policies that would trigger if they targeted a single account with multiple passwords.

Answer

Distributed denial-of-service (DDoS) attack

Answer

Brute-force attack

Answer

Pass-the-hash attack

Question 4

A company policy requires that all security incidents be reported to management within one hour of detection. An analyst discovers a low-severity incident (a single malware download attempt blocked by antivirus) at 4:55 PM on a Friday. The analyst is about to leave for the weekend. What should the analyst do?

Accepted Answer

Report the incident immediately according to policy, even if it means staying late.. The company policy explicitly requires reporting all security incidents within one hour of detection, regardless of severity. The analyst must report the incident immediately, even if it means staying late, as policy compliance is mandatory and low-severity incidents still represent a security event that could indicate broader compromise or be part of a larger attack chain. Delaying reporting violates the policy and could lead to disciplinary action or missed escalation windows.

Answer

Document the incident in the ticketing system and report it the next business day.

Answer

Report the incident via email and ignore it until Monday.

Answer

Wait until Monday morning to report, as it is low severity.

Question 5

A security analyst is preparing a vulnerability report for the IT operations team. Which section should provide a high-level overview of the organization's risk posture?

Accepted Answer

Executive summary. The executive summary provides a concise overview of key findings and risk posture for management.

Answer

Risk acceptance

Answer

Remediation timeline

Answer

Findings by severity

Question 6

A company uses a centralized logging solution. A security analyst receives a log from a host indicating a user account 'jsmith' was created locally on a server. The analyst suspects this is a backdoor account. Which of the following log sources would provide the most context to confirm the creation method and identify the responsible process?

Accepted Answer

Sysmon Event ID 1 (Process creation). Sysmon Event ID 1 captures every process creation event with detailed command-line arguments, parent process information, and hashes. This allows the analyst to see exactly which executable (e.g., net.exe, powershell.exe, or a custom script) created the 'jsmith' user account and what command-line parameters were used, providing definitive evidence of the creation method and responsible process.

Answer

Network logs

Answer

Application logs

Answer

Windows Security Event Logs (Event ID 4720)

Question 7

During a threat hunting engagement, a hunter creates a hypothesis that adversaries may be using PowerShell to perform reconnaissance via Active Directory cmdlets. The hunter decides to look for events where PowerShell loaded the ActiveDirectory module. Which of the following detection techniques is most appropriate?

Accepted Answer

Create a SIEM correlation rule that triggers on Event ID 4104 (PowerShell Script Block Logging). Event ID 4104 is generated by PowerShell Script Block Logging and captures the actual script block text executed, including the commands that import and invoke Active Directory cmdlets. A SIEM correlation rule on 4104 can detect patterns like 'Import-Module ActiveDirectory' or 'Get-ADUser' that indicate AD reconnaissance. This gives the hunter visibility into the exact PowerShell code executed on endpoints, which is the most direct evidence of the hypothesized behavior.

Answer

Perform a packet capture to analyze PowerShell network traffic

Answer

Deploy a YARA rule on endpoints to scan for malicious PowerShell scripts

Answer

Use osquery to query running PowerShell processes

Question 8

A security analyst must prepare a report on a recent intrusion for a technical audience (IT staff and security engineers). Which TWO elements should be included?

Accepted Answer

Indicators of compromise (IoCs). Indicators of Compromise (IoCs) are essential for a technical audience because they provide the forensic artifacts—such as IP addresses, file hashes, registry keys, and domain names—that security engineers need to detect, contain, and eradicate the intrusion. Including IoCs enables the IT staff to update detection signatures, block malicious infrastructure, and perform host-based threat hunting, directly supporting incident response and future prevention.

Answer

Estimated financial cost of the incident

Answer

Full exploit code used in the attack

Answer

Executive summary explaining business impact

Question 9

What is the net effect of the policy shown in the exhibit on requests from an IP address in the 10.0.0.0/8 range?

Accepted Answer

Denies all S3 actions from all IP addresses.. The exhibit shows an AWS S3 bucket policy with a Deny effect for all S3 actions (s3:*) from any IP address (the condition block uses a NotIpAddress condition with the value 10.0.0.0/8, meaning the deny applies to all IPs that are NOT in that range). However, because the policy explicitly denies all actions for all IPs not in 10.0.0.0/8, and there is no corresponding Allow statement for the 10.0.0.0/8 range, the net effect is that all S3 actions are denied from all IP addresses, including those in 10.0.0.0/8. This is because AWS IAM policies default to implicit deny, and an explicit deny overrides any allow, so without an explicit allow for the 10.0.0.0/8 range, the deny applies universally.

Answer

Allows all S3 actions from the 10.0.0.0/8 range and denies from other IPs.

Answer

Denies all S3 actions except GetObject from the 10.0.0.0/8 range.

Answer

Allows GetObject requests from the 10.0.0.0/8 range and denies all other S3 actions.

Question 10

An analyst is reviewing a suspicious executable using static analysis. Which of the following would provide information about the functions the executable imports from system libraries?

Accepted Answer

Import table analysis. The import table (also called the import address table, IAT) lists the functions an executable imports from system libraries (DLLs), such as kernel32.dll or user32.dll. Static analysis of the import table reveals which APIs the malware calls, providing insight into its capabilities (e.g., file I/O, network communication, registry manipulation). This directly answers the question about functions imported from system libraries.

Answer

PE header analysis

Answer

String extraction

Answer

YARA rule creation

Question 11

Which TWO of the following are key components of an incident communication plan?

Accepted Answer

Escalation contact list. An incident communication plan must include an escalation contact list (A) to ensure that the right stakeholders—such as the incident response team, legal counsel, and executive management—are notified promptly based on the severity of the incident. Pre-approved public statements or scripts (B) are critical to maintain consistent, accurate, and legally vetted messaging to external parties (e.g., customers, media, regulators) during a crisis, preventing unauthorized disclosures that could worsen the situation.

Answer

Network topology diagrams

Answer

Encryption keys for secure communications

Answer

System event logs

Question 12

A cloud posture scan finds a storage bucket with public read access containing customer exports. What should the team do first? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Restrict public access and determine whether sensitive data was accessed. The immediate priority is to stop the data leak by restricting public read access to the storage bucket, then investigate whether sensitive data was actually accessed. This aligns with the incident response principle of containment before analysis. In cloud environments like AWS S3 or Azure Blob Storage, a bucket with public read access exposes all objects to the internet, and the first step is to apply a bucket policy or ACL to deny public access.

Answer

Wait for the next quarterly review

Answer

Rotate database administrator passwords only

Answer

Delete all audit logs to reduce liability

Question 13

An emergency patch may break a revenue-critical system. Which actions balance risk and availability? (Choose two.)

Accepted Answer

Test the patch in a representative staging environment. Testing the emergency patch in a representative staging environment that mirrors the production system's configuration, dependencies, and load allows you to identify potential breaking changes before deployment. This balances risk by validating the patch's impact on revenue-critical systems while maintaining availability, as any failures are contained in the test environment. Option B is correct because applying temporary compensating controls—such as additional monitoring, rate limiting, or failover mechanisms—provides a safety net that reduces the blast radius of a potential patch failure, enabling you to proceed with deployment while preserving system availability.

Answer

Disable monitoring to avoid alerts during the change

Answer

Ignore active exploitation until the next annual review

Question 14

During the post-incident analysis phase of an incident response process, which of the following activities are considered essential best practices? Choose all that apply. (There are four correct answers.)

Accepted Answer

Identifying gaps in existing security controls that allowed the incident to occur.. A detailed timeline is essential for reconstructing the sequence of events, identifying the initial compromise vector, and measuring response effectiveness. It provides a factual basis for all subsequent analysis and reporting, ensuring that the incident response team can accurately assess the scope and impact of the incident.

Answer

Immediately deleting all logs related to the incident to free up storage space.

Answer

Notifying law enforcement and regulatory bodies before conducting any internal investigation.

Question 15

Based on the exhibit, which type of issue is most likely affecting the server's network performance?

Accepted Answer

Faulty network cable or interface. The exhibit shows excessive CRC errors and runts on the server's network interface, which are classic symptoms of a faulty physical layer component such as a damaged cable or failing NIC. These errors indicate that frames are being corrupted during transmission, and the interface is discarding them, leading to retransmissions and degraded performance. A faulty cable or interface directly causes these physical-layer issues, unlike configuration or driver problems.

Answer

Duplex mismatch between the server and switch

Answer

Incorrect TCP/IP configuration

Answer

Outdated network driver