CS0-003 Practice Test 44 — 15 Questions

Question 1

A security analyst notices that an IDS is generating a high number of false positives for legitimate encrypted traffic. Which tuning method should the analyst use to reduce false positives without reducing detection capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Whitelist the source IP addresses of known, trusted servers.. Whitelisting the source IP addresses of known, trusted servers reduces false positives by instructing the IDS to ignore alerts for encrypted traffic from those specific hosts. This approach preserves detection capability because the IDS continues to apply all signatures to traffic from other, potentially malicious sources. It is a targeted tuning method that does not disable detection mechanisms or alter sensitivity thresholds, which could otherwise miss real threats.

Answer

Disable the signatures that trigger for encrypted traffic.

Answer

Increase the sensitivity threshold for the encrypted traffic signatures.

Answer

Enable full packet capture and analyze the encrypted traffic manually.

Question 2

A security analyst is investigating a containerized environment. A scan using Trivy has identified a critical vulnerability in a container image. The container is running in a Kubernetes cluster with a Pod Security Policy that disallows privileged containers. Which additional concern should the analyst address?

Accepted Answer

The analyst should immediately patch the image, but also verify that the Pod Security Policy prevents privilege escalation. A critical vulnerability in a container image remains a real risk even if the container is not privileged, because the vulnerability could still be exploited for data exfiltration, denial of service, or lateral movement within the cluster. The analyst should patch the image and also verify that the Pod Security Policy actually prevents privilege escalation, since misconfigurations or policy gaps could allow an attacker to escalate privileges after exploiting the vulnerability.

Answer

The vulnerability is not exploitable due to the Pod Security Policy

Answer

The vulnerability is automatically mitigated because the container is not privileged

Answer

The analyst should ignore the vulnerability because the container is not privileged

Question 3

An organization is implementing a new security incident response plan and wants to establish clear communication protocols. Which three of the following are essential components of effective incident communication? (Choose three.)

Accepted Answer

Establishing pre-approved templates for different incident types. Defining a single point of contact (POC) for each stakeholder group ensures clear, controlled communication and prevents conflicting information. Pre-approved templates for different incident types enable rapid, consistent, and accurate notifications without needing to craft messages from scratch during a crisis. An escalation matrix with authority levels ensures that decisions are made by the appropriate personnel based on incident severity, preventing delays and unauthorized actions.

Answer

Automatically releasing incident details to the press within one hour

Answer

Including all employees in every incident notification to ensure transparency

Answer

Using only email for all incident updates to maintain a written record

Question 4

A tabletop exercise reveals that no one knows who can approve public statements. What should be updated? (Choose two.)

Accepted Answer

Contact list and escalation matrix. The tabletop exercise revealed a gap in the incident response process: no one knows who can approve public statements. This is a procedural and communication failure, not a technical one. Updating the incident communication plan with named approval roles (Option D) directly addresses this by defining the specific person or role authorized to speak publicly. The contact list and escalation matrix (Option B) must also be updated to ensure the correct approver can be reached quickly, as it provides the hierarchical path and contact details needed to execute the plan.

Answer

The office seating plan only

Answer

The malware signature database only

Question 5

A small business with 50 employees has been hit by ransomware. All files on the file server and local workstations are encrypted, and the ransom note demands $5,000 in Bitcoin for the decryption key. The CEO is panicking and wants to know the impact on operations and how to proceed. The security analyst has been tasked with preparing a report for the CEO. The company does not have cyber insurance, has minimal IT staff, and relies heavily on email and shared drives for daily operations. The analyst has identified that there is a one-week-old backup but is unsure of its integrity. The analyst must consider that the CEO has limited technical knowledge and that the report will form the basis for critical business decisions. The company's reputation and customer trust are at stake. The analyst must balance transparency with clear, actionable guidance. Which of the following is the BEST approach for the analyst to take in communicating with the CEO?

Accepted Answer

Summarize the situation in non-technical terms, explain the business impact (e.g., inability to access customer data, potential revenue loss), outline recovery options (e.g., restore from backups or pay ransom with risks), and recommend immediate steps.. The best approach is to communicate in business terms the CEO can understand: summarize the incident, explain operational and financial impact, present recovery options with risks, and recommend immediate actions. This balances transparency with actionable guidance, enabling informed decision-making.

Answer

Provide a detailed technical timeline of the ransomware infection, including the malware variant and encryption algorithm used.

Answer

Tell the CEO that the incident is being handled and not to worry, then proceed with recovery without further updates.

Answer

Immediately contact law enforcement and advise the CEO to wait for their instructions without providing additional information.

Question 6

An organization has identified a ransomware outbreak on several workstations. Which TWO actions should the incident response team take immediately?

Accepted Answer

Disconnect all network shares to prevent encryption.. Option B is correct because disconnecting or disabling network shares (e.g., SMB/CIFS shares) immediately limits the ransomware's ability to propagate laterally and encrypt files on shared network resources, which is a critical containment step during an active outbreak. Option E is correct because isolating the affected workstations from the network (e.g., unplugging the Ethernet cable, disabling Wi-Fi, or placing them in a quarantine VLAN) prevents the malware from spreading to other systems and stops further command-and-control communication. Option A is not appropriate because paying the ransom is discouraged, does not guarantee data recovery, and may fund criminal activity. Option C, while often advisable, is not an immediate technical containment action and typically follows initial isolation. Option D is not immediate because reimaging should occur only after containment, eradication, and forensic evidence preservation, not as a first response.

Answer

Pay the ransom to recover data quickly.

Answer

Contact law enforcement for guidance.

Answer

Reimage all affected systems immediately.

Question 7

A security analyst needs to share threat intelligence data with a partner organization as part of an information sharing agreement. Which of the following is the most critical consideration before sharing the data?

Accepted Answer

The classification level and handling restrictions. The classification level and handling restrictions are the most critical consideration because threat intelligence often contains sensitive information such as indicators of compromise (IOCs) that may be classified or subject to legal handling requirements (e.g., TLP markings). Sharing data without verifying classification could violate security policies, breach confidentiality agreements, or expose critical vulnerabilities to unauthorized parties, undermining the trust and legality of the information-sharing agreement.

Answer

The volume of data being shared

Answer

The data format (e.g., STIX, TAXII)

Answer

The geographic location of the partner

Question 8

A SOC team is tuning a SIEM to reduce false positives. Which THREE of the following metrics should the team consider when evaluating detection effectiveness? (Choose THREE)

Accepted Answer

False Positive Rate. A is correct because False Positive Rate (FPR) measures the proportion of benign events incorrectly flagged as malicious, directly indicating how much noise the SIEM generates. Reducing FPR is a primary goal when tuning detection rules to minimize analyst fatigue and improve alert fidelity.

Answer

Number of detected events

Answer

Mean Time to Detect (MTTD)

Question 9

An organization uses OpenSCAP to perform compliance scanning. The scan results indicate that a system fails to meet a STIG requirement. Which of the following best describes the purpose of STIGs?

Accepted Answer

They are developed by the DoD to secure its information systems. STIGs (Security Technical Implementation Guides) are configuration standards developed by the Defense Information Systems Agency (DISA), a DoD agency, to provide mandatory technical security controls for hardening DoD information systems. They define specific settings, patch levels, and configuration baselines that systems must meet to be authorized for use within the DoD. OpenSCAP uses SCAP content (often derived from STIG benchmarks) to automatically assess compliance against these requirements, which is why a failed STIG check indicates a deviation from DoD-mandated configuration.

Answer

They are used solely for web application security

Answer

They are vulnerability scoring standards

Answer

They are industry-standard benchmarks for cloud security

Question 10

An incident report includes a section that details the sequence of events from initial compromise to containment. Which component of the incident report does this describe?

Accepted Answer

Timeline. The timeline component of an incident report provides a chronological record of events, from the initial compromise through detection, response, and containment. It answers the 'when' and 'in what order' questions, which is exactly what the question describes. Other components like impact assessment, root cause, and lessons learned focus on consequences, underlying reasons, and improvements, respectively.

Answer

Impact assessment

Answer

Root cause

Answer

Lessons learned

Question 11

During a security incident, the SOC team identifies indicators of compromise (IoCs) related to a new malware strain. Which type of threat intelligence report should be produced for the SOC team to enhance detection?

Accepted Answer

Tactical intelligence report with IoCs and detection signatures. Tactical threat intelligence focuses on immediate, actionable indicators such as file hashes, IP addresses, domain names, and YARA rules that SOC analysts can directly load into SIEM, IDS/IPS, or endpoint detection tools to enhance detection. Since the SOC team needs to detect the new malware strain, a tactical report with IoCs and detection signatures provides the specific technical artifacts required for signature-based and anomaly-based detection. This type of intelligence is consumed at the analyst level and is designed for machine-readable consumption, enabling rapid deployment of detection logic.

Answer

Technical intelligence report on malware code analysis

Answer

Strategic intelligence report on global threat trends

Answer

Operational intelligence report on threat actor campaigns

Question 12

A security analyst is reviewing a vulnerability scan report from Rapid7 InsightVM. The report shows that a Tomcat server has a plugin finding indicating that the 'Server' header is set to 'Apache-Coyote/1.1', which reveals the server version. Which type of vulnerability does this represent?

Accepted Answer

Security misconfiguration. The 'Server' header revealing the server version is a security misconfiguration because it exposes unnecessary information that could aid attackers in targeting known vulnerabilities. This falls under the OWASP Top 10 category of Security Misconfiguration. It is not a direct vulnerability but a configuration weakness that should be remediated by suppressing version details.

Answer

Broken access control

Answer

Injection vulnerability

Answer

Cryptographic failure

Question 13

Which of the following is a primary benefit of using credentialed vulnerability scans over non-credentialed scans?

Accepted Answer

They provide more accurate results by checking internal configurations. Credentialed scans can access the OS and applications, allowing deeper inspection of installed software, patches, and configuration settings.

Answer

They are less likely to crash services

Answer

They are faster and less intrusive

Answer

They do not require network access

Question 14

A security analyst notices that a firewall log shows outbound traffic from an internal server to an external IP address on TCP port 443, but the server is not configured to make any outbound connections. The analyst checks previous logs and finds similar connections every 60 minutes. What type of activity is most likely occurring?

Accepted Answer

Beaconing to a command-and-control server. Regular outbound connections every 60 minutes to an external IP on port 443 from a server that should not make outbound connections is a textbook beaconing pattern. Malware uses periodic callbacks to a command-and-control (C2) server to receive instructions and exfiltrate data, often disguising traffic as HTTPS to evade detection. The fixed interval and unexpected destination strongly indicate C2 beaconing.

Answer

Normal software update check

Answer

DNS tunneling

Answer

Data exfiltration via FTP

Question 15

Which of the following tools is specifically designed for compliance scanning against security benchmarks such as CIS and STIG?

Accepted Answer

OpenSCAP. OpenSCAP is an open-source tool specifically designed for compliance scanning against security benchmarks like CIS and STIG. It uses SCAP (Security Content Automation Protocol) standards to automate vulnerability management and compliance checking. It can evaluate systems against predefined policies and generate reports.

Answer

OpenVAS

Answer

Nessus

Answer

Trivy