CS0-003 Practice Test 45 — 15 Questions

Question 1

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is technical remediation owner, which content choice is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SLA compliance by severity, asset owner, and business unit. An SLA compliance report by severity, asset owner, and business unit directly maps to the goal of showing whether critical findings are fixed within policy timelines. This report filters by severity (e.g., critical), includes remediation deadlines (SLA), and groups by asset owner and business unit, enabling technical remediation owners to track overdue items and prioritize fixes. It aligns with the NIST SP 800-55 framework for measuring security effectiveness through compliance metrics.

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Answer

A report sorted only by scanner plugin ID

Question 2

An analyst reviews AWS CloudTrail logs and detects multiple 'CreateNetworkAclEntry' API calls from a user who does not typically perform network administration. What type of activity is this?

Accepted Answer

Privilege escalation or lateral movement. Creating Network ACL entries is a network administration task. When a user who does not normally perform such actions makes multiple CreateNetworkAclEntry calls, it suggests the user's credentials may have been compromised and are being used to modify network access controls, potentially to enable lateral movement or privilege escalation. This is a classic indicator of compromise in cloud environments.

Answer

Cloud misconfiguration

Answer

Normal administrative activity

Answer

Data exfiltration via NACL

Question 3

A vulnerability scan report shows a critical vulnerability on a web server with a CVSS score of 9.8. The IT manager wants to know the risk to the organization. Which of the following factors should the analyst consider FIRST?

Accepted Answer

The asset value and business criticality. The CVSS score of 9.8 indicates a critical severity vulnerability, but risk is a function of both severity and business context. The analyst must first assess the asset value and business criticality of the web server because a critical vulnerability on a non-essential server poses lower risk than the same vulnerability on a server handling sensitive data or core business processes. Without this context, the organization cannot prioritize remediation effectively.

Answer

The vendor's patch release schedule

Answer

The number of exploit attempts in the logs

Answer

The number of other vulnerabilities on the server

Question 4

A vulnerability management analyst is reviewing the results of an authenticated scan. The analyst identifies several medium-severity vulnerabilities that have been present for over a year. Which of the following are the best actions to take? (Choose two.)

Accepted Answer

Verify the vulnerabilities are still relevant by re-scanning.. Re-scanning verifies whether the vulnerabilities are still present or have been remediated by other means (e.g., patching, configuration changes). Over a year, the environment may have changed, and the original scan results could be stale. An authenticated scan provides deeper visibility, but a fresh scan is the only way to confirm current relevance before taking further action.

Answer

Accept the risk if the system is no longer in use.

Answer

Remove the system from the network.

Answer

Increase the severity rating to high to ensure remediation.

Question 5

Which of the following best describes the purpose of the CISA Known Exploited Vulnerabilities (KEV) catalog in vulnerability management?

Accepted Answer

It lists vulnerabilities that are known to have been exploited in the wild. The CISA Known Exploited Vulnerabilities (KEV) catalog is a authoritative list maintained by CISA that enumerates vulnerabilities confirmed to have been exploited in the wild. Its purpose is to help organizations prioritize remediation by focusing on vulnerabilities with active exploitation evidence, not theoretical risk. This makes it a key input for risk-based vulnerability management and for meeting Binding Operational Directive 22-01 requirements for federal agencies.

Answer

It provides a framework for conducting penetration tests

Answer

It provides a scoring system for vulnerability severity

Answer

It offers a database of configuration baselines for operating systems

Question 6

Which analysis technique involves examining the parent-child relationships of processes to identify potentially malicious activity?

Accepted Answer

Process analysis. Process analysis involves examining running processes, their attributes, and especially their parent-child relationships to detect anomalies such as a suspicious process spawned by an unexpected parent (e.g., a word processor spawning cmd.exe). This technique is fundamental in endpoint detection and response (EDR) and forensic investigations to identify malicious activity like process injection or lateral movement.

Answer

Network analysis

Answer

Memory analysis

Answer

Registry analysis

Question 7

An organization wants to detect threats in their AWS environment using a cloud-native service that monitors for suspicious API calls and potential credential compromise. Which service should they use?

Accepted Answer

AWS GuardDuty. AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior in AWS accounts. It analyzes CloudTrail management events, VPC Flow Logs, and DNS logs to detect suspicious API calls, credential compromise, and other threats using machine learning and threat intelligence. This directly matches the requirement for a cloud-native service to detect threats.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Inspector

Question 8

An organization is implementing a patch management process. Which of the following is the BEST practice before deploying patches to production systems?

Accepted Answer

Test patches in a staging environment that mirrors production. Best practice for patch management includes testing patches in a staging environment that closely mirrors production before deploying to production. This allows identification of compatibility issues, performance impacts, or conflicts without disrupting critical systems. It balances security with operational stability.

Answer

Disable automatic updates and deploy patches manually without testing

Answer

Immediately apply all patches to production to minimize exposure time

Answer

Only apply patches that have a CVSS score of 9.0 or higher

Question 9

After a DDoS attack, the incident response team wants to improve detection and prevention. Which of the following metrics would be MOST useful for evaluating the effectiveness of the response?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to respond to and resolve an incident after it is detected. In the context of evaluating the effectiveness of the response to a DDoS attack, MTTR directly reflects how quickly the team mitigated the attack and restored normal operations. A lower MTTR indicates a more effective response process, making it the most useful metric among the options.

Answer

Number of false positives

Answer

Mean Time to Detect (MTTD)

Answer

Incidents per week

Question 10

A security analyst is preparing a monthly dashboard for the board of directors. Which metric would best demonstrate the effectiveness of the security program in reducing risk?

Accepted Answer

Mean time to detect (MTTD) and mean time to respond (MTTR).. Mean time to detect (MTTD) and mean time to respond (MTTR) directly quantify the security program's operational efficiency in identifying and containing threats, which reduces the window of exposure and potential damage. A lower MTTD/MTTR indicates faster detection and response, directly correlating with reduced risk from incidents. This makes it the best metric for demonstrating risk reduction effectiveness to the board.

Answer

Number of security incidents detected.

Answer

Percentage of employees who completed security awareness training.

Answer

Number of firewall rules configured.

Question 11

During a penetration test, an analyst successfully exploits a privilege escalation vulnerability to gain root access on a Linux server. The server is used for application development. Which of the following remediation actions would be MOST effective in preventing similar attacks?

Accepted Answer

Apply the principle of least privilege to user accounts. The principle of least privilege ensures that users and processes have only the minimum permissions necessary to perform their tasks. By applying this to user accounts, the attack surface for privilege escalation is reduced because even if an account is compromised, the attacker cannot easily escalate to root. This directly addresses the root cause of the vulnerability exploited in the scenario.

Answer

Deploy a host intrusion detection system

Answer

Harden the kernel using sysctl parameters

Answer

Implement application whitelisting

Question 12

A security analyst is tuning a SIEM rule that generates alerts for every failed login attempt. The rule is causing alert fatigue. Which TWO actions would reduce false positives while maintaining security visibility?

Accepted Answer

Aggregate alerts by source IP and time window. Option A is correct because aggregating failed-login alerts by source IP and time window (e.g., using a threshold such as 5 failures in 5 minutes) collapses repetitive noise into a single meaningful event, preserving visibility into brute-force patterns while cutting alert volume. Option C is correct because whitelisting known internal service IPs that legitimately produce repeated failed logins (e.g., misconfigured service accounts or scanners) suppresses expected benign activity without hiding genuine external attack attempts. Option B is wrong because disabling the rule entirely eliminates detection of brute-force and credential-stuffing attacks, destroying security visibility. Option D is wrong because raising the severity threshold only changes how alerts are labeled or escalated; it does not reduce the number of false-positive alerts generated. Option E is wrong because increasing log retention affects storage duration, not alert generation, so it does nothing to address alert fatigue.

Answer

Disable the rule entirely

Answer

Increase the alert severity threshold

Answer

Increase the log retention period

Question 13

During a threat hunt, an analyst identifies a suspicious process that is making outbound connections to multiple IP addresses on port 443 using TLS. The analyst suspects data exfiltration. Which THREE techniques would best help confirm this hypothesis?

Accepted Answer

Review EDR telemetry for file reads on sensitive documents prior to the connections. Option A is correct because correlating EDR file-read telemetry on sensitive documents with the timing of the outbound TLS connections establishes the data-collection stage of exfiltration, showing what data the process accessed before sending it. Option D is correct because NetFlow/IPFIX records byte and packet counts per flow, so unusually large outbound volumes to multiple destinations on port 443 reveal the data-transfer stage that distinguishes exfiltration from benign browsing. Option E is correct because the process command line often exposes exfiltration tooling and parameters such as destination lists, upload flags, or encoded payload arguments that explain the connections. Option B does not belong because inspecting the remote TLS certificate only identifies the server or its issuer and does not confirm that data was stolen. Option C does not belong because dumping process memory to hunt for encryption keys is complex and unreliable, and finding keys would not by itself prove exfiltration occurred.

Answer

Inspect the TLS certificate presented by the remote server

Answer

Perform a memory dump of the process and look for encryption keys

Question 14

During a memory forensics investigation, a security analyst identifies a process that appears to have code injected into it. The process is 'explorer.exe' and its memory contains sections that are not part of the original executable. Which TWO memory analysis techniques should the analyst use to confirm code injection?

Accepted Answer

Scan for executable memory pages not backed by a file on disk. Option D is correct because injected code typically resides in memory regions that are executable but have no corresponding file on disk; tools like Volatility's malfind or PE-sieve flag such RWX/VAD regions as strong indicators of injection. Option E is correct because comparing the loaded module/DLL list against a known-good baseline reveals unexpected or unsigned DLLs loaded into explorer.exe, which is a classic sign of DLL injection or reflective loading. Option A is not specific to code injection, since open handles (files, registry keys, mutexes) are normal for explorer.exe and do not prove injected code. Option B is not relevant, as environment variables are process metadata and are not used to detect injected executable memory. Option C is also not diagnostic, because the parent process (typically userinit.exe or winlogon.exe) only shows process lineage, not memory-resident code injection.

Answer

List the process's open handles

Answer

Examine the process's environment variables

Answer

Check the process's parent process

Question 15

A security analyst is reviewing a vulnerability scan report and notices a critical vulnerability with a CVSS v3.1 base score of 9.8. The vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack vector and the scope impact?

Accepted Answer

Attack vector: Network; Scope: Unchanged. The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H decodes as Attack Vector: Network (AV:N) and Scope: Unchanged (S:U). AV:N means the vulnerability is exploitable remotely over a network, and S:U means a successful exploit affects only the vulnerable component's security authority, not other components. The 9.8 base score is consistent with a network-exploitable, no-privilege, no-interaction, high-impact vulnerability with unchanged scope.

Answer

Attack vector: Network; Scope: Changed

Answer

Attack vector: Local; Scope: Changed

Answer

Attack vector: Adjacent; Scope: Unchanged