CS0-003 Practice Test 46 — 15 Questions

Question 1

During a web application penetration test using Burp Suite, a security analyst identifies that an API endpoint accepts a URL parameter that is used to fetch data from an external resource. The application does not validate or sanitize the parameter. This is most likely vulnerable to which attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Server-Side Request Forgery (SSRF). When an application takes a user-supplied URL parameter and fetches content from it without validation, the server can be tricked into making requests to internal or external resources on the attacker's behalf. This is the classic definition of Server-Side Request Forgery (SSRF). The lack of validation or sanitization of the URL parameter is the key indicator, allowing attackers to reach internal metadata endpoints (e.g., 169.254.169.254) or internal services.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

XML External Entity (XXE)

Question 2

During a threat hunt, an analyst uses Velociraptor to collect forensic artifacts from endpoints. Which THREE of the following artifacts are most useful for detecting persistence mechanisms?

Accepted Answer

Scheduled tasks. Scheduled tasks (B) are a classic persistence mechanism because attackers can register a task to execute malware at logon, startup, or on a recurring schedule, and Velociraptor can enumerate them via artifacts like Windows.System.TaskScheduler. Service configuration (D) is equally relevant since creating or modifying a Windows service (e.g., with a malicious ImagePath or auto-start type) allows code to run at boot under SYSTEM privileges. Registry Run keys (E) such as HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU equivalents are a well-known autostart location that malware abuses for persistence at user logon. The list of installed updates (A) is useful for patch-level and vulnerability assessment, not for identifying persistence, and the ARP cache (C) only shows recent IP-to-MAC mappings, which is network-state data rather than a persistence indicator.

Answer

List of installed updates

Answer

ARP cache

Question 3

A security analyst is investigating a reported vulnerability in a web application. The team uses Burp Suite for DAST scanning. Which TWO of the following findings would be classified as injection vulnerabilities according to OWASP Top 10?

Accepted Answer

Stored XSS in the comment section. Option C (Stored XSS in the comment section) is correct because cross-site scripting is classified under OWASP Top 10 A03:2021 Injection, where untrusted user input is interpreted as code (HTML/JavaScript) by the browser, and the stored variant persists the payload in the application's database. Option E (SQL injection in the login form) is correct because SQLi is the canonical injection flaw, where attacker-supplied input alters the structure of a SQL query executed by the backend database, also falling under A03:2021 Injection. Option A does not belong because using a component with known vulnerabilities maps to A06:2021 Vulnerable and Outdated Components, not injection. Option B does not belong because broken access control is its own category, A01:2021, involving authorization failures rather than input being interpreted as code or commands. Option D does not belong because security misconfiguration maps to A05:2021 and concerns improper hardening (such as exposed directory listings), not injection.

Answer

Use of a component with known vulnerabilities

Answer

Broken access control allowing privilege escalation

Answer

Security misconfiguration exposing directory listing

Question 4

During dynamic malware analysis in a sandbox, an analyst observes that the malware attempts to connect to a remote IP address on port 443, modifies the Windows registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and drops a DLL in the system32 folder. Which type of IOC is most indicative of persistence?

Accepted Answer

The registry modification to the Run key. The registry modification to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is the most indicative of persistence because this specific key is designed to automatically launch programs when a user logs in. By adding a value here, the malware ensures it executes on every system startup, which is the definition of persistence. In contrast, network connections and file drops are common during execution but do not inherently guarantee re-execution after a reboot.

Answer

The network connection over port 443

Answer

The remote IP address

Answer

The dropped DLL file hash

Question 5

A security analyst is configuring a vulnerability scanner for a new deployment. The scanner must be able to authenticate to targets to perform deep configuration audits against CIS Benchmarks. Which type of scan should the analyst configure?

Accepted Answer

Credentialed scan. A credentialed scan supplies valid credentials (e.g., SSH keys, SMB accounts, or API tokens) to the scanner, allowing it to log into targets and inspect local configuration, registry settings, file permissions, and patch levels. This deep access is required to audit against CIS Benchmarks, which specify OS and application configuration hardening checks that cannot be assessed externally.

Answer

Unauthenticated scan

Answer

Passive scan

Answer

External scan

Question 6

During a patch management process, a security analyst is testing a critical security patch in a staging environment. The patch causes a regression in a key business application. Which of the following should the analyst do next?

Accepted Answer

Report the regression to the vendor and wait for a fixed patch. Reporting the regression to the vendor and waiting for a fixed patch is correct because the patch introduces a functional regression in a key business application, meaning it cannot be safely deployed. The proper patch management lifecycle requires that failed patches be documented, communicated to the vendor, and re-tested once a corrected version is available. This preserves both security and business continuity without accepting unmanaged risk.

Answer

Apply the patch to production but roll back if issues occur

Answer

Skip the patch and accept the risk

Answer

Deploy the patch to production and monitor for issues

Question 7

During a forensic investigation, an analyst creates a disk image using dd with a SHA256 hash. Later, the analyst needs to verify the integrity of the image before analysis. Which command should the analyst use to compare the original hash with a newly computed hash?

Accepted Answer

sha256sum image.dd. The analyst needs to recompute the SHA256 hash of the image file and compare it to the original value. The command 'sha256sum image.dd' computes the SHA256 digest of the file directly, which is the standard Linux utility for this purpose and produces output that can be diffed against the original hash.

Answer

md5sum original.dd

Answer

dd if=image.dd | sha256sum

Answer

chksum -a sha256 image.dd

Question 8

An organization has identified indicators of compromise (IOCs) from a recent incident. Which data format is specifically designed for sharing threat intelligence in a standardized, machine-readable way?

Accepted Answer

STIX. STIX (Structured Threat Information Expression) is a standardized language and serialization format specifically designed by MITRE and OASIS to represent and share cyber threat intelligence in a machine-readable way. It defines domain objects like Indicator, Malware, ThreatActor, and Relationship, and is typically transported via TAXII. JSON, CSV, and PDF are generic data formats not purpose-built for threat intel semantics.

Answer

PDF

Answer

CSV

Answer

JSON

Question 9

During an incident response, the SOC team identifies a data breach involving customer PII. Under GDPR, what is the maximum time frame to notify the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification of the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. This 72-hour window is a hard regulatory deadline and applies to breaches involving customer PII. Failure to notify can trigger fines under Article 83.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 10

An analyst is creating a YARA rule to detect a specific malware family that uses the string 'evil' in its PE file. Which of the following rule structures is correct?

Accepted Answer

rule detect_malware { strings: $a = "evil" condition: $a }. A valid YARA rule requires the structure: rule <name> { strings: $var = "pattern" condition: $var }. Option A correctly declares a string variable $a assigned to 'evil' and then references $a in the condition, which is the canonical YARA syntax.

Answer

rule detect_malware { strings: "evil" condition: $a }

Answer

rule detect_malware { condition: $a = "evil" }

Answer

if "evil" in file then alert

Question 11

A security analyst is performing a vulnerability assessment and needs to identify potential misconfigurations in a Kubernetes cluster. Which TWO of the following are common Kubernetes misconfigurations that should be checked? (Select TWO.)

Accepted Answer

Privileged containers. Option A (Privileged containers) is correct because running a container with securityContext.privileged: true grants it nearly all capabilities of the host, effectively removing container isolation and allowing access to host devices and kernel features, which is a classic Kubernetes misconfiguration flagged by tools like kube-bench and CIS benchmarks. Option C (hostPath mounts) is correct because mounting a host directory or file into a pod (volumes.hostPath) exposes the node's filesystem to the container, enabling privilege escalation, persistence, or node compromise if an attacker gains code execution. Option B (Using network policies) is not a misconfiguration — network policies are a security best practice that restrict pod-to-pod traffic, and their absence would be the issue, not their use. Option D (Running containers as non-root user) is not a misconfiguration — setting runAsNonRoot: true or a non-zero runAsUser is a hardening measure that reduces risk. Option E (Using ConfigMaps for non-sensitive data) is not a misconfiguration — ConfigMaps are the intended mechanism for non-confidential configuration data, whereas Secrets should be used for sensitive values.

Answer

Using network policies

Answer

Running containers as non-root user

Answer

Using ConfigMaps for non-sensitive data

Question 12

A security analyst is collecting evidence for an upcoming compliance audit. Which three types of evidence are typically required? (Select THREE.)

Accepted Answer

Access review documentation. Access review documentation (B) is required because compliance frameworks such as SOX, HIPAA, PCI DSS, and ISO 27001 mandate periodic attestation that user access rights are appropriate and least-privilege, providing auditable proof of authorization control. Log exports from critical systems (C) are essential evidence because they demonstrate continuous monitoring, traceability of user and system activity, and support incident investigation and retention requirements under regulations like PCI DSS Req. 10 and HIPAA §164.312(b). Vulnerability scan reports (D) are required to prove that the organization identifies, tracks, and remediates technical weaknesses on a recurring basis, satisfying requirements such as PCI DSS Req. 11.2 and NIST SP 800-53 RA-5. Employee training attendance records (A) are useful for awareness programs but are not one of the three evidence types typically demanded in this audit context, and marketing brochures (E) are promotional materials with no evidentiary value for compliance.

Answer

Employee training attendance records

Answer

Marketing brochures

Question 13

A security analyst is investigating a potential data exfiltration incident. The analyst captures memory from a Windows system and finds a process that is injecting code into other processes. Which THREE indicators from the memory analysis would MOST strongly suggest malicious activity? (Select THREE.)

Accepted Answer

The process has memory regions with RWX permissions.. Option A is correct because memory regions marked RWX (read-write-execute) are a strong indicator of code injection, since legitimate code typically resides in RX (read-execute) or read-only pages, and RWX allows an attacker to write and then execute shellcode in the same region. Option B is correct because a process hidden from Task Manager indicates an attempt to evade user and analyst detection, which is characteristic of rootkits or injected/hooked processes used in exfiltration tooling. Option C is correct because WriteProcessMemory followed by CreateRemoteThread is the canonical Windows API sequence for process injection, letting an attacker place code in a remote process and start a thread to run it, which strongly suggests malicious activity. Option D is not correct on its own because malware frequently masquerades as a known Windows system process (e.g., svchost.exe), so a familiar name alone is not a reliable malicious indicator. Option E is not correct because a valid digital signature generally indicates trusted, unmodified software and argues against malicious tampering, not for it.

Answer

The process name is a known Windows system process.

Answer

The process has a valid digital signature.

Question 14

A security analyst is performing forensic analysis of a compromised system. The analyst needs to acquire disk evidence in a forensically sound manner. Which TWO actions should the analyst take to ensure the integrity of the evidence? (Choose TWO.)

Accepted Answer

Calculate a hash of the original drive before imaging. Option A is correct because calculating a cryptographic hash (e.g., MD5 or SHA-256) of the original drive before imaging establishes a baseline value that can later be compared to the hash of the forensic image, proving the data was not altered. Option C is correct because a hardware or software write blocker prevents any write operations to the source drive during acquisition, preserving the original evidence in an unmodified state as required for forensic soundness. Option B is incorrect because disabling the write blocker would allow the forensic workstation to write to the source drive, contaminating or altering the evidence. Option D is incorrect because powering on the system and running an antivirus scan modifies file system metadata, timestamps, and potentially deletes or quarantines files, destroying evidence integrity. Option E is incorrect because rebooting the system alters volatile data and can modify file system artifacts such as temporary files, log entries, and timestamps, which compromises the evidence.

Answer

Disable the write blocker to speed up the imaging process

Answer

Power on the system and run a full antivirus scan before imaging

Answer

Reboot the system to clear any temporary files

Question 15

A SOC analyst is triaging a SIEM alert that indicates a possible DNS tunneling attack. The alert was generated based on a correlation rule that looks for unusually high DNS query volume from a single host. Which TWO additional data sources should the analyst correlate to confirm the attack?

Accepted Answer

DNS server logs. DNS server logs (C) are essential because they capture the actual query names, record types (e.g., TXT, NULL, CNAME), response sizes, and query/response patterns that reveal the encoded exfiltration payloads and high-entropy subdomains typical of DNS tunneling. NetFlow/IPFIX (E) provides flow-level metadata such as packet and byte counts, flow duration, and destination IPs/ports, which helps confirm the sustained, periodic, or oversized DNS traffic volume to an external resolver that the SIEM rule flagged. Together these sources let the analyst validate that the high query volume is anomalous in content (C) and in traffic behavior (E), which is what distinguishes tunneling from benign DNS activity. Firewall logs (A) mainly show allowed/denied connections and port usage rather than DNS query content, so they add limited confirmation value here. Endpoint registry logs (B) are unrelated to DNS query behavior, and authentication logs (D) would only help if credential abuse were suspected, neither of which supports confirming DNS tunneling.

Answer

Firewall logs

Answer

Endpoint registry logs

Answer

Authentication logs