CS0-003 Practice Test 48 — 15 Questions

Question 1

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for incidents is significantly higher than industry benchmarks. Which of the following improvements would most directly reduce MTTD?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implementing automated alerting based on threat intelligence.. Mean time to detect (MTTD) measures how quickly incidents are identified. Implementing automated alerting based on threat intelligence directly improves detection speed by continuously monitoring for known indicators of compromise and generating alerts in real time. This reduces the time between an incident occurring and the team becoming aware of it.

Answer

Increasing the number of forensic analysts on call.

Answer

Conducting more frequent tabletop exercises.

Answer

Rotating credentials after each incident.

Question 2

A security analyst is conducting a dynamic application security testing (DAST) scan of a REST API. The scanner reports a potential Server-Side Request Forgery (SSRF) vulnerability. The analyst needs to confirm the finding manually. Which TWO of the following techniques are most appropriate for validating SSRF?

Accepted Answer

Submit a payload that triggers the server to send a request to an attacker-controlled external server (e.g., Burp Collaborator). Option A is correct because SSRF validation classically uses an out-of-band channel: submitting a payload that makes the vulnerable server issue a request to an attacker-controlled host such as Burp Collaborator, and then confirming the inbound DNS/HTTP interaction proves the server-side request was actually made. Option B is correct because SSRF is fundamentally about the server reaching resources the attacker cannot, so crafting input that causes the server to request an internal address like 127.0.0.1 (or 169.254.169.254 for cloud metadata) and observing a response or timing/error difference confirms the server is fetching attacker-influenced URLs. Option C is not appropriate because injecting SQL queries tests for SQL injection, a different vulnerability class, not server-side request forgery. Option D is not appropriate because uploading a malicious file tests unrestricted file upload, not SSRF. Option E is not appropriate because modifying HTTP headers to test for cross-site scripting targets XSS, which is a client-side injection issue unrelated to SSRF.

Answer

Inject malicious SQL queries into input fields to see if they are executed

Answer

Attempt to upload a malicious file to the server

Answer

Modify HTTP headers to test for cross-site scripting

Question 3

A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?

Accepted Answer

Frequent DNS queries to domains with random-looking, long subdomains. Option B is correct because DGA malware generates large numbers of pseudo-random domain names (often long, high-entropy subdomains) and the infected host repeatedly queries them while attempting to locate its C2 server. Option D is correct because most algorithmically generated domains are unregistered, so the resolver typically returns NXDOMAIN for the vast majority of these queries, producing a distinctive high-volume NXDOMAIN pattern. Option A is not indicative of DGA activity, since using internal DNS resolvers is normal enterprise behavior and says nothing about the queried domain names. Option C is not indicative because DGA domains are newly generated and unregistered, so they would not have a high Alexa ranking. Option E is not indicative because consistent intervals to a single IP suggest beaconing to a fixed C2, whereas DGA relies on constantly changing domain names.

Answer

All DNS queries are to internal DNS servers

Answer

DNS queries to domains with a high Alexa ranking

Answer

Consistent DNS query intervals to a single IP

Question 4

A security analyst is prioritizing vulnerabilities for a critical internet-facing application server. The analyst has CVSS scores, EPSS scores, and access to the CISA KEV catalog. Which TWO factors should the analyst consider as the most important for determining remediation priority? (Select TWO)

Accepted Answer

Asset criticality and business context. Remediation priority must reflect the value and exposure of the affected system; a critical internet-facing application server supporting key business functions warrants higher priority than a low-value internal host, regardless of raw severity scores. Option E (CISA Known Exploited Vulnerabilities (KEV) catalog) is correct because KEV lists vulnerabilities known to be actively exploited in the wild, which is the strongest evidence of immediate real-world risk and should drive urgent remediation. CVSS base score (B) measures intrinsic technical severity but not exploit likelihood or business impact, so it is only one input and not the top priority factor. EPSS score (D) estimates the probability of exploitation but does not capture asset importance or confirmed exploitation like KEV does. The number of plugins detecting the vulnerability (C) is a scanner artifact and has no bearing on actual risk or remediation priority.

Answer

CVSS base score

Answer

Number of plugins detecting the vulnerability

Answer

EPSS score

Question 5

After a phishing incident, the security team wants to improve detection of similar attacks in the future. Which THREE actions should the team take as part of post-incident activity? (Choose THREE.)

Accepted Answer

Updating email filtering rules and detection signatures. Option B is correct because updating email filtering rules and detection signatures directly operationalizes the lessons from the phishing incident, enabling future similar messages to be blocked or flagged based on the observed sender, subject, URL, or attachment characteristics. Option C is correct because sharing indicators of compromise (IOCs) such as malicious domains, IP addresses, and file hashes through a threat intelligence platform helps other organizations detect the same campaign and can yield reciprocal intelligence that improves the team's own defenses. Option D is correct because a lessons learned meeting is a core post-incident activity that reviews the timeline, root cause, and response effectiveness to identify concrete process, tooling, and training improvements. Option A is not a post-incident improvement action; disabling accounts is a containment step during the incident, and it does not by itself enhance future detection. Option E is also not a detection improvement; reimaging workstations is an eradication/recovery action for affected hosts and does not build capability to detect similar attacks later.

Answer

Disabling user accounts that clicked the phishing link

Answer

Reimaging all affected workstations

Question 6

Which of the following is a key component of a vulnerability report that provides a high-level overview for management?

Accepted Answer

Executive summary. The executive summary condenses findings for management to quickly understand the state of vulnerabilities.

Answer

Remediation timeline

Answer

Findings by severity

Answer

Risk acceptance

Question 7

A vulnerability management team is prioritizing vulnerabilities for remediation. They have a list of vulnerabilities with different characteristics. According to best practices, which TWO factors should be considered when prioritizing vulnerabilities? (Select TWO.)

Accepted Answer

The asset's criticality to the business. Option B is correct because an asset's criticality to the business determines the real-world impact of exploitation, so a high-severity vulnerability on a mission-critical server should be remediated before the same vulnerability on a low-value test machine. Option D is correct because the CISA Known Exploited Vulnerabilities (KEV) catalog identifies vulnerabilities that are actively exploited in the wild, which is a strong signal to prioritize them regardless of other factors. The CVSS base score (A) reflects intrinsic severity but not business context or exploitation activity, so it is only one input rather than a standalone prioritization factor. Patch availability (C) affects remediation timing but does not by itself indicate risk priority, and the number of open ports (E) is an attack-surface indicator, not a standard vulnerability prioritization criterion.

Answer

The CVSS base score

Answer

The availability of a patch

Answer

The number of open ports on the asset

Question 8

A security analyst is creating metrics for a security dashboard aimed at executive leadership. Which THREE metrics are most appropriate for this audience? (Select THREE.)

Accepted Answer

Phishing simulation click rates. Phishing simulation click rates (A) are appropriate because they express human-risk exposure as a simple percentage that executives can trend over time to judge the effectiveness of security awareness training. Number of security incidents by category (B) is right because it gives leadership a business-level view of what kinds of threats are materializing and where to direct risk-reduction investment. Mean time to detect (C) is right because it is a key operational KPI showing how quickly the security program identifies threats, which executives use to assess detection capability and response readiness. The unmarked options do not belong: vulnerability scan details for individual hosts (D) are too granular and technical for an executive dashboard, and firewall rule change request logs (E) are operational change-management records rather than strategic risk metrics.

Answer

Vulnerability scan details for individual hosts

Answer

Firewall rule change request logs

Question 9

An organization is preparing evidence for an audit of access controls. Which THREE types of evidence should be collected? (Select THREE.)

Accepted Answer

Access review documentation. Access review documentation (B) is correct because periodic user access reviews are the primary artifact proving that entitlements are authorized, appropriate, and revoked when no longer needed, directly evidencing access control governance. Vulnerability scan reports (C) are correct because they show whether access-related weaknesses (e.g., missing patches, misconfigurations, default credentials) exist and are being remediated, supporting the audit's assessment of control effectiveness. Log exports of user access events (D) are correct because authentication and authorization logs (e.g., Windows Security event IDs 4624/4625, sudo/syslog entries, cloud trail records) provide the raw, timestamped proof that access controls actually operate as intended. Network flow data (A) is not selected because flow records (NetFlow/IPFIX) show traffic patterns and volumes, not user identity or authorization decisions, so they do not directly evidence access control. Incident response reports (E) are not selected because they document security incidents and containment actions, which relate to incident management rather than the access control audit evidence requested.

Answer

Network flow data

Answer

Incident response reports

Question 10

A security analyst is using OpenVAS to scan a network. The scan identifies several vulnerabilities. Which TWO of the following are valid components of a CVSS v3.1 base score? (Select the two correct answers.)

Accepted Answer

Scope (S). Scope (S) is a valid CVSS v3.1 base metric that indicates whether a vulnerability can affect resources beyond the security scope of the vulnerable component, with values Unchanged (U) or Changed (C). Attack Vector (AV) is also a valid base metric describing the context in which the vulnerability is exploitable, with values Network (N), Adjacent (A), Local (L), or Physical (P). Both belong to the Base metric group, which also includes Attack Complexity (AC), Privileges Required (PR), User Interaction (UI), Confidentiality (C), Integrity (I), and Availability (A). Exploitability (E), Confidence (C), and Remediation Level (RL) are not base metrics: E and RL are Temporal metrics in CVSS v3.1, and Confidence is a metric from the older CVSS v2 environmental scoring, not part of CVSS v3.1 base scoring.

Answer

Exploitability (E)

Answer

Confidence (C)

Answer

Remediation Level (RL)

Question 11

A security analyst is selecting Key Performance Indicators (KPIs) for a security operations dashboard. Which THREE metrics are most relevant for measuring incident response effectiveness? (Select THREE.)

Accepted Answer

Mean time to detect (MTTD). Option B, Mean time to detect (MTTD), is correct because it directly measures how quickly the security operations team identifies a potential incident from the moment it occurs, which is a core indicator of detection capability and monitoring effectiveness. Option C, Mean time to remediate (MTTRem), is correct because it quantifies the time required to fully resolve or contain an incident after detection, reflecting the team's ability to restore normal operations and limit business impact. Option E, Mean time to respond (MTTR), is correct because it measures the elapsed time from detection to the start of active response actions, showing how promptly analysts engage with and begin handling a confirmed incident. Option A, Number of employees, is not a security operations performance metric and does not reflect incident response effectiveness. Option D, Revenue growth, is a business financial metric unrelated to the speed or quality of incident detection, response, or remediation.

Answer

Number of employees

Answer

Revenue growth

Question 12

A security analyst is performing an API vulnerability test using OWASP ZAP. The analyst finds several issues. Which THREE of the following are common API vulnerabilities according to OWASP? (Select THREE.)

Accepted Answer

Broken Object Level Authorization. Broken Object Level Authorization (A) is correct because it is the #1 item on the OWASP API Security Top 10, occurring when an API fails to verify that the requesting user owns or is authorized to access the specific object referenced by an ID in the request (e.g., /api/users/123), allowing horizontal privilege escalation via IDOR-style attacks. Excessive Data Exposure (B) is correct because it is a recognized OWASP API risk where APIs return full objects with sensitive fields (PII, tokens, internal attributes) and rely on the client to filter, exposing data the consumer should never receive. Broken Authentication (E) is correct because it is a core OWASP API Security Top 10 category covering weak credential handling, missing token validation, improper JWT verification, and absent rate limiting on authentication endpoints. SQL Injection (C) and Cross-Site Scripting (D) are not API-specific OWASP API Top 10 categories; they are classic web application vulnerabilities listed in the OWASP Top 10 for web apps, and while an API could theoretically be affected, they are not among the API-specific vulnerabilities the question asks for.

Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Question 13

A company uses a patch management tool to track compliance across its server fleet. The security team needs to prioritize vulnerabilities for patching. Which THREE factors should be considered when prioritizing?

Accepted Answer

EPSS probability score. Option A (EPSS probability score) is correct because the Exploit Prediction Scoring System estimates the likelihood that a vulnerability will be exploited in the wild within the next 30 days, giving a forward-looking, threat-based signal that helps rank which CVEs to patch first. Option B (Asset criticality and exposure) is correct because the same vulnerability poses very different risk depending on whether the affected server is internet-facing, holds sensitive data, or supports a critical business function, so business context must weight the technical severity. Option D (CVSS base score) is correct because it provides a standardized, vendor-neutral measure of the intrinsic severity of a vulnerability (attack vector, complexity, privileges, impact), forming the baseline technical input for prioritization. Option C (availability of a patch from the vendor) is not a prioritization factor per se — if no patch exists, the issue is handled through compensating controls or mitigation, and patch availability does not indicate how urgent or risky the vulnerability is. Option E (number of plugins that detected the vulnerability) is irrelevant because multiple scanners reporting the same CVE is a detection artifact, not a measure of exploit likelihood or business impact.

Answer

Availability of a patch from the vendor

Answer

Number of plugins that detected the vulnerability

Question 14

During a forensic investigation, an analyst must preserve evidence in accordance with forensic sound procedures. Which THREE of the following practices should the analyst follow? (Select THREE.)

Accepted Answer

Document all actions taken in a chain of custody form. Option B is correct because maintaining a chain of custody form that documents every action, transfer, and access of the evidence is essential for forensic soundness and admissibility in court. Option C is correct because a write blocker prevents any modification to the original hard drive during imaging, preserving the integrity of the evidence. Option D is correct because creating a cryptographic hash (e.g., MD5 or SHA-256) of the original media before imaging provides a verifiable baseline to prove the image is an exact copy and that the original was not altered. Option A is not appropriate because running an antivirus scan modifies the drive (e.g., quarantining or deleting files), which violates forensic soundness. Option E is not appropriate because booting the system can alter the state of the drive (e.g., changing timestamps, creating temporary files), compromising evidence integrity.

Answer

Run a full antivirus scan on the target drive

Answer

Boot the system to ensure it is operational

Question 15

An organization is implementing security hardening for Kubernetes clusters. Which THREE of the following are common Kubernetes misconfigurations that should be addressed? (Select THREE)

Accepted Answer

Using hostPath mounts without restrictions. Option C is correct because hostPath mounts without restrictions let a pod access the node's filesystem, enabling container escape, node compromise, and tampering with kubelet or other host files, so they should be limited via Pod Security Admission or OPA/Gatekeeper policies. Option D is correct because privileged containers run with all Linux capabilities and unrestricted device access, effectively granting root on the host and bypassing container isolation, so privileged: true should be disallowed except for tightly controlled system workloads. Option E is correct because overly permissive RBAC roles, such as wildcard verbs/resources or cluster-admin bindings, violate least privilege and let compromised service accounts read secrets, create pods, or escalate across the cluster. Options A and B are not misconfigurations: using namespaces to isolate workloads and implementing network policies are recommended hardening practices that segment resources and restrict pod-to-pod traffic.

Answer

Using namespaces to isolate workloads

Answer

Implementing network policies