CS0-003 Practice Test 49 — 15 Questions

Question 1

An incident response team is analyzing indicators of compromise (IOCs) from a phishing campaign. Which THREE of the following are commonly used IOC types? (Select THREE.)

Accepted Answer

IP addresses. IP addresses (B) are a standard network-based IOC, since malicious command-and-control servers, phishing hosts, and payload delivery endpoints are tracked by their IPv4/IPv6 addresses. Domain names (C) are equally common IOCs, as phishing URLs, C2 domains, and DNS-based exfiltration are identified by fully qualified domain names. File hashes (E), typically MD5, SHA-1, or SHA-256 values, are host-based IOCs used to uniquely identify known malicious files such as phishing attachments or malware binaries. CPU registers (A) are volatile runtime processor state, not a shareable indicator of compromise, and software version numbers (D) describe legitimate application builds rather than evidence of malicious activity.

Answer

CPU registers

Answer

Software version numbers

Question 2

An incident response team is conducting post-incident activities after containing a malware outbreak. Which TWO activities should be included in the lessons learned phase? (Choose TWO.)

Accepted Answer

Conducting a root cause analysis.. Option B (Conducting a root cause analysis) is correct because the lessons learned phase of incident response requires determining why the malware outbreak occurred and how it bypassed existing controls, so the team can address the underlying weakness rather than just the symptom. Option D (Updating detection rules based on IOCs) is correct because indicators of compromise gathered during the incident should be operationalized into SIEM correlation rules, IDS/IPS signatures, or EDR detections to improve future detection and reduce time to identify similar threats. Option A is wrong because deleting logs destroys forensic evidence and violates retention and chain-of-custody requirements; logs should be preserved and reviewed. Option C is wrong because rewriting the entire security policy from scratch is an overreaction not scoped to lessons learned, which should produce targeted improvements. Option E is wrong because patching all systems immediately is a remediation action that belongs to the eradication/recovery phase, not the post-incident lessons learned review.

Answer

Deleting all logs from the incident.

Answer

Rewriting the organization's security policy from scratch.

Answer

Patching all systems immediately.

Question 3

A vulnerability management analyst is prioritizing vulnerabilities for remediation. The analyst has the following information for three vulnerabilities: CVE-2023-1: CVSS 9.8, EPSS 0.9, asset criticality high; CVE-2023-2: CVSS 7.5, EPSS 0.01, asset criticality low; CVE-2023-3: CVSS 5.0, EPSS 0.8, asset criticality medium. According to best practices, which THREE factors should the analyst consider when prioritizing? (Select THREE)

Accepted Answer

CVSS score. Option A (CVSS score) is correct because CVSS provides the standardized severity rating of a vulnerability's technical impact, and in this scenario the analyst is explicitly comparing scores such as 9.8, 7.5, and 5.0 to gauge relative severity. Option C (Asset criticality) is correct because the business value and exposure of the affected asset determine the real-world risk; a high-criticality asset raises the urgency of remediation regardless of raw severity. Option D (EPSS score) is correct because EPSS estimates the probability that a vulnerability will be exploited in the wild within the next 30 days, so values like 0.9 versus 0.01 strongly influence prioritization beyond CVSS alone. Option B (CVE publication date) is not a standard prioritization factor, since age alone does not indicate exploitability or business impact. Option E (Number of vendors affected) is not a recognized risk-scoring input for prioritizing a specific vulnerability in a given environment.

Answer

CVE publication date

Answer

Number of vendors affected

Question 4

A security analyst is investigating a potential data breach. The analyst needs to collect digital evidence while preserving its integrity. Which TWO actions should the analyst take? (Choose TWO.)

Accepted Answer

Verify the hash of the acquired image against the original.. Option C is correct because verifying the hash (e.g., MD5 or SHA-256) of the acquired forensic image against the original source confirms that the copy is bit-for-bit identical and has not been altered, which is essential for maintaining evidence integrity and admissibility. Option D is correct because using a hardware or software write blocker when imaging the hard drive prevents any write operations to the suspect drive, ensuring the original evidence remains unmodified during acquisition. Option A is incorrect because running a full antivirus scan modifies system state, timestamps, and potentially quarantines or alters files, which contaminates evidence. Option B is incorrect because deleting malicious files destroys evidence and violates chain-of-custody and preservation principles. Option E is incorrect because connecting a suspect drive without a write blocker allows the forensic workstation's OS to write to the drive, altering metadata and compromising evidentiary integrity.

Answer

Run a full antivirus scan on the system.

Answer

Delete any malicious files found during the investigation.

Answer

Connect the suspect drive to a forensic workstation without a write blocker.

Question 5

A security analyst is preparing an incident report after a ransomware attack. Which two components must be included in the report? (Select TWO.)

Accepted Answer

Root cause analysis. Option B (Root cause analysis) is correct because an incident report must document how the ransomware gained initial access and spread, identifying the underlying vulnerability, misconfiguration, or human factor so that remediation and preventive controls can be applied. Option D (Timeline of the incident) is correct because a chronological record of detection, containment, eradication, and recovery events is essential for understanding the attack's progression, supporting forensic findings, and meeting compliance or legal reporting requirements. The remaining options do not belong: a responder's resume (A) is irrelevant personal information, the marketing department's budget (C) has no bearing on the technical or procedural facts of the incident, and software license keys (E) are sensitive credentials that should never be exposed in a report and are unrelated to documenting the attack.

Answer

Resume of the incident responder

Answer

Marketing department's budget

Answer

Software license keys

Question 6

A security team is deploying a new web application and wants to ensure it follows secure configuration practices. Which THREE of the following are recommended configuration settings according to CIS benchmarks for web servers? (Select THREE.)

Accepted Answer

Disable directory listing. Option A (Disable directory listing) is correct because CIS benchmarks for web servers require turning off autoindex/directory browsing so that attackers cannot enumerate files and directories that lack an index page, reducing information disclosure. Option C (Enforce HTTPS) is correct because CIS guidance mandates TLS-protected transport, typically by redirecting or rejecting plain HTTP and configuring strong protocols/ciphers, to protect credentials and session data in transit. Option E (Remove default accounts) is correct because CIS benchmarks require deleting or disabling vendor-supplied default accounts and sample content, since these often ship with well-known credentials and are a common initial-access vector. Option B (Use HTTP instead of HTTPS) does not belong because plain HTTP transmits data unencrypted and directly contradicts the requirement to enforce HTTPS. Option D (Enable automatic directory browsing) does not belong because automatic directory listing is the exact behavior that disabling directory listing is meant to prevent, and it exposes the server's file structure to unauthenticated users.

Answer

Use HTTP instead of HTTPS

Answer

Enable automatic directory browsing

Question 7

An analyst is preparing a vulnerability report for management. Which THREE sections should be included to effectively communicate findings and remediation? (Select THREE.)

Accepted Answer

Executive summary. The executive summary (A) is correct because it gives management a concise, non-technical overview of the assessment's scope, key risks, and overall risk posture, which is essential for decision-makers who need the bottom line without deep technical detail. Findings by severity (D) is correct because organizing vulnerabilities by severity ratings (e.g., CVSS scores or Critical/High/Medium/Low categories) lets management prioritize the most dangerous issues and allocate resources accordingly. Remediation timeline (E) is correct because it communicates when fixes will be applied, establishes accountability, and aligns remediation with business risk tolerance and operational constraints. Incident response procedures (B) do not belong because they are operational playbooks for handling active incidents, not components of a vulnerability report. Network topology diagram (C) is not required because it is supporting technical documentation that may aid context but is not one of the core sections needed to communicate findings and remediation to management.

Answer

Incident response procedures

Answer

Network topology diagram

Question 8

A security analyst is investigating a potential advanced persistent threat (APT) that uses living off the land binaries (LOLBins). The EDR has flagged several processes. Which THREE process behaviors are most indicative of LOLBin abuse? (Choose THREE.)

Accepted Answer

mshta.exe executing JavaScript from a remote URL. Option A is correct because mshta.exe is a signed Microsoft LOLBin that normally renders HTML applications, so executing JavaScript from a remote URL is a classic abuse pattern for fileless execution and remote payload retrieval. Option D is correct because wmic.exe is a legitimate WMI command-line utility, and using it to create a process on a remote system (e.g., via /node and process call create) is a well-known lateral movement and remote execution technique. Option E is correct because certutil.exe is a built-in certificate utility whose -urlcache or -split options are frequently abused to download executables from remote servers, making it a hallmark LOLBin download cradle. Option B is not indicative because explorer.exe opening the Start menu is normal user-interface behavior, and Option C is not indicative because notepad.exe opening a local .txt file in the user's Documents folder is ordinary, expected activity with no remote or execution-abuse characteristics.

Answer

explorer.exe opening the Start menu

Answer

notepad.exe opening a .txt file in the user's Documents folder

Question 9

A security analyst is using a vulnerability scanner to identify missing patches on Windows servers. The scanner uses plugins that reference Common Vulnerabilities and Exposures (CVE) identifiers. Which THREE of the following are components of a CVSS v3.1 base score vector?

Accepted Answer

Attack Vector (AV). The CVSS v3.1 base score vector is composed of Exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) and Impact metrics (Confidentiality, Integrity, Availability). Option A, Attack Vector (AV), is correct because AV is an Exploitability metric in the base group, with values Network (N), Adjacent (A), Local (L), and Physical (P). Option B, Confidentiality (C), is correct because C is one of the three Impact metrics (C/I/A) in the base score, reflecting the degree of confidentiality loss. Option C, Privileges Required (PR), is correct because PR is an Exploitability metric in the base group, with values None (N), Low (L), and High (H). Option D, Remediation Level (RL), is incorrect because RL belongs to the Temporal score group, not the base score. Option E, Exploitability (E), is incorrect because E is a Temporal metric (with values Unproven, Proof-of-Concept, Functional, High, Not Defined), not a base metric.

Answer

Remediation Level (RL)

Answer

Exploitability (E)

Question 10

An analyst receives a threat intelligence feed containing IOCs in STIX format. Which of the following BEST describes the purpose of STIX?

Accepted Answer

A standardized language for threat intelligence. STIX (Structured Threat Information Expression) is a standardized language and serialization format for representing cyber threat intelligence, including indicators, threat actors, campaigns, and relationships. It is designed to be machine-readable and interoperable, allowing organizations to share threat intelligence consistently. Therefore, the best description is that STIX is a standardized language for threat intelligence.

Answer

A protocol for real-time log collection

Answer

A framework for automating incident response

Answer

A tool for malware analysis

Question 11

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Executive leadership requires a high-level summary that translates technical findings into business impact. The executive summary should focus on business risk, customer impact assessment, remediation status, and remaining exposure, as these directly inform strategic decisions without overwhelming non-technical stakeholders with raw data.

Answer

Raw packet captures from the scan

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Question 12

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Accepted Answer

Vulnerability scan reports. Vulnerability scan reports (C) are essential evidence because they document the identification of vulnerabilities across the environment, showing when scans were performed, what hosts were assessed, and which CVEs or findings were detected, which is the core proof that a vulnerability management program is actively discovering weaknesses. Patch management reports (D) are equally essential because they demonstrate remediation—showing that identified vulnerabilities were addressed through applied updates, with dates, affected systems, and patch levels (e.g., KB numbers or package versions), closing the loop between detection and resolution. Together, C and D provide the audit trail of find-and-fix that auditors require to verify an effective vulnerability management process. Network topology diagrams (A) describe architecture but do not evidence scanning or remediation activity. Employee training logs (B) support security awareness compliance, not vulnerability management specifically. Incident response playbooks (E) are documentation for handling incidents and do not demonstrate ongoing vulnerability identification or patching.

Answer

Network topology diagrams

Answer

Employee training logs

Answer

Incident response playbooks

Question 13

A security analyst is investigating a potential insider threat where a user is suspected of exfiltrating sensitive data via USB drives. The analyst needs to gather evidence while preserving the chain of custody. Which THREE actions should the analyst perform? (Choose THREE.)

Accepted Answer

Creating a forensic image of the USB drive using a write blocker. Option A is correct because creating a forensic image of the USB drive using a write blocker ensures that the original evidence is not altered during acquisition, preserving its integrity for later analysis and legal admissibility. Option D is correct because documenting the chain of custody for the USB drive records every person who handled, transferred, or accessed the evidence, which is essential for proving that the evidence has not been tampered with. Option E is correct because computing a hash (e.g., MD5 or SHA-256) of both the original USB drive and the forensic image allows the analyst to verify that the image is an exact bit-for-bit copy and that the original has not changed. Option B does not belong because disabling the user's network account is a containment action that could alert the suspect and is not part of evidence gathering or chain-of-custody preservation. Option C does not belong because interviewing the user is an investigative step that could compromise the case and is not a forensic evidence-handling action.

Answer

Disabling the user's network account immediately

Answer

Interviewing the user about their activities

Question 14

A security analyst is reviewing the output of a vulnerability scan and sees a finding for a web application that uses a known vulnerable version of Apache Struts. Which TWO of the following actions should the analyst prioritize?

Accepted Answer

Update Apache Struts to the latest patched version. Option C is correct because upgrading Apache Struts to the latest patched version directly remediates the underlying vulnerability (e.g., the CVE affecting that specific Struts release) and eliminates the exploitable code path. Option E is correct because a WAF rule blocking known exploit patterns (such as OGNL injection payloads targeting Struts' Content-Type or action parameters) provides immediate compensating protection while the patch is scheduled and deployed. Option A is not appropriate as a priority action because removing the Struts component entirely would likely break the web application's functionality rather than remediate it. Option B is irrelevant because rebooting the web server does not remove or patch the vulnerable Struts library and provides no security benefit. Option D is overly disruptive; taking the application offline is a last resort and not a prioritized remediation step when patching and WAF mitigation are available.

Answer

Remove the Apache Struts component entirely

Answer

Reboot the web server to clear memory

Answer

Disable the web application until further notice

Question 15

An analyst is configuring correlation rules in a SIEM. Which TWO data sources are essential for detecting lateral movement using pass-the-hash attacks?

Accepted Answer

Authentication logs (e.g., Windows Event ID 4624). Authentication logs such as Windows Event ID 4624 are essential because they record logon events, including the logon type (e.g., Type 3 network logon) and authentication package (NTLM), which reveal the credential reuse characteristic of pass-the-hash lateral movement. Endpoint process creation logs such as Event ID 4688 are also essential because they capture the execution of tools and commands (e.g., cmd.exe, PsExec, net use) spawned after the attacker authenticates with the stolen hash, providing the behavioral evidence of movement on the target host. Firewall logs only show network connections and cannot confirm authentication or credential reuse, so they are insufficient on their own. DNS logs may reveal resolution of internal hosts but do not show authentication or process execution tied to pass-the-hash. Vulnerability scan results identify missing patches or misconfigurations but do not record the runtime authentication and process activity needed to detect an active pass-the-hash attack.

Answer

Firewall logs

Answer

DNS logs

Answer

Vulnerability scan results