CS0-003 Practice Test 50 — 15 Questions

Question 1

A security analyst is setting up a vulnerability management program and needs to select tools for container image scanning. Which THREE of the following are commonly used container image scanning tools? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Snyk. Snyk (A) is a widely used container image scanning tool that detects known vulnerabilities in OS packages and application dependencies within images, integrating into CI/CD pipelines. Clair (D) is an open-source static analysis tool from CoreOS/Quay that scans container image layers against vulnerability databases to report known CVEs. Trivy (E) is an Aqua Security open-source scanner that detects OS package and language-specific dependency vulnerabilities, misconfigurations, and secrets in container images. OpenVAS (B) is a network vulnerability scanner for hosts and services, not a container image scanner, and Burp Suite (C) is a web application security testing proxy, so neither is designed for scanning container images.

Answer

OpenVAS

Answer

Burp Suite

Question 2

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. The vulnerability program needs to demonstrate that critical findings are remediated within policy timelines, which requires a report showing SLA compliance. For a SOC manager, the most appropriate content includes severity, asset owner, and business unit breakdowns, enabling them to track accountability and prioritize remediation efforts across the organization.

Answer

A report sorted only by scanner plugin ID

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Question 3

A business unit accepts the risk of delaying a patch because downtime would breach a contractual deadline. What should be updated? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

The risk register with owner, justification, expiry date, and compensating controls. When a business unit formally accepts the risk of delaying a patch, the risk register must be updated with the owner, justification, expiry date, and compensating controls. This documentation ensures the decision is defensible during audits or incidents, as it captures the explicit risk acceptance and the temporary controls in place until the patch is applied.

Answer

The firewall vendor invoice

Answer

The incident containment playbook only

Answer

The phishing training completion list

Question 4

A supplier provides a software product used in a regulated environment. The security team wants visibility into included libraries and versions. What should they request? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

A software bill of materials. A software bill of materials (SBOM) provides a formal, machine-readable inventory of all components, libraries, and versions used in a software product. This directly gives the security team the visibility needed for vulnerability management in a regulated environment, aligning with frameworks like NIST SP 800-53 and Executive Order 14028.

Answer

A DNS MX record report

Answer

A building floor plan

Answer

A password complexity screenshot only

Question 5

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. A post-incident finding of an unowned alert integration indicates a process gap that must be closed with a named owner, a due date, acceptance criteria, and a retest plan. This ensures accountability, a measurable fix, and verification that the integration is properly configured and monitored, preventing future failures.

Answer

No action because the incident is closed

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Question 6

A vulnerability scan identifies a critical unauthenticated remote-code-execution flaw on an internet-facing VPN appliance that is actively exploited in the wild. Several internal-only medium vulnerabilities are also present. What should be remediated first? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Patch or mitigate the VPN appliance immediately and verify exposure is removed. The VPN appliance with a critical unauthenticated remote-code-execution flaw that is actively exploited in the wild represents an immediate and severe risk to the organization's security posture. An internet-facing device with such a vulnerability can be compromised by any attacker on the internet without authentication, leading to full system compromise and potential lateral movement into the internal network. Prioritizing remediation of this flaw over internal-only medium vulnerabilities aligns with risk-based vulnerability management principles, as the likelihood and impact of exploitation are far higher.

Answer

Defer all remediation until the monthly patch window

Answer

Start with the oldest medium vulnerability

Answer

Remediate only low-risk internal findings to improve closure rate

Question 7

During the preparation phase of the NIST SP 800-61 incident response lifecycle, which of the following is the MOST important activity to ensure effective incident response?

Accepted Answer

Creating and training the incident response team. The preparation phase of NIST SP 800-61 is about establishing the capability to respond before an incident occurs. The single most critical element is having a trained, organized incident response team with defined roles, responsibilities, and communication channels. Without a competent team, detection tools, segmentation, and post-incident analysis cannot be effectively leveraged. NIST explicitly lists 'Incident Response Team' as a key preparation component, including team formation, training, and equipping.

Answer

Using YARA rules to detect malware in the environment

Answer

Implementing network segmentation to limit lateral movement

Answer

Conducting a root cause analysis after each incident

Question 8

A development team wants to find vulnerable open-source libraries before deployment. Which control best fits this stage? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Software composition analysis in the CI/CD pipeline. Software composition analysis (SCA) is the correct control because it automatically scans the project's dependencies against known vulnerability databases (e.g., NVD, GitHub Advisory Database) to identify vulnerable open-source libraries before deployment. Integrating SCA into the CI/CD pipeline ensures that vulnerabilities are caught early in the development lifecycle, aligning with the shift-left security principle without suppressing or masking risk.

Answer

Wireless spectrum analysis

Answer

Physical badge access reviews

Answer

Database transaction log backups

Question 9

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners analyze live web applications by sending HTTP requests and inspecting responses. When authentication is required to access protected pages, the scanner must maintain a valid session to reach those endpoints. Configuring authenticated scanning with a test account and proper session handling (e.g., using cookies, tokens, or form-based login) allows the scanner to traverse authenticated pages, ensuring the scan covers the full attack surface and reports findings from restricted areas.

Answer

Reduce the scan to only the landing page

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Question 10

A financial services organization experienced a ransomware incident that encrypted several file servers. The CISO must deliver a post-incident report to the board of directors and the audit committee. The report must communicate both the business impact and the effectiveness of the response. Which of the following should be included in this executive-level report? (Choose two.)

Accepted Answer

A timeline of key response actions and the measured effectiveness of containment, eradication, and recovery. Executive-level post-incident reports must translate technical events into business language. Quantifying financial loss and presenting a timeline with response effectiveness give the board the information they need to evaluate risk, resilience, and investment priorities. Technical artifacts like packet captures, hashes, and file lists belong in operational reports, not board communications.

Answer

The complete raw packet capture from the initial compromise vector

Answer

The full malware binary hash list and YARA rule syntax used during triage

Answer

A detailed list of every file that was encrypted, including full directory paths

Question 11

During an incident response engagement, a junior analyst asks the team lead about the purpose of a lessons learned meeting. Which of the following BEST describes the primary objective of this meeting?

Accepted Answer

To identify improvements to the incident response process and prevent recurrence.. The lessons learned meeting is a post-incident review focused on improving the incident response process. It identifies strengths and weaknesses in detection, analysis, containment, eradication, and recovery. The outcome should be actionable recommendations to prevent similar incidents and enhance future response. Blame, financial calculations, and deep technical dives are not the primary objectives. A blameless, improvement-oriented approach is most effective.

Answer

To determine the exact financial cost of the incident for insurance claims.

Answer

To assign blame for the incident to the responsible parties.

Answer

To provide a detailed technical walkthrough of the malware for all attendees.

Question 12

A CSIRT is following its incident response plan during a confirmed data breach. The team lead needs to ensure that all evidence collected is admissible in a future legal proceeding. Which of the following should the team lead implement FIRST?

Accepted Answer

Establish a chain of custody log for all evidence items.. A chain of custody log is the first legal safeguard because it documents the who, what, when, and why of evidence handling. Without it, any forensic image or log can be challenged as tampered or unauthenticated. Other actions like imaging or interviews are important but do not by themselves ensure admissibility. The team lead should initiate the chain of custody before or during the first evidence collection.

Answer

Notify law enforcement and await their instructions before collecting any evidence.

Answer

Create a full forensic image of every affected system's hard drive.

Answer

Interview all employees who have access to the affected systems.

Question 13

A security analyst is drafting a communication plan for a suspected data breach involving customer personally identifiable information. Legal counsel advises that notification may be required under multiple regulations. Which of the following should the analyst do FIRST to ensure the communication plan meets regulatory obligations?

Accepted Answer

Identify which regulations apply and their specific notification requirements, including timelines and recipients. When a data breach involves regulated data, the first step is to determine which laws apply and what they require. Notification timelines, recipients, and content vary by regulation. Identifying these obligations ensures the communication plan is legally compliant and avoids premature or inadequate disclosures. Only after this analysis should customer, public, or internal communications be drafted.

Answer

Publish a press release on the corporate website to demonstrate transparency

Answer

Send an internal email to all employees describing the breach and instructing them not to discuss it

Answer

Immediately notify all affected customers via email with the details of the breach

Question 14

A security analyst is preparing a quarterly vulnerability management report for IT operations managers. The report must help them prioritize remediation efforts across a large environment. Which metric is MOST useful to include for this audience?

Accepted Answer

Percentage of critical vulnerabilities remediated within the defined SLA, segmented by business unit. IT operations managers need actionable metrics that tie remediation performance to accountability and risk reduction. The percentage of critical vulnerabilities remediated within SLA, broken down by business unit, provides clear visibility into which teams are meeting targets and where intervention is needed. This drives prioritization far better than raw counts, averages, or process metrics.

Answer

Number of vulnerability scans completed successfully each month

Answer

Average CVSS base score of all open vulnerabilities across the enterprise

Answer

Total count of vulnerabilities discovered, grouped by severity rating

Question 15

A security analyst receives an alert that a workstation is communicating with a known C2 server over DNS. The analyst wants to quickly isolate the endpoint from the network but keep it powered on for later memory capture. Which of the following actions should the analyst take FIRST?

Accepted Answer

Administratively disable the switch port to which the workstation is connected.. Administratively disabling the switch port is the fastest, most controlled way to isolate the endpoint while preserving volatile memory. It stops C2 communication without powering off the system, allowing the analyst to capture RAM and running processes. Physical disconnection or shutdown may lose evidence or be less auditable, and antivirus scanning does not contain the threat. Containment should always precede eradication.

Answer

Disconnect the workstation's network cable from the switch port.

Answer

Run a full antivirus scan on the workstation to remove the malware.

Answer

Shut down the workstation to prevent further data exfiltration.