CS0-003 Practice Questions 1 — 50 Questions

Question 1

A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exclude failed logins from known service accounts. Aggregating alerts by source IP reduces noise; excluding known service accounts eliminates expected failures.

Answer

Disable the rule entirely

Answer

Increase the alert severity to critical for all failed logins

Answer

Add a correlation rule to trigger on successful login after multiple failures

Question 2

An organization uses MISP (Malware Information Sharing Platform) to share threat intelligence with trusted partners. Which of the following standards is commonly used by MISP to structure and exchange threat intelligence data?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Answer

NetFlow

Answer

SNMP

Answer

Syslog

Question 3

You are a security analyst for a mid-sized financial services company. At 2:30 PM, the endpoint detection and response (EDR) console alerts on three workstations in the accounting department, indicating that files are being encrypted with a '.encrypt' extension and a ransom note named 'READ_ME_NOW.html' has been dropped. The workstations are connected to a file server that hosts shared financial records and a domain controller that handles authentication. The file server and domain controller have not shown signs of compromise yet. Your incident response plan states that containment must begin within 15 minutes of detection. Based on your analysis of the EDR telemetry, the encryption process appears to be spreading via SMB connections from the first infected workstation. Which of the following is the BEST immediate containment action to prevent further spread while preserving evidence?

Accepted Answer

Immediately isolate the three workstations by disconnecting their network cables at the patch panel or disabling their switch ports.. Immediately isolating the three infected workstations at the network level (disconnecting cables or disabling switch ports) stops the SMB-based encryption propagation without destroying volatile forensic data. This containment action preserves the running processes, memory, and disk state for later analysis, which would be lost if the systems were powered off. The 15-minute containment window makes network isolation the fastest and most effective method to halt lateral movement while maintaining evidence integrity.

Answer

Shut down the file server and domain controller to protect critical systems from potential encryption.

Answer

Power off the three infected workstations immediately to contain the encryption process.

Answer

Apply the latest SMB vulnerability patch to the file server and domain controller to block the propagation vector.

Question 4

A security analyst is conducting a vulnerability assessment of a Kubernetes cluster. Which TWO of the following are common misconfigurations that could lead to security risks? (Select TWO.)

Accepted Answer

Running containers in privileged mode. Privileged containers and hostPath mounts are common Kubernetes misconfigurations that can lead to container breakout and host access.

Answer

Setting resource limits on containers

Answer

Configuring network policies to restrict traffic

Answer

Using read-only root filesystems

Question 5

A threat hunter is analyzing network traffic and observes a system making outbound connections to multiple IP addresses on port 53 (DNS) with unusually large payload sizes. The hunter suspects DNS tunneling. Which THREE characteristics are indicative of DNS tunneling?

Accepted Answer

Large DNS payload sizes. DNS tunneling often involves large payloads, high query volume to a single domain, and non-standard record types to encode data.

Answer

DNS responses with NXDOMAIN for most queries

Answer

Use of standard A record queries

Question 6

An analyst is creating a detection rule for lateral movement using SMB. Which two network indicators should be included in the rule? (Choose two.)

Accepted Answer

SMB traffic between workstations. Lateral movement over SMB often involves file writes to admin shares (IPC$) and unusual SMB traffic patterns.

Answer

Repeated failed logins to multiple hosts

Answer

High volume of DNS queries

Answer

Unusual outbound connections on port 443

Question 7

A threat hunter is reviewing endpoint telemetry and sees a process 'svchost.exe' spawning 'cmd.exe', which then executes 'reg.exe add' to create a Run key. The hunter suspects persistence. Which TWO artifacts should the hunter examine to confirm persistence?

Accepted Answer

Registry Run keys. Run keys are stored in the registry, and scheduled tasks can also be created via command line. Examining these confirms persistence.

Answer

Windows Event Logs for service creation

Answer

Browser history

Answer

Network connections

Question 8

A security analyst is reviewing the results of a web application vulnerability scan and needs to identify the vulnerabilities that are part of the OWASP Top 10 (2021) category 'Injection'. Which THREE of the following vulnerabilities fall under this category? (Select THREE.)

Accepted Answer

SQL injection. SQL injection, Cross-Site Scripting (XSS), and OS command injection are all types of injection flaws. XXE is also injection, but it is often listed separately; however, in OWASP Top 10 2021, Injection includes XSS, SQL injection, etc. Broken access control is a separate category.

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 9

A security analyst is creating a Sigma rule to detect use of the LOLBin 'certutil' for downloading payloads. Which THREE command-line arguments should the rule look for to indicate malicious use?

Accepted Answer

-urlcache. Certutil can be abused to download files using the '-urlcache' and '-split' arguments (or '-f' for force). The combination of '-urlcache' with a URL and output file is typical for downloading malicious payloads. '-verify' is legitimate, '-encode' and '-decode' are used for encoding/decoding, but '-urlcache' and '-split' are key for download.

Answer

-encode

Answer

-verify

Question 10

A security analyst is setting up a vulnerability management program and needs to select tools for container image scanning. Which THREE of the following are commonly used container image scanning tools? (Select THREE.)

Accepted Answer

Snyk. Trivy, Clair, and Snyk are well-known container image scanning tools. OpenVAS is a network vulnerability scanner, and Burp Suite is for web application testing.

Answer

OpenVAS

Answer

Burp Suite

Question 11

A cybersecurity analyst is reviewing the configuration of a Linux server against CIS Benchmarks. The analyst notices that several settings deviate from the recommended baseline. Which TWO of the following are most likely to be considered Level 1 CIS Benchmark recommendations?

Accepted Answer

Set password expiration to 90 days. CIS Level 1 recommendations are basic security settings that do not cause significant operational impact. Setting password expiration and disabling root SSH login are common Level 1 items.

Answer

Remove all unnecessary packages and services

Answer

Enable mandatory access control (SELinux) in enforcing mode

Answer

Configure audit rules for file permission changes

Question 12

An incident response team is conducting post-incident activities after a ransomware attack. The team wants to improve detection and response for future incidents. Which TWO actions are most appropriate for updating detection rules? (Select TWO.)

Accepted Answer

Create YARA rules to identify the ransomware file hashes and patterns.. Updating SIEM correlation rules based on the attack TTPs and creating YARA rules for the ransomware family will enhance detection of similar threats.

Answer

Conduct a tabletop exercise for the incident response team.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with external threat intelligence platforms.

Question 13

A security analyst is configuring a container scanning tool to identify vulnerabilities in Docker images before deployment. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories.

Answer

Burp Suite

Answer

Nessus

Answer

OpenVAS

Question 14

After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?

Accepted Answer

Implement multi-factor authentication for remote access to reduce risk.. Lessons learned should be actionable recommendations to prevent recurrence.

Answer

The ransomware encrypted 500 files.

Answer

The incident started at 2:00 AM.

Answer

The root cause was a phishing email.

Question 15

A security analyst is communicating a complex security risk about a new zero-day vulnerability to the board of directors. The board members have varying technical backgrounds. Which approach would be MOST effective?

Accepted Answer

Describe the potential financial loss, reputational damage, and regulatory fines. Translating technical risk to business impact (financial, reputational, regulatory) is key for non-technical stakeholders.

Answer

Provide a list of all current vulnerabilities

Answer

Present the CVSS score and affected systems

Answer

Explain the technical details of the exploit chain

Question 16

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Accepted Answer

Vulnerability scan reports. Vulnerability scan reports show identified vulnerabilities, and patch management reports show remediation efforts, together demonstrating the vulnerability management lifecycle.

Answer

Network topology diagrams

Answer

Employee training logs

Answer

Incident response playbooks

Question 17

During a security incident involving a potential data breach, the CISO asks you to prepare a communication for the board of directors. What is the MOST important aspect to emphasize in this communication?

Accepted Answer

The financial impact, reputational risk, and potential regulatory penalties. Board members are non-technical stakeholders who need to understand the business impact. The communication should translate technical details into financial, reputational, and regulatory consequences.

Answer

The specific malware used and its technical attributes

Answer

The names of the IT staff who first detected the incident

Answer

A step-by-step timeline of the incident response actions taken so far

Question 18

A security analyst is investigating a potential insider threat where a user is suspected of exfiltrating sensitive data via USB drives. The analyst needs to gather evidence while preserving the chain of custody. Which THREE actions should the analyst perform? (Choose THREE.)

Accepted Answer

Creating a forensic image of the USB drive using a write blocker. Forensic sound procedures include imaging the drive, hashing to verify integrity, and documenting the chain of custody. Disabling the account is containment, and interviewing is not part of evidence collection.

Answer

Disabling the user's network account immediately

Answer

Interviewing the user about their activities

Question 19

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Accepted Answer

Check the baseline behavior of the source IP. The first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.

Answer

Immediately block the source IP at the firewall

Answer

Update the signature database

Answer

Isolate the affected system for forensic analysis

Question 20

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Accepted Answer

Financial impact. Business risk communication should focus on financial impact, reputational impact, and regulatory penalties as these resonate with business leaders. Technical impact is too detailed.

Answer

Operational impact

Answer

Technical impact