CS0-003 Practice Questions 1 — 50 Questions

Question 1

After a major security incident, a post-incident review reveals that communication between the SOC and the network operations center (NOC) was slow and unclear. Which document should be updated to improve future incident response?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident response plan (IRP). The Incident Response Plan (IRP) is the primary document that outlines the phases of incident response, including the communication pathways, escalation procedures, and coordination protocols between internal teams (such as the SOC and NOC) and external stakeholders. When a post-incident review (lessons learned) identifies communication delays and lack of clarity between teams, the IRP must be updated to define clearer communication channels and responsibilities for future incidents.

Answer

Disaster recovery plan (DRP)

Answer

Communication management plan

Answer

Business continuity plan (BCP)

Question 2

Refer to the exhibit. An analyst reviews the output from a netstat command on a server. Which connection is MOST likely indicative of command and control (C2) activity?

Accepted Answer

10.0.0.5:54321 to 198.51.100.20:4444. The connection from a high ephemeral port (54321) on the server to an external IP (198.51.100.20) on port 4444 is a classic indicator of C2 activity. Port 4444 is commonly associated with Metasploit's default reverse shell listener and other malware frameworks, while the use of a non-standard high source port and an external destination suggests outbound beaconing or command reception.

Answer

10.0.0.5:22 to 10.0.0.1:50001

Answer

All connections are normal.

Answer

10.0.0.5:3389 to 192.168.1.10:54321

Question 3

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. The best next step is to validate whether the vulnerable OpenSSL binary is actually reachable or exploitable in the running container, and then rebuild from a patched base image if feasible. This balances security with business priorities by avoiding unnecessary rebuilds for non-exploitable vulnerabilities while ensuring that truly exploitable CVEs are remediated. Simply ignoring or renaming the tag does not address the underlying risk and violates secure CI/CD practices.

Answer

Ignore all base-image vulnerabilities

Answer

Only rename the image tag

Answer

Ship the image and document nothing

Question 4

During a security incident, the SOC analyst determines that the attack is originating from an internal IP address belonging to the finance department. The incident response plan requires escalation to the appropriate team. Which of the following should the analyst contact first?

Accepted Answer

The system administrator for the finance department to isolate the host.. During an active security incident where an attack is originating from an internal host, the immediate priority under incident response frameworks (such as NIST SP 800-61) is containment. The SOC analyst should contact the system administrator responsible for the system to isolate the host and prevent lateral movement or further damage. Contacting a non-technical department manager to ask if an 'attack' is authorized is incorrect and delays critical containment actions.

Answer

The legal department to handle potential compliance issues.

Answer

The finance department manager to confirm if the activity is authorized.

Answer

The human resources department for disciplinary action.

Question 5

A security analyst is evaluating a Kubernetes cluster for misconfigurations. Which TWO of the following are common Kubernetes misconfigurations that increase security risk? (Select the two best answers.)

Accepted Answer

Using hostPath mounts. Option B (Using hostPath mounts) is correct because a hostPath volume mounts a file or directory directly from the node's filesystem into the pod, allowing a compromised container to read or write sensitive node paths such as /etc, /var/run/docker.sock, or kubelet credentials, which can lead to node takeover or cluster compromise. Option C (Using privileged containers) is correct because a privileged container runs with essentially all Linux capabilities and full access to host devices and kernel interfaces (equivalent to --privileged), disabling isolation and enabling container escape and host compromise. Option A is not a misconfiguration but a security best practice, since running as non-root reduces privilege. Option D is not a misconfiguration because enabling RBAC is a recommended access-control hardening measure. Option E is not a misconfiguration because network policies that restrict pod traffic reduce lateral movement and are a security best practice.

Answer

Running containers as non-root user

Answer

Enabling Role-Based Access Control (RBAC)

Answer

Implementing network policies to restrict traffic

Question 6

A company uses Lynis for compliance scanning on Linux servers. During a scan, Lynis reports that the system has world-writable files in critical directories. Which CIS Benchmark recommendation does this finding relate to?

Accepted Answer

Ensure no world-writable files exist. CIS Benchmarks include recommendations to restrict file permissions, such as ensuring no world-writable files exist in system directories.

Answer

Ensure system is configured to forward logs to a central server

Answer

Ensure permissions on /etc/shadow are configured

Answer

Ensure separate partition exists for /tmp

Question 7

Refer to the exhibit. An analyst sees this alert in the SIEM console: Suricata alert: ET MALWARE Ransomware activity detected from 10.0.0.5 to 10.0.0.1 over SMB. What is the best immediate action?

Accepted Answer

Isolate the source host 10.0.0.5 from the network.. The alert indicates active ransomware activity from an internal source host. The best immediate action is containment: isolate source host 10.0.0.5 from the network to prevent the malware from spreading. Updating a signature and running an antivirus scan are not immediate containment actions, and escalation should not delay containment once a high-severity active threat is confirmed.

Answer

Update the Suricata signature to block the traffic.

Answer

Run a full antivirus scan on destination host 10.0.0.1.

Answer

Escalate the alert to the incident response team.

Question 8

During a forensic investigation of a compromised Linux server, the analyst needs to acquire memory for analysis. The system is running and the analyst cannot power it off. Which tool is MOST appropriate for acquiring memory in this scenario?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a tool designed for acquiring memory from Linux systems while they are running, and it can be loaded as a kernel module without shutting down.

Answer

FTK Imager

Answer

WinPmem

Answer

dd

Question 9

During a network traffic analysis, a security analyst notices a high volume of DNS queries to a domain that is algorithmically generated. The domain names follow a random pattern and are not resolved to known IP addresses. Which technique is most likely being used?

Accepted Answer

Domain generation algorithm (DGA). Domain Generation Algorithms (DGAs) are commonly used by malware to generate a large number of potential C2 domain names to evade static blocklists.

Answer

DNS tunneling

Answer

Beaconing

Answer

HTTP smuggling

Question 10

You are a security analyst for a mid-sized financial services company. At 2:30 PM, the endpoint detection and response (EDR) console alerts on three workstations in the accounting department, indicating that files are being encrypted with a '.encrypt' extension and a ransom note named 'READ_ME_NOW.html' has been dropped. The workstations are connected to a file server that hosts shared financial records and a domain controller that handles authentication. The file server and domain controller have not shown signs of compromise yet. Your incident response plan states that containment must begin within 15 minutes of detection. Based on your analysis of the EDR telemetry, the encryption process appears to be spreading via SMB connections from the first infected workstation. Which of the following is the BEST immediate containment action to prevent further spread while preserving evidence?

Accepted Answer

Immediately isolate the three workstations by disconnecting their network cables at the patch panel or disabling their switch ports.. Immediately isolating the three infected workstations at the network level (disconnecting cables or disabling switch ports) stops the SMB-based encryption propagation without destroying volatile forensic data. This containment action preserves the running processes, memory, and disk state for later analysis, which would be lost if the systems were powered off. The 15-minute containment window makes network isolation the fastest and most effective method to halt lateral movement while maintaining evidence integrity.

Answer

Shut down the file server and domain controller to protect critical systems from potential encryption.

Answer

Power off the three infected workstations immediately to contain the encryption process.

Answer

Apply the latest SMB vulnerability patch to the file server and domain controller to block the propagation vector.

Question 11

A security analyst at a small company notices that several workstations in the finance department are communicating with an external IP address known to be associated with a command-and-control server. The analyst checks the host-based firewall logs and sees that outbound connections to that IP are allowed. Which of the following is the BEST immediate action to take?

Accepted Answer

Disconnect the workstations from the network.. Disconnecting the workstations from the network immediately stops the active command-and-control communication and prevents further data exfiltration or lateral movement, which is the priority during a suspected active compromise. Containment precedes remediation, so isolating the hosts is the correct first action before blocking IPs, updating signatures, or scanning. This preserves the ability to perform forensics while halting the threat.

Answer

Block the IP at the perimeter firewall.

Answer

Update the antivirus definitions.

Answer

Run a full antivirus scan on the affected workstations.

Question 12

During a security incident, which of the following should be the FIRST communication to internal stakeholders?

Accepted Answer

Internal escalation to the incident response team. The first communication during a security incident must be the internal escalation to the incident response team, as this triggers the formal incident response process. The IR team is responsible for assessing the scope, containing the threat, and coordinating all subsequent actions, including any external notifications. Without this initial escalation, no coordinated response can occur, and other communications (legal, PR, risk) would lack the necessary technical context. This aligns with the preparation and identification phases of the incident response lifecycle (e.g., NIST SP 800-61).

Answer

Notification to law enforcement

Answer

Press release to customers

Answer

Update to the risk register

Question 13

An incident responder is collecting evidence from a compromised Linux server. The server is still running. Which order of collection adheres to the order of volatility?

Accepted Answer

Memory → network connections → swap space → disk.. The order of volatility (OOV) dictates that the most volatile data (memory/registers) must be collected first, followed by network connections, then swap space, and finally disk. Memory contains running processes and encryption keys that vanish on power loss; network connections change rapidly; swap space persists longer but is still more volatile than disk. This sequence ensures maximum preservation of ephemeral evidence before it is lost.

Answer

Memory → network connections → disk → swap space.

Answer

Disk → memory → network connections → swap space.

Answer

Network connections → memory → disk → swap space.

Question 14

A threat hunter is analyzing EDR telemetry and discovers that the process svchost.exe spawned a child process powershell.exe. The powershell.exe then established a network connection to an external IP address. Which of the following best describes this behavior in the context of threat hunting?

Accepted Answer

Living off the land binary (LOLBin) usage. The behavior described — svchost.exe spawning powershell.exe, which then makes an outbound network connection — is a classic example of a Living off the Land Binary (LOLBin) attack. LOLBins are legitimate, signed Windows executables (like PowerShell, certutil, mshta, regsvr32) that adversaries abuse to blend malicious activity into normal system noise, evading signature-based detection. Because svchost.exe is a trusted system process, its child processes are often overlooked by naive detection rules, making this pattern a high-fidelity threat-hunting indicator.

Answer

A Windows update process

Answer

Normal administrative activity

Answer

A false positive from EDR

Question 15

A security analyst is triaging an alert from the EDR that shows the process 'powershell.exe' with a parent process of 'winword.exe'. The user recently opened a document from an email. What is the most likely explanation?

Accepted Answer

The document contains a malicious macro that spawned PowerShell to execute commands. When winword.exe (Microsoft Word) is the parent of powershell.exe, it almost always indicates a malicious macro in the document spawned a shell to execute commands. This parent-child relationship is a classic indicator of macro-based malware delivery, especially when the document arrived via email and the user opened it. Legitimate Word documents rarely spawn PowerShell directly.

Answer

The user double-clicked a PowerShell script attached to the email

Answer

A scheduled task started PowerShell that initiated Word

Answer

The user is running a legitimate PowerShell script from within a Word document

Question 16

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF that blocks the attack vector. The system owner states the vulnerability is not exploitable due to the compensating control. Which of the following is the best next step?

Accepted Answer

Document the finding and accept the risk with the compensating control. The best next step is to document the finding and accept the risk with the compensating control because the WAF blocks the attack vector, making the vulnerability not exploitable. This aligns with risk management principles: compensating controls can reduce risk to an acceptable level, and acceptance should be documented.

Answer

Re-run the scan with a non-credentialed profile

Answer

Ignore the vulnerability and close the finding

Answer

Immediately patch the server during business hours

Question 17

A threat intelligence report indicates that a known APT group is using 'regsvr32.exe' to execute malicious code. Which detection rule type would be most effective in identifying this technique across multiple endpoints?

Accepted Answer

Sigma rule. Sigma is a generic, open signature format for log-based detection rules that can be converted to multiple SIEM query languages (Splunk, Elastic, Sentinel, etc.). Because the question asks for a rule type effective across multiple endpoints and the technique involves process execution (regsvr32.exe), a Sigma rule targeting process creation events is the most portable and effective choice. It can be deployed across heterogeneous endpoint detection platforms.

Answer

Snort rule

Answer

YARA rule

Answer

Suricata rule

Question 18

During a threat hunting exercise, a hunter creates a hypothesis that a threat actor is using PowerShell to download payloads from a remote server. Which ATT&CK technique is the hunter most likely investigating?

Accepted Answer

T1105 - Ingress Tool Transfer. T1105 (Ingress Tool Transfer) covers the adversary transferring tools or payloads into the victim environment from an external system, including via PowerShell downloads. The hypothesis — PowerShell downloading payloads from a remote server — maps directly to the transfer of a tool into the environment. T1059.001 describes PowerShell execution itself, but the specific behavior of pulling a payload in is T1105.

Answer

T1047 - Windows Management Instrumentation

Answer

T1071.001 - Web Protocols

Answer

T1059.001 - PowerShell

Question 19

A cloud security analyst reviews AWS CloudTrail logs and notices multiple 'RunInstances' API calls from a single IAM user creating EC2 instances with public IP addresses in an unusual region. What is the most likely concern?

Accepted Answer

The user's credentials may be compromised and used for cryptomining. Multiple RunInstances calls from a single IAM user creating public-IP EC2 instances in an unusual region is a textbook indicator of compromised credentials being used for cryptomining. Attackers favor this pattern because it rapidly provisions compute resources for mining, often in regions the victim doesn't normally use to evade detection and quota monitoring.

Answer

The user is performing legitimate scaling operations

Answer

The user is provisioning resources for a new project

Answer

The user is testing disaster recovery procedures

Question 20

An organization's incident response team is handling a ransomware incident where critical servers have been encrypted. The team has identified the ransomware variant and determined that decryption is not possible. Which of the following is the BEST post-incident activity to prevent recurrence?

Accepted Answer

Conduct a root cause analysis to determine the initial infection vector.. A root cause analysis identifies how the ransomware actually entered — phishing email, exposed RDP, unpatched VPN, supply chain — which is the only way to close the specific gap that allowed the incident. Without knowing the initial infection vector, any remediation is guesswork and the same attack can recur. Post-incident activities in NIST SP 800-61 and CompTIA's IR lifecycle explicitly call for lessons-learned/root-cause work to drive preventive controls.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with the industry ISAC.

Answer

Reimage all affected servers from backups.