CS0-003 Practice Questions 2 — 50 Questions

Question 1

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For stakeholder management, Which documentation or approval is required to keep the programme defensible?

Accepted Answer

Asset criticality, exposure, and business impact. D is correct because remediation priority is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API has high business impact and exposure, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based vulnerability management principles where context (e.g., data sensitivity, network reachability) drives patching order.

Answer

The colour of the scanner dashboard

Answer

The number of installed fonts

Answer

Whether the hostname is shorter

Question 2

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is SOC manager, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are the core operational metrics that directly measure the effectiveness and efficiency of an incident response program. For a SOC manager assessing quarter-over-quarter improvement, these metrics provide actionable insight into detection speed, response agility, containment effectiveness, and whether incidents are being fully remediated to prevent repeats.

Answer

Number of desktop wallpapers changed

Answer

Number of unused dashboards

Answer

Total coffee consumed by analysts

Question 3

A DAST scan cannot reach authenticated pages of a web application and reports only public content findings. What should be configured? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Authenticated scanning with a test account and session handling. DAST scanners analyze live web applications by sending HTTP requests and inspecting responses. When authentication is required to access protected pages, the scanner must maintain a valid session to reach those endpoints. Configuring authenticated scanning with a test account and proper session handling (e.g., using cookies, tokens, or form-based login) allows the scanner to traverse authenticated pages, ensuring the scan covers the full attack surface and reports findings from restricted areas.

Answer

Reduce the scan to only the landing page

Answer

Disable all application authentication

Answer

Treat absence of findings as proof of security

Question 4

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option D is correct because it directly answers the board's question about whether cyber risk is decreasing by showing a trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. This provides a clear, quantitative, and business-aligned view of risk reduction, which is essential for executive reporting. For a technical remediation owner, this content is most appropriate as it focuses on actionable metrics (e.g., SLA compliance, residual risk per service) that directly guide patching and mitigation priorities.

Answer

A raw CSV of 20,000 findings

Answer

A screenshot of every scanner page

Answer

A list of tool login names

Question 5

Match each security tool to its primary purpose.

Question 6

Match each network protocol to its well-known port number.

Question 7

Match each incident response phase to its activity.

Question 8

Match each threat intelligence source to its description.

Question 9

Match each log type to its typical source.

Question 10

Match each vulnerability scanning concept to its definition.

Question 11

Match each regulatory framework to its focus.

Question 12

Match each analysis technique to its description.

Question 13

Order the steps to perform a vulnerability scan using a tool like Nessus.

Question 14

Arrange the steps for conducting a risk assessment in the correct order.

Question 15

Order the steps for setting up a SIEM (Security Information and Event Management) system.

Question 16

Arrange the steps for a typical penetration testing engagement in the correct order.

Question 17

Arrange the steps for conducting a security incident response in the correct order.

Question 18

Order the steps for proper forensic acquisition of a hard drive.

Question 19

Order the steps for deploying a new security patch to a production environment.

Question 20

Order the steps for a typical patch management process.