CS0-003 Practice Test 6 — 10 Questions

Question 1

During a post-compromise review, a laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible? which action should be prioritized before closure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Forensic acquisition requires a complete chain of custody to ensure evidence integrity and admissibility in legal proceedings. Documenting who collected the evidence, when and where it was collected, cryptographic hash values (e.g., SHA-256) to verify data integrity, transfer details (e.g., write-blocker used, network path), and storage location provides a defensible record that meets legal and organizational standards.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title

Question 2

Arrange the steps for configuring a firewall rule set in the correct order.

Accepted Answer

Identify traffic, Create rule, Apply to interface, Test, Monitor. Firewall rule configuration involves identifying traffic, creating rules, applying to interface, testing, and monitoring.

Answer

Create rule, Identify traffic, Apply to interface, Test, Monitor

Answer

Apply to interface, Create rule, Identify traffic, Test, Monitor

Answer

Identify traffic, Test, Create rule, Apply to interface, Monitor

Question 3

Order the steps for deploying a new security patch to a production environment.

Accepted Answer

Download/verify the patch -> Test in staging environment -> Backup production systems -> Roll out the patch to production -> Monitor for issues. Patch deployment involves download/verification, testing, backup, rollout, and monitoring.

Answer

Backup production systems -> Download/verify the patch -> Test in staging environment -> Roll out the patch to production -> Monitor for issues

Answer

Download/verify the patch -> Backup production systems -> Test in staging environment -> Roll out the patch to production -> Monitor for issues

Answer

Download/verify the patch -> Roll out the patch to production -> Test in staging environment -> Backup production systems -> Monitor for issues

Question 4

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Container runtime events (e.g., from containerd or CRI-O) capture process spawns like an unexpected shell, Kubernetes audit logs record API calls that could indicate a compromised pod mounting the host filesystem, and network flow logs from the pod (e.g., via eBPF or Calico) reveal outbound connections to an unknown IP. Together, these three telemetry sources provide direct, real-time evidence of the three suspicious behaviors described, making them the most useful for detection and investigation.

Answer

Only monthly vulnerability scan summaries

Answer

Only user password age reports

Answer

Only physical datacenter access logs

Question 5

Which technology is specifically designed to detect anomalous user behavior that may indicate a compromised account?

Accepted Answer

UEBA.. User and Entity Behavior Analytics (UEBA) is specifically designed to establish baselines of normal user behavior and detect anomalous activities—such as unusual login times, impossible travel, or abnormal data access patterns—that may indicate a compromised account. Unlike signature-based tools, UEBA leverages machine learning and statistical modeling to identify deviations from established norms, making it the correct choice for detecting account compromise.

Answer

IDS.

Answer

SIEM.

Answer

Antivirus.

Question 6

During a vulnerability scan, the scanner reports a high number of open ports on a server that is supposed to be a hardened web server. The analyst investigates and finds that the server is running unnecessary services. Which of the following is the MOST effective long-term solution?

Accepted Answer

Implement a configuration management baseline and enforce it. Implementing a configuration management baseline and enforcing it (Option A) is the most effective long-term solution because it ensures that the server is consistently provisioned with only the necessary services and configurations. This approach uses tools like Ansible, Puppet, or Chef to automatically remediate drift, preventing unnecessary services from reappearing after manual changes or reboots. It addresses the root cause by codifying the desired state, rather than relying on ad-hoc fixes.

Answer

Disable the unnecessary services manually

Answer

Increase the frequency of vulnerability scans

Answer

Install a host-based firewall to block the ports

Question 7

A third-party provider caused an outage during remediation. What should the communication to the vendor focus on? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Timeline, service impact, evidence, required corrective actions, and contractual follow-up. It provides a structured, factual communication that addresses the legal and privacy stakeholder's need for accountability, risk assessment, and contractual compliance. The timeline and evidence establish the sequence of events, service impact quantifies the breach of SLA, required corrective actions demonstrate remediation steps, and contractual follow-up triggers legal review of penalties or liabilities. This approach avoids speculation and focuses on verifiable data, which is critical for legal teams to assess regulatory obligations (e.g., GDPR breach notification timelines) and potential litigation.

Answer

Confidential unrelated customer data

Answer

Internal blame speculation

Answer

A public press statement draft first

Question 8

A company uses a SIEM platform that ingests logs from various sources. The SOC team receives an alert for a high number of failed login attempts (over 100 in 5 minutes) on the domain controller from a single IP address. The analyst investigates and finds that the failed attempts are for multiple different usernames, including some disabled accounts. The source IP is traced to an external VPN service. The analyst also notices that a few accounts had successful logins from the same IP after the failed attempts. Which of the following is the MOST likely attack type?

Accepted Answer

Password spraying.. The attack involves a single external IP attempting logins with multiple different usernames (including disabled accounts) and eventually succeeding on a few. This is characteristic of a password spraying attack, where an attacker tries a small number of common passwords against many accounts to avoid triggering account lockout policies. The use of an external VPN service indicates the attacker is anonymizing their origin, and the successful logins after failures confirm the attack's objective.

Answer

Brute-force attack.

Answer

Kerberoasting.

Answer

Pass-the-hash.

Question 9

An analyst is preparing a report that includes Personally Identifiable Information (PII) from a data breach. The report will be shared with external auditors. Which of the following is the BEST practice for handling PII in the report?

Accepted Answer

Use tokenization or pseudonymization to mask PII while preserving analytical value. Tokenization or pseudonymization replaces PII with non-sensitive placeholders that retain referential integrity and analytical utility, allowing auditors to perform their review without exposing actual personal data. This approach balances transparency requirements with data minimization principles mandated by regulations like GDPR and PCI DSS, unlike full disclosure or simple encryption which still exposes the original data to the recipient.

Answer

Include full PII in the report for complete transparency

Answer

Encrypt the report and send it via email to auditors

Answer

Remove all PII entirely, leaving only anonymized records

Question 10

A security analyst is configuring a vulnerability scan for a demilitarized zone (DMZ) containing public-facing web servers. The analyst wants to minimize the risk of causing a denial-of-service condition on the servers. Which of the following scan settings should be configured?

Accepted Answer

Limit the number of concurrent checks.. Limiting the number of concurrent checks (option D) reduces the simultaneous requests sent to the target servers, which prevents overwhelming the web server's connection pool or CPU. This is the most direct way to minimize the risk of a denial-of-service condition during a vulnerability scan, especially in a DMZ with public-facing servers that may have limited resources.

Answer

Enable a full port scan.

Answer

Disable safe checks to speed up the scan.

Answer

Increase the scan timeout values.