CS0-003 Practice Test 9 — 10 Questions

Question 1

A cloud security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The instance is part of an auto-scaling group. What is the best immediate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the instance by modifying its security group to deny all traffic.. Isolating the instance by removing it from the security group or using a quarantine VPC prevents further communication while preserving forensic data.

Answer

Terminate the instance immediately to stop the threat.

Answer

Ignore the alert because auto-scaling groups are ephemeral.

Answer

Update the GuardDuty threat list to ignore that IP.

Question 2

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a finance workstation to a known malicious IP address at 2:00 AM. The analyst checks the firewall logs and sees a single connection. Which action should the analyst take FIRST according to NIST SP 800-61?

Accepted Answer

Validate the incident by reviewing additional data sources.. NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.

Answer

Run a full antivirus scan on the workstation.

Answer

Isolate the workstation from the network immediately.

Answer

Notify law enforcement per the incident response plan.

Question 3

A security analyst is triaging an alert indicating that a user's workstation has been infected with ransomware. The file server shows signs of encryption. The analyst needs to contain the incident. Which action should the analyst take FIRST to minimize damage?

Accepted Answer

Disconnecting the workstation from the network. Disconnecting the infected workstation from the network stops the ransomware from spreading to other systems via network shares.

Answer

Running a full antivirus scan on the workstation

Answer

Disabling the user's Active Directory account

Answer

Rebuilding the workstation from a known good image

Question 4

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Accepted Answer

Notify all affected data subjects without undue delay if high risk. GDPR requires notification to the supervisory authority within 72 hours, documentation of the breach, and notification to affected individuals if high risk.

Answer

Publish a public notice in the local newspaper

Answer

Notify law enforcement within 24 hours

Question 5

A vulnerability manager wants accurate Linux package findings. Which scan conditions are important? (Choose two.)

Accepted Answer

Authenticated access to inspect installed packages. For accurate Linux package findings, the vulnerability scanner must have authenticated access (e.g., via SSH with valid credentials) to inspect installed packages directly from the package manager database (e.g., RPM or dpkg). Without authentication, the scanner can only perform unauthenticated network-based checks, which cannot reliably determine installed software versions or patch levels. Authenticated access ensures the scanner can execute commands like 'rpm -qa' or 'dpkg -l' to enumerate packages with high accuracy.

Answer

Only scanning ICMP echo replies

Answer

Changing server hostnames randomly

Question 6

An analyst is creating a compliance dashboard for management. Which of the following is the most relevant metric to include regarding patch management?

Accepted Answer

Patch SLA compliance %. Patch SLA compliance percentage directly measures how well the organization meets patch deadlines, which is a key compliance metric.

Answer

Number of antivirus alerts

Answer

Phishing simulation click rate

Answer

Mean time to detect incidents

Question 7

A security analyst is reviewing a vulnerability scan report and notices a plugin that identifies a critical vulnerability with a CVSS v3.1 base score of 9.8. The CVSS vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which attack vector is indicated?

Accepted Answer

Network. AV:N indicates network attack vector, meaning the vulnerability can be exploited remotely over the network without any physical or local access.

Answer

Adjacent network

Answer

Local

Answer

Physical

Question 8

Which metric measures the average time it takes for an organization to identify a security incident from the moment it occurs?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) is the average time to detect an incident.

Answer

Mean Time to Resolve (MTTR)

Answer

Patch SLA compliance percentage

Answer

Mean Time to Remediate (MTTRem)

Question 9

An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)

Accepted Answer

Implementing network segmentation to prevent lateral movement.. Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.

Answer

Identifying and patching the vulnerability exploited by the malware.

Answer

Creating a forensic image of the infected systems for later analysis.

Answer

Notifying law enforcement agencies about the incident.

Question 10

A vulnerability management team is evaluating whether to apply a patch immediately or implement a compensating control. The patch is for a vulnerability in a legacy system that cannot be taken offline during business hours. The compensating control would involve restricting network access to the system. Which decision is MOST appropriate?

Accepted Answer

Implement a compensating control and schedule patching during a maintenance window. If the system cannot be patched immediately, implementing a compensating control (network restriction) reduces risk while waiting for a maintenance window.

Answer

Ignore the vulnerability since it affects a legacy system

Answer

Remove the system from the network

Answer

Apply the patch immediately despite the outage risk