CS0-003 Incident Response and Management — 10 Questions

Question 1

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, an analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which step should the analyst perform next to validate the alert?

Accepted Answer

Correlate the alert with other logs and endpoint data to confirm malicious activity.. Option B is correct because during the detection and analysis phase, the primary goal is to validate the alert by correlating it with additional data sources (e.g., firewall logs, DNS logs, endpoint detection and response (EDR) telemetry) to confirm whether the traffic is truly malicious or a false positive. Simply searching external threat intelligence (Option A) provides context but does not confirm activity on the host; escalation (Option C) and containment (Option D) are premature without validated evidence.

Answer

Search for the IP address on VirusTotal and Shodan.

Answer

Escalate the alert to the incident response team for containment.

Answer

Contain the host immediately by disconnecting it from the network.

Question 2

An organization's security team receives an alert about a potential ransomware infection on a critical server. The severity classification is 'high' because the server supports a production database. According to the incident response plan, which containment action should be taken first to minimize data loss?

Accepted Answer

Disconnect the server from the network.. Isolating the network connection prevents lateral movement and further encryption while preserving evidence for forensic analysis.

Answer

Reboot the server to clear the ransomware from memory.

Answer

Kill the ransomware process using task manager.

Answer

Create a full disk image of the server before any action.

Question 3

A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?

Accepted Answer

CPU registers → RAM → Swap → Disk → Network connections → Archived media. The order of volatility starts with the most volatile data (CPU registers/cache) and proceeds to the least volatile (archived media).

Answer

Disk → RAM → Swap → CPU registers → Network connections → Archived media

Answer

RAM → CPU registers → Swap → Network connections → Disk → Archived media

Answer

Network connections → CPU registers → RAM → Swap → Disk → Archived media

Question 4

After containing a malware outbreak, the incident response team performs static malware analysis on a suspicious executable. Which of the following artifacts would be most helpful in creating a YARA rule to detect variants of the malware?

Accepted Answer

The import table showing API calls like WriteProcessMemory and CreateRemoteThread. Import table analysis reveals API calls and DLLs used by the malware, which are often consistent across variants and useful for detection.

Answer

The creation timestamp of the file

Answer

The file size of the executable

Answer

The packer used to obfuscate the executable

Question 5

During dynamic malware analysis in a sandbox, an analyst observes that the malware attempts to connect to a remote IP address on port 443, modifies the Windows registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and drops a DLL in the system32 folder. Which type of IOC is most indicative of persistence?

Accepted Answer

The registry modification to the Run key. The registry modification to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is the most indicative of persistence because this specific key is designed to automatically launch programs when a user logs in. By adding a value here, the malware ensures it executes on every system startup, which is the definition of persistence. In contrast, network connections and file drops are common during execution but do not inherently guarantee re-execution after a reboot.

Answer

The network connection over port 443

Answer

The remote IP address

Answer

The dropped DLL file hash

Question 6

An organization uses MISP as its threat intelligence platform. After a security incident, the team wants to share IOCs with other trusted organizations. Which standard should they use to package and exchange the threat intelligence?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is the standard for describing threat intelligence, and TAXII is the protocol for sharing it.

Answer

SNMP

Answer

NetFlow

Answer

SMTP

Question 7

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for a recent breach was 14 days, while the mean time to respond (MTTR) was 6 hours. Which metric should the team prioritize to improve in future incidents?

Accepted Answer

Mean time to detect (MTTD). A high MTTD indicates the organization is not detecting incidents quickly enough, which increases dwell time and potential damage.

Answer

Percentage of incidents containing malware

Answer

Number of incidents per week

Answer

Mean time to respond (MTTR)

Question 8

A security analyst is performing memory acquisition on a compromised Linux server using LiME. The analyst needs to capture the memory image with minimal impact on the system. Which of the following parameters should the analyst use to ensure the output is forensically sound?

Accepted Answer

Ensure the output path is on a write-blocked device. Using a write blocker ensures the memory capture does not alter the storage media, preserving forensic integrity.

Answer

Use the --digest option to calculate a SHA256 hash during acquisition

Answer

Specify a format that compresses the output to reduce size

Answer

Use the --reload option to reload the original kernel module after acquisition

Question 9

An analyst receives an alert about a user account that has been locked out multiple times within an hour. The account belongs to a system administrator. Which incident category does this scenario most likely fall under?

Accepted Answer

Insider threat. A system administrator account being locked out multiple times in an hour suggests a deliberate attempt to guess or brute-force the credentials, or the admin themselves may be performing unauthorized actions that trigger lockout policies. This aligns with an insider threat because the account has elevated privileges and the anomalous lockout pattern indicates either a compromised credential or malicious insider activity, not an external network-based attack.

Answer

DDoS

Answer

Ransomware

Answer

Phishing

Question 10

During a forensic investigation, an analyst creates a disk image using dd with a SHA256 hash. Later, the analyst needs to verify the integrity of the image before analysis. Which command should the analyst use to compare the original hash with a newly computed hash?

Accepted Answer

sha256sum image.dd. Recomputing the hash with sha256sum and comparing it to the original verifies that the image has not been altered.

Answer

md5sum original.dd

Answer

dd if=image.dd | sha256sum

Answer

chksum -a sha256 image.dd