CS0-003 Incident Response and Management — 25 Questions

Question 1

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, an analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which step should the analyst perform next to validate the alert?

Accepted Answer

Correlate the alert with other logs and endpoint data to confirm malicious activity.. Option B is correct because during the detection and analysis phase, the primary goal is to validate the alert by correlating it with additional data sources (e.g., firewall logs, DNS logs, endpoint detection and response (EDR) telemetry) to confirm whether the traffic is truly malicious or a false positive. Simply searching external threat intelligence (Option A) provides context but does not confirm activity on the host; escalation (Option C) and containment (Option D) are premature without validated evidence.

Answer

Search for the IP address on VirusTotal and Shodan.

Answer

Escalate the alert to the incident response team for containment.

Answer

Contain the host immediately by disconnecting it from the network.

Question 2

An organization's security team receives an alert about a potential ransomware infection on a critical server. The severity classification is 'high' because the server supports a production database. According to the incident response plan, which containment action should be taken first to minimize data loss?

Accepted Answer

Disconnect the server from the network.. Isolating the network connection prevents lateral movement and further encryption while preserving evidence for forensic analysis.

Answer

Reboot the server to clear the ransomware from memory.

Answer

Kill the ransomware process using task manager.

Answer

Create a full disk image of the server before any action.

Question 3

A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?

Accepted Answer

CPU registers → RAM → Swap → Disk → Network connections → Archived media. The order of volatility starts with the most volatile data (CPU registers/cache) and proceeds to the least volatile (archived media).

Answer

Disk → RAM → Swap → CPU registers → Network connections → Archived media

Answer

RAM → CPU registers → Swap → Network connections → Disk → Archived media

Answer

Network connections → CPU registers → RAM → Swap → Disk → Archived media

Question 4

After containing a malware outbreak, the incident response team performs static malware analysis on a suspicious executable. Which of the following artifacts would be most helpful in creating a YARA rule to detect variants of the malware?

Accepted Answer

The import table showing API calls like WriteProcessMemory and CreateRemoteThread. Import table analysis reveals API calls and DLLs used by the malware, which are often consistent across variants and useful for detection.

Answer

The creation timestamp of the file

Answer

The file size of the executable

Answer

The packer used to obfuscate the executable

Question 5

During dynamic malware analysis in a sandbox, an analyst observes that the malware attempts to connect to a remote IP address on port 443, modifies the Windows registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and drops a DLL in the system32 folder. Which type of IOC is most indicative of persistence?

Accepted Answer

The registry modification to the Run key. The registry modification to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is the most indicative of persistence because this specific key is designed to automatically launch programs when a user logs in. By adding a value here, the malware ensures it executes on every system startup, which is the definition of persistence. In contrast, network connections and file drops are common during execution but do not inherently guarantee re-execution after a reboot.

Answer

The network connection over port 443

Answer

The remote IP address

Answer

The dropped DLL file hash

Question 6

An organization uses MISP as its threat intelligence platform. After a security incident, the team wants to share IOCs with other trusted organizations. Which standard should they use to package and exchange the threat intelligence?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is the standard for describing threat intelligence, and TAXII is the protocol for sharing it.

Answer

SNMP

Answer

NetFlow

Answer

SMTP

Question 7

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for a recent breach was 14 days, while the mean time to respond (MTTR) was 6 hours. Which metric should the team prioritize to improve in future incidents?

Accepted Answer

Mean time to detect (MTTD). A high MTTD indicates the organization is not detecting incidents quickly enough, which increases dwell time and potential damage.

Answer

Percentage of incidents containing malware

Answer

Number of incidents per week

Answer

Mean time to respond (MTTR)

Question 8

A security analyst is performing memory acquisition on a compromised Linux server using LiME. The analyst needs to capture the memory image with minimal impact on the system. Which of the following parameters should the analyst use to ensure the output is forensically sound?

Accepted Answer

Ensure the output path is on a write-blocked device. Using a write blocker ensures the memory capture does not alter the storage media, preserving forensic integrity.

Answer

Use the --digest option to calculate a SHA256 hash during acquisition

Answer

Specify a format that compresses the output to reduce size

Answer

Use the --reload option to reload the original kernel module after acquisition

Question 9

An analyst receives an alert about a user account that has been locked out multiple times within an hour. The account belongs to a system administrator. Which incident category does this scenario most likely fall under?

Accepted Answer

Insider threat. A system administrator account being locked out multiple times in an hour suggests a deliberate attempt to guess or brute-force the credentials, or the admin themselves may be performing unauthorized actions that trigger lockout policies. This aligns with an insider threat because the account has elevated privileges and the anomalous lockout pattern indicates either a compromised credential or malicious insider activity, not an external network-based attack.

Answer

DDoS

Answer

Ransomware

Answer

Phishing

Question 10

During a forensic investigation, an analyst creates a disk image using dd with a SHA256 hash. Later, the analyst needs to verify the integrity of the image before analysis. Which command should the analyst use to compare the original hash with a newly computed hash?

Accepted Answer

sha256sum image.dd. Recomputing the hash with sha256sum and comparing it to the original verifies that the image has not been altered.

Answer

md5sum original.dd

Answer

dd if=image.dd | sha256sum

Answer

chksum -a sha256 image.dd

Question 11

An organization has been experiencing repeated phishing attacks that bypass email filters. The incident response team wants to enhance detection by creating rules based on characteristics of the phishing emails. Which of the following IOCs would be most effective for detecting similar phishing campaigns?

Accepted Answer

Email subject lines and sender domain. Email indicators such as subject lines, sender addresses, or embedded URLs are directly observable in emails and help identify phishing patterns.

Answer

Registry keys modified by the payload

Answer

File hashes of attached malware

Answer

IP addresses of the phishing servers

Question 12

During a post-incident activity, the CSIRT performs a root cause analysis for a data breach. They discover that the breach originated from a misconfigured S3 bucket that allowed public read access. Which of the following actions should be included in the lessons learned to prevent recurrence?

Accepted Answer

Implement automated compliance checks for cloud storage configurations. Implementing automated compliance checks using tools like AWS Config ensures that storage configurations are continuously monitored and misconfigurations are flagged or corrected.

Answer

Rotate all access keys for the affected account

Answer

Disable public access to all S3 buckets permanently

Answer

Conduct a penetration test on the cloud environment

Question 13

A security analyst is responding to a potential data exfiltration incident. As part of the containment strategy, the analyst must preserve evidence. Which TWO actions should the analyst take before containment? (Select two.)

Accepted Answer

Capture a forensic image of the affected systems. Forensic imaging of the affected systems captures the state before containment actions alter it. Recording current network connections captures volatile evidence that may be lost when the system is isolated.

Answer

Change passwords for affected accounts

Answer

Disconnect the system from the network

Answer

Kill malicious processes

Question 14

A CSIRT is investigating a ransomware incident that encrypted files on multiple servers. The team needs to determine the initial infection vector. Which THREE pieces of evidence should the team prioritize collecting? (Select three.)

Accepted Answer

Email gateway logs for the week prior to the incident. Email logs can reveal phishing attachments or links. Endpoint logs may show process execution or downloads. Network logs can identify C2 communication or lateral movement. These three together help trace the initial entry.

Answer

Physical access logs to the data center

Answer

Firewall configuration backups

Question 15

A security analyst is reviewing IOCs from a threat intelligence feed. The analyst wants to enrich the IOCs using open-source tools. Which THREE tools are commonly used for IOC enrichment? (Select three.)

Accepted Answer

WHOIS. VirusTotal provides file and URL reputation. Shodan gives information about exposed services. WHOIS reveals domain registration details. These are standard enrichment sources.

Answer

Wireshark

Answer

Nmap

Question 16

During which phase of the NIST SP 800-61 incident response lifecycle would an organization conduct a lessons learned meeting?

Accepted Answer

Post-Incident Activity. The post-incident activity phase includes lessons learned, root cause analysis, and improvement actions.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Preparation

Question 17

A security analyst detects ransomware on a critical server. Which containment strategy should be implemented FIRST to minimize damage?

Accepted Answer

Disconnect the server from the network. Immediate network isolation (short-term containment) stops lateral spread and limits damage.

Answer

Run a full antivirus scan on the server

Answer

Block the ransomware's command-and-control IP at the firewall

Answer

Rebuild the server from a clean backup

Question 18

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module for acquiring volatile memory from Linux systems.

Answer

dd

Answer

FTK Imager

Answer

WinPmem

Question 19

Which of the following is the MOST volatile data according to the order of volatility?

Accepted Answer

CPU registers and cache. CPU registers and cache are the most volatile because they store data only while the system is powered on and actively executing instructions. Unlike RAM, which retains data for a short time after power loss, registers and cache lose their contents almost instantly when power is removed, making them the highest priority in the order of volatility (OOV) for forensic acquisition.

Answer

Disk storage

Answer

Swap space

Answer

RAM

Question 20

An analyst is reviewing a suspicious executable using static analysis. Which of the following would provide information about the functions the executable imports from system libraries?

Accepted Answer

Import table analysis. The import table lists DLLs and functions that the executable uses, revealing potential capabilities.

Answer

PE header analysis

Answer

String extraction

Answer

YARA rule creation