CS0-003 Incident Response and Management — 40 Questions

Question 1

An analyst receives an alert about a user account that has been locked out multiple times within an hour. The account belongs to a system administrator. Which incident category does this scenario most likely fall under?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insider threat. A system administrator account being locked out multiple times in an hour suggests a deliberate attempt to guess or brute-force the credentials, or the admin themselves may be performing unauthorized actions that trigger lockout policies. This aligns with an insider threat because the account has elevated privileges and the anomalous lockout pattern indicates either a compromised credential or malicious insider activity, not an external network-based attack.

Answer

DDoS

Answer

Ransomware

Answer

Phishing

Question 2

Which of the following is the MOST volatile data according to the order of volatility?

Accepted Answer

CPU registers and cache. CPU registers and cache are the most volatile because they store data only while the system is powered on and actively executing instructions. Unlike RAM, which retains data for a short time after power loss, registers and cache lose their contents almost instantly when power is removed, making them the highest priority in the order of volatility (OOV) for forensic acquisition.

Answer

Disk storage

Answer

Swap space

Answer

RAM

Question 3

A company has experienced a ransomware attack that encrypted critical servers. The incident response team is in the containment, eradication, and recovery phase. Which THREE actions are part of long-term containment? (Choose three.)

Accepted Answer

Apply security patches to vulnerable systems. Long-term containment focuses on hardening the environment and preventing re-infection while recovery proceeds, so A (Apply security patches to vulnerable systems) is correct because remediating the exploited vulnerability removes the initial access vector the ransomware used. B (Rotate all privileged account credentials) is correct because ransomware operators often harvest credentials for lateral movement and persistence, so resetting privileged passwords and keys invalidates stolen authentication material. E (Rebuild affected servers from clean backups) is correct because restoring systems from verified, offline, malware-free backups is a core long-term containment and recovery action that eliminates the encrypted/compromised state. C (Isolate the infected systems from the network) is not part of long-term containment because it is a short-term containment action performed immediately to stop the spread. D (Block the ransomware's C2 domain at the firewall) is not long-term containment because it is a short-term containment/eradication measure that only blocks one known indicator rather than addressing the root cause.

Answer

Isolate the infected systems from the network

Answer

Block the ransomware's C2 domain at the firewall

Question 4

An incident responder needs to collect memory from a Linux system during an incident. Which tool should the responder use?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory from Linux systems, loading as a kernel module to safely dump RAM contents. During incident response, memory acquisition must be performed with minimal system interference, and LiME supports both raw and compressed output formats suitable for analysis with tools like Volatility.

Answer

avml

Answer

WinPmem

Answer

FTK Imager

Question 5

An analyst is investigating a suspected data breach and needs to preserve network logs. Which of the following actions is MOST appropriate?

Accepted Answer

Forward logs to a remote syslog server. Preserving network logs is best accomplished by forwarding them to a remote syslog server. This maintains a centralized, unaltered copy that is less likely to be tampered with or lost. Packet capture collects live traffic and does not preserve existing logs.

Answer

Delete old logs to free space for new logs

Answer

Perform a packet capture (pcap) and store it on write-protected media

Answer

Copy the log files to a USB drive and analyze them

Question 6

A security analyst is performing incident response for a suspected malware outbreak. Which TWO actions are examples of long-term containment? (Select TWO.)

Accepted Answer

Apply security patches to all systems. Long-term containment focuses on durable remediation that prevents reinfection and restores a trusted state, rather than short-term isolation. Option A (Apply security patches to all systems) is correct because patching closes the vulnerability that allowed the malware to spread, providing a persistent fix that hardens the environment after the immediate threat is contained. Option E (Rebuild compromised systems from known good media) is correct because rebuilding from trusted media removes any residual malware, backdoors, or persistence mechanisms, ensuring systems are returned to a verified clean state. Options B (Isolate the affected network segment), C (Disable compromised user accounts), and D (Block malicious IPs at the firewall) are short-term containment actions that limit immediate spread or cut off active attacker access but do not address the root cause or permanently remediate the environment.

Answer

Isolate the affected network segment

Answer

Disable compromised user accounts

Answer

Block malicious IPs at the firewall

Question 7

An organization's security team receives a report of a potential insider threat. An employee is suspected of accessing sensitive files without authorization. Which incident category BEST describes this scenario?

Accepted Answer

Insider threat. An insider threat is a security risk originating from within the organization, often involving unauthorized access or data exfiltration by employees.

Answer

Malware

Answer

Data breach

Answer

Ransomware

Question 8

During a DDoS attack, the incident response team notices that the attack traffic originates from multiple IP addresses across different countries. The team decides to implement a long-term containment strategy. Which action is MOST appropriate for long-term containment?

Accepted Answer

Implement BGP blackholing with the ISP.. Long-term containment focuses on preventing recurrence. Implementing BGP blackholing at the ISP level can mitigate future DDoS attacks by dropping traffic to the targeted IPs upstream.

Answer

Block the source IPs on the firewall.

Answer

Increase server bandwidth to absorb the traffic.

Answer

Deploy additional load balancers.

Question 9

During a forensic investigation, an analyst needs to acquire volatile memory from a compromised Linux server running a critical application. The server cannot be powered off. Which tool should the analyst use to capture memory with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module designed to acquire volatile memory from Linux systems with minimal impact, allowing capture without powering off the server. It can output memory to a file or over the network, preserving evidence integrity. avml is also a Linux memory acquisition tool, but LiME is the classic, widely accepted forensic choice for least-impact live acquisition on Linux.

Answer

avml

Answer

WinPmem

Answer

dd

Question 10

During a dynamic malware analysis session, a security analyst uses a sandbox to detonate a suspicious file. Which of the following observations would be considered a behavioral indicator of compromise (IOC)?

Accepted Answer

The file makes outbound connections to an unknown IP address. During dynamic analysis, behavioral IOCs include actions performed by malware, such as network connections, file creation, or registry changes. Outbound connections to an unknown IP address are a classic behavioral indicator of command-and-control activity, making option D correct. While option C (creating a scheduled task) is also a behavioral action, it is not considered a definitive behavioral IOC in this context because scheduled tasks can be created by legitimate software and are often used for persistence rather than immediate malicious activity. The question expects the most direct behavioral indicator, which is the network connection. Options A and B are static indicators, not behavioral.

Answer

The file has a suspicious import table

Answer

The file's PE header indicates it is packed

Answer

The file creates a scheduled task

Question 11

A security analyst is investigating a suspected insider threat incident. The analyst needs to preserve evidence before containment. Which of the following actions should the analyst prioritize to maintain the integrity of digital evidence?

Accepted Answer

Using a write blocker to create a forensic image of the hard drive. A write blocker prevents any write operations to the source drive during imaging, preserving the original evidence in an unmodified state. Creating a forensic image with a write blocker ensures the copy is a bit-for-bit duplicate and the original remains admissible. This is the foundational step in the order of volatility and chain of custody.

Answer

Imaging the suspect's hard drive using dd without a write blocker

Answer

Rebooting the suspect's computer to ensure no hidden processes are running

Answer

Deleting suspicious files to prevent further damage

Question 12

During a malware outbreak, an incident responder uses YARA rules to detect similar malware across the environment. The responder created a custom YARA rule based on static analysis of the malware sample. Which THREE elements are MOST useful for creating an effective YARA rule for this malware? (Choose THREE.)

Accepted Answer

Unique strings found in the malware binary. YARA rules commonly use strings, PE header characteristics, and file metadata. While YARA can check file size with the filesize condition, it is not a strong indicator for identifying similar malware because it is not unique and can be easily changed. Dynamic behavior, such as sandbox execution results, is not used in static YARA rules.

Answer

The file size of the malware sample

Answer

Behavior observed in a sandbox, such as registry changes

Question 13

A security analyst is performing dynamic malware analysis using a sandbox. The analyst observes that the malware creates a scheduled task that executes a PowerShell command to download a payload from a remote server. Which of the following behavioral IOCs should be prioritized for detection?

Accepted Answer

The creation of a scheduled task. The creation of a scheduled task is a behavioral indicator that is highly specific to the malware's persistence mechanism and is less likely to change than the remote server's domain or IP. Prioritizing this IOC allows detection of the malware's action regardless of the payload's source, making it a robust detection point.

Answer

The domain name of the remote server

Answer

The hash of the initial malware sample

Answer

The IP address of the remote server

Question 14

A security team is responding to a suspected data breach involving exfiltration of customer data via email. During the containment phase, which TWO actions should the team perform to preserve evidence while preventing further data loss?

Accepted Answer

Disable the compromised user account.. Disabling the compromised account stops further data exfiltration, and taking a memory dump of the email server preserves volatile evidence for forensic analysis.

Answer

Rebuild the email server from backup.

Answer

Notify all customers immediately.

Answer

Apply all available patches to the email server.

Question 15

A security analyst is responding to an incident involving a compromised user account. The analyst has confirmed that the account was used to access sensitive files. Which TWO of the following actions should the analyst take to contain the incident while preserving evidence? (Choose two.)

Accepted Answer

Disable the user account in Active Directory.. Disabling the compromised account stops further access without destroying evidence, and capturing a memory image preserves volatile data that could be lost. Together, they contain the incident while maintaining forensic integrity. Resetting passwords or deleting mailboxes can be ineffective or destructive. Terminating sessions alone is insufficient if the account remains active. These two actions balance containment and evidence preservation.

Answer

Reset the user's password and require a change at next logon.

Answer

Delete the user's mailbox to prevent further data theft.

Answer

Immediately terminate all active sessions for the user.

Question 16

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, an analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which step should the analyst perform next to validate the alert?

Accepted Answer

Correlate the alert with other logs and endpoint data to confirm malicious activity.. During the detection and analysis phase, the primary goal is to validate the alert by correlating it with additional data sources (e.g., firewall logs, DNS logs, endpoint detection and response (EDR) telemetry) to confirm whether the traffic is truly malicious or a false positive. Simply searching external threat intelligence (Option A) provides context but does not confirm activity on the host; escalation (Option C) and containment (Option D) are premature without validated evidence.

Answer

Search for the IP address on VirusTotal and Shodan.

Answer

Escalate the alert to the incident response team for containment.

Answer

Contain the host immediately by disconnecting it from the network.

Question 17

An organization's security team receives an alert about a potential ransomware infection on a critical server. The severity classification is 'high' because the server supports a production database. According to the incident response plan, which containment action should be taken first to minimize data loss?

Accepted Answer

Disconnect the server from the network.. Isolating the network connection prevents lateral movement and further encryption while preserving evidence for forensic analysis.

Answer

Reboot the server to clear the ransomware from memory.

Answer

Kill the ransomware process using task manager.

Answer

Create a full disk image of the server before any action.

Question 18

A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?

Accepted Answer

CPU registers → RAM → Swap → Network connections → Disk → Archived media. The correct order of volatility is CPU registers, RAM, swap, network connections, disk, archived media. This sequence captures the most volatile data first: CPU registers are the most volatile, followed by RAM, then swap, then network connections, then disk, and finally archived media.

Answer

Disk → RAM → Swap → CPU registers → Network connections → Archived media

Answer

Network connections → CPU registers → RAM → Swap → Disk → Archived media

Answer

CPU registers → RAM → Swap → Disk → Network connections → Archived media

Question 19

After containing a malware outbreak, the incident response team performs static malware analysis on a suspicious executable. Which of the following artifacts would be most helpful in creating a YARA rule to detect variants of the malware?

Accepted Answer

The import table showing API calls like WriteProcessMemory and CreateRemoteThread. Import table analysis reveals API calls and DLLs used by the malware, which are often consistent across variants and useful for detection.

Answer

The creation timestamp of the file

Answer

The file size of the executable

Answer

The packer used to obfuscate the executable

Question 20

During dynamic malware analysis in a sandbox, an analyst observes that the malware attempts to connect to a remote IP address on port 443, modifies the Windows registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and drops a DLL in the system32 folder. Which type of IOC is most indicative of persistence?

Accepted Answer

The registry modification to the Run key. The registry modification to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is the most indicative of persistence because this specific key is designed to automatically launch programs when a user logs in. By adding a value here, the malware ensures it executes on every system startup, which is the definition of persistence. In contrast, network connections and file drops are common during execution but do not inherently guarantee re-execution after a reboot.

Answer

The network connection over port 443

Answer

The remote IP address

Answer

The dropped DLL file hash