CS0-003 Incident Response and Management Practice Test 2 — 15 Questions

Question 1

Which of the following is the MOST volatile data according to the order of volatility?

Accepted Answer

CPU registers and cache. CPU registers and cache are the most volatile because they store data only while the system is powered on and actively executing instructions. Unlike RAM, which retains data for a short time after power loss, registers and cache lose their contents almost instantly when power is removed, making them the highest priority in the order of volatility (OOV) for forensic acquisition.

Answer

Disk storage

Answer

Swap space

Answer

RAM

Question 2

An analyst is reviewing a suspicious executable using static analysis. Which of the following would provide information about the functions the executable imports from system libraries?

Accepted Answer

Import table analysis. The import table lists DLLs and functions that the executable uses, revealing potential capabilities.

Answer

PE header analysis

Answer

String extraction

Answer

YARA rule creation

Question 3

A SOC analyst receives an alert from a threat intelligence platform (TIP) about a new phishing campaign. The indicator is a URL. Which enrichment source is BEST for determining the URL's current hosting infrastructure?

Accepted Answer

Passive DNS. Passive DNS allows querying historical and current IP addresses associated with a domain, revealing hosting changes.

Answer

VirusTotal

Answer

WHOIS

Answer

Shodan

Question 4

During a post-incident review, the CSIRT identifies that the mean time to detect (MTTD) is significantly higher than the industry benchmark. Which initiative would MOST likely reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors. Improving detection capabilities through enhanced monitoring and alerting reduces detection time.

Answer

Conducting more frequent tabletop exercises

Answer

Rotating credentials for all service accounts

Answer

Implementing a new patch management process

Question 5

An organization has identified indicators of compromise (IOCs) from a recent incident. Which data format is specifically designed for sharing threat intelligence in a standardized, machine-readable way?

Accepted Answer

STIX. STIX (Structured Threat Information Expression) is a language for sharing threat intelligence.

Answer

PDF

Answer

CSV

Answer

JSON

Question 6

A security analyst is investigating a potential data breach. The analyst needs to preserve evidence before containment. Which of the following actions is MOST appropriate at this stage?

Accepted Answer

Creating a forensic image of the hard drive. Taking a forensic image of the affected system ensures evidence is preserved before any containment actions that could alter data.

Answer

Powering off the system

Answer

Blocking the attacker's IP at the firewall

Answer

Disabling the user's account

Question 7

An analyst runs a YARA rule against a set of files and gets a hit. The rule was written to detect a specific malware family. What is the PRIMARY purpose of using YARA rules in this context?

Accepted Answer

To identify files that match known malware characteristics. YARA is a pattern-matching tool used to identify and classify malware samples based on textual or binary patterns.

Answer

To sandbox the malware for dynamic analysis

Answer

To verify the hash of the malware sample

Answer

To extract strings from the malware

Question 8

After a DDoS attack, the CSIRT wants to share IOCs with other organizations. Which protocol is specifically designed for automated, real-time threat intelligence sharing?

Accepted Answer

TAXII. TAXII (Trusted Automated Exchange of Indicator Information) is the protocol for exchanging threat intelligence over HTTPS.

Answer

HTTP

Answer

SMTP

Answer

FTP

Question 9

Which of the following is an example of a behavioral indicator of compromise (IOC) observed during dynamic malware analysis?

Accepted Answer

Outbound network connection to a known malicious IP. Dynamic analysis monitors behavior such as network connections, file system changes, and process creation.

Answer

PE section names

Answer

File hash

Answer

Domain name

Question 10

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a workstation to an external IP address known for command and control (C2) activity. Which classification should the analyst assign to this incident?

Accepted Answer

Malware. The incident involves communication with a known C2 server, which is characteristic of a malware infection (specifically, a botnet or trojan). This falls under the malware category.

Answer

Insider threat

Answer

Data breach

Answer

Phishing

Question 11

A security analyst receives an alert about a possible ransomware outbreak. Which short-term containment action should be performed FIRST to prevent further spread?

Accepted Answer

Isolate the system from the network. Network isolation (disconnecting the affected system from the network) is a quick short-term containment step that stops the ransomware from communicating with C2 or spreading laterally.

Answer

Disable the user account

Answer

Rebuild the system

Answer

Update antivirus signatures

Question 12

During forensic analysis of a compromised server, an analyst needs to preserve evidence in order of volatility. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Acquire a memory dump using WinPmem. According to the order of volatility, CPU registers and cache are the most volatile. However, in practice, capturing memory (RAM) is the first feasible step after powering on the system, as registers are lost on shutdown. The correct order: capture memory first, then try to capture swap, then disk, etc.

Answer

Collect log files from the system

Answer

Create a forensic image of the hard drive

Answer

Run antivirus scan

Question 13

A security analyst is conducting static analysis of a suspicious executable. Which of the following tools or techniques is BEST suited for extracting strings and viewing the import table?

Accepted Answer

PEview or CFF Explorer. Static analysis often involves examining the PE header, imports, and strings. Tools like PEview, CFF Explorer, or simply using 'strings' command can extract readable strings. The import table shows DLLs and functions the executable uses.

Answer

LiME

Answer

FTK Imager

Answer

Cuckoo Sandbox

Question 14

After containing a security incident, the incident response team conducts a root cause analysis. Which of the following is the PRIMARY purpose of this activity?

Accepted Answer

To identify the initial attack vector. Root cause analysis aims to identify the underlying cause of the incident to prevent recurrence. It is a key part of post-incident activity.

Answer

To calculate the financial loss

Answer

To document the timeline

Answer

To assign blame to individuals

Question 15

An analyst receives a threat intelligence feed containing IOCs in STIX format. Which of the following BEST describes the purpose of STIX?

Accepted Answer

A standardized language for threat intelligence. STIX (Structured Threat Information Expression) is a standardized language for representing and sharing threat intelligence.

Answer

A protocol for real-time log collection

Answer

A framework for automating incident response

Answer

A tool for malware analysis