CS0-003 Incident Response and Management Practice Test 3 — 15 Questions

Question 1

A security analyst detects ransomware on a critical server. Which containment strategy should be implemented FIRST to minimize damage?

Accepted Answer

Disconnect the server from the network. Immediate network isolation (short-term containment) stops lateral spread and limits damage.

Answer

Run a full antivirus scan on the server

Answer

Block the ransomware's command-and-control IP at the firewall

Answer

Rebuild the server from a clean backup

Question 2

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module specifically designed to acquire volatile memory from Linux systems in a forensically sound manner. It captures RAM contents and outputs them in formats like raw or lime, which can then be analyzed with tools such as Volatility. This makes it the correct answer for Linux memory acquisition.

Answer

dd

Answer

FTK Imager

Answer

WinPmem

Question 3

An analyst is reviewing a suspicious executable using static analysis. Which of the following would provide information about the functions the executable imports from system libraries?

Accepted Answer

Import table analysis. The import table (also called the import address table, IAT) lists the functions an executable imports from system libraries (DLLs), such as kernel32.dll or user32.dll. Static analysis of the import table reveals which APIs the malware calls, providing insight into its capabilities (e.g., file I/O, network communication, registry manipulation). This directly answers the question about functions imported from system libraries.

Answer

PE header analysis

Answer

String extraction

Answer

YARA rule creation

Question 4

A SOC analyst receives an alert from a threat intelligence platform (TIP) about a new phishing campaign. The indicator is a URL. Which enrichment source is BEST for determining the URL's current hosting infrastructure?

Accepted Answer

Passive DNS. Passive DNS allows querying historical and current IP addresses associated with a domain, revealing hosting changes.

Answer

VirusTotal

Answer

WHOIS

Answer

Shodan

Question 5

During a post-incident review, the CSIRT identifies that the mean time to detect (MTTD) is significantly higher than the industry benchmark. Which initiative would MOST likely reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors. Improving detection capabilities through enhanced monitoring and alerting reduces detection time.

Answer

Conducting more frequent tabletop exercises

Answer

Rotating credentials for all service accounts

Answer

Implementing a new patch management process

Question 6

An organization has identified indicators of compromise (IOCs) from a recent incident. Which data format is specifically designed for sharing threat intelligence in a standardized, machine-readable way?

Accepted Answer

STIX. STIX (Structured Threat Information Expression) is a standardized language and serialization format specifically designed by MITRE and OASIS to represent and share cyber threat intelligence in a machine-readable way. It defines domain objects like Indicator, Malware, ThreatActor, and Relationship, and is typically transported via TAXII. JSON, CSV, and PDF are generic data formats not purpose-built for threat intel semantics.

Answer

PDF

Answer

CSV

Answer

JSON

Question 7

A security analyst is investigating a potential data breach. The analyst needs to preserve evidence before containment. Which of the following actions is MOST appropriate at this stage?

Accepted Answer

Creating a forensic image of the hard drive. Creating a forensic image of the hard drive is the most appropriate action to preserve evidence before containment. A forensic image is a bit-for-bit copy of the storage media that captures the system state, including deleted files, memory remnants, and metadata, without altering the original. This preserves the integrity of evidence for later analysis and legal proceedings. Powering off, blocking IPs, or disabling accounts are containment actions that can destroy volatile evidence and should be done after imaging.

Answer

Powering off the system

Answer

Blocking the attacker's IP at the firewall

Answer

Disabling the user's account

Question 8

An analyst runs a YARA rule against a set of files and gets a hit. The rule was written to detect a specific malware family. What is the PRIMARY purpose of using YARA rules in this context?

Accepted Answer

To identify files that match known malware characteristics. YARA is a pattern-matching tool used to identify and classify malware samples based on textual or binary patterns.

Answer

To sandbox the malware for dynamic analysis

Answer

To verify the hash of the malware sample

Answer

To extract strings from the malware

Question 9

After a DDoS attack, the CSIRT wants to share IOCs with other organizations. Which protocol is specifically designed for automated, real-time threat intelligence sharing?

Accepted Answer

TAXII. TAXII (Trusted Automated Exchange of Indicator Information) is the protocol for exchanging threat intelligence over HTTPS.

Answer

HTTP

Answer

SMTP

Answer

FTP

Question 10

Which of the following is an example of a behavioral indicator of compromise (IOC) observed during dynamic malware analysis?

Accepted Answer

Outbound network connection to a known malicious IP. Dynamic analysis monitors behavior such as network connections, file system changes, and process creation.

Answer

PE section names

Answer

File hash

Answer

Domain name

Question 11

A security analyst is investigating a phishing incident that resulted in credential theft. Which TWO actions should the analyst take as part of short-term containment? (Choose two.)

Accepted Answer

Block the phishing domain at the email gateway. Option A is correct because blocking the phishing domain at the email gateway is a short-term containment action that immediately prevents additional phishing emails from the same domain from reaching other users and stops further credential harvesting. Option E is correct because disabling the compromised user accounts is a short-term containment step that stops the attacker from using the stolen credentials to access resources, halting ongoing unauthorized activity. Option B is not appropriate here because rebuilding workstations from a clean image is a longer-term eradication and recovery action, and credential theft does not necessarily require reimaging. Option C is not a containment action; a full vulnerability scan is a broader assessment activity that does not stop the active incident. Option D is not the best short-term containment step because changing all domain user passwords is a broad, disruptive action, whereas disabling the specific compromised accounts is more targeted and immediate.

Answer

Rebuild the affected workstations from a clean image

Answer

Conduct a full vulnerability scan of the network

Answer

Change all user passwords in the domain

Question 12

During a forensic investigation, an analyst must acquire digital evidence while maintaining forensic soundness. Which THREE practices should the analyst follow? (Choose three.)

Accepted Answer

Verify the hash of the image against the original. Option C is correct because hashing the acquired image (e.g., with MD5 or SHA-256) and comparing it to the hash of the original source proves the copy is a bit-for-bit duplicate and has not been altered, which is essential to forensic soundness and admissibility. Option D is correct because a hardware or software write blocker prevents any write operations from reaching the suspect drive during imaging, preserving the integrity of the original evidence. Option E is correct because maintaining a detailed chain of custody and documenting every action (tools, timestamps, hashes, personnel) ensures the acquisition is reproducible, defensible, and legally admissible. Option A is not appropriate because using the suspect's operating system can modify file metadata (MAC times) and alter the evidence, violating forensic soundness. Option B is not appropriate as a general acquisition practice because powering on the system can change volatile and non-volatile data; volatile data should only be captured under a documented, justified order of volatility when necessary, not as a blanket first step.

Answer

Use the suspect's operating system to copy files

Answer

Power on the system to capture volatile data first

Question 13

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a workstation to an external IP address known for command and control (C2) activity. Which classification should the analyst assign to this incident?

Accepted Answer

Malware. The suspicious outbound traffic to a known C2 IP indicates that the workstation is likely infected with malware that is beaconing to its command and control server. This is a classic indicator of a malware infection, where the compromised host communicates with an external entity for instructions or data exfiltration. Therefore, the incident should be classified as malware.

Answer

Insider threat

Answer

Data breach

Answer

Phishing

Question 14

A security analyst receives an alert about a possible ransomware outbreak. Which short-term containment action should be performed FIRST to prevent further spread?

Accepted Answer

Isolate the system from the network. Network isolation (disconnecting the affected system from the network) is a quick short-term containment step that stops the ransomware from communicating with C2 or spreading laterally.

Answer

Disable the user account

Answer

Rebuild the system

Answer

Update antivirus signatures

Question 15

During forensic analysis of a compromised server, an analyst needs to preserve evidence in order of volatility. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Acquire a memory dump using WinPmem. The order of volatility dictates collecting the most perishable evidence first. RAM contents — running processes, network connections, encryption keys, and injected code — vanish on reboot or power loss, so acquiring a memory dump with a tool like WinPmem must be the first action. Only after memory is captured should the analyst move to less volatile sources.

Answer

Collect log files from the system

Answer

Create a forensic image of the hard drive

Answer

Run antivirus scan