CS0-003 Incident Response and Management Practice Test 3 — 15 Questions

Question 1

During post-incident activities, the security team reviews metrics. Which metric measures the average time taken to detect an incident?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) measures detection efficiency. MTTR is for response/repair.

Answer

MTTR

Answer

SLA

Answer

RTO

Question 2

A security analyst is performing dynamic analysis of a suspicious file in a sandbox. Which of the following observations is most indicative of ransomware behavior?

Accepted Answer

The file opens and overwrites documents with a new extension and drops a ransom note. Ransomware typically encrypts files and renames them with a new extension. Dropping a ransom note and leaving encrypted files is characteristic.

Answer

The file injects code into a legitimate process

Answer

The file creates a registry run key

Answer

The file attempts to connect to multiple external IPs

Question 3

Which of the following is the correct order of volatility for digital evidence?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility: CPU registers and cache (most volatile), then RAM, then swap/page file, then disk, then network logs, then archived media (least volatile).

Answer

Swap, RAM, CPU registers, disk, logs

Answer

Disk, RAM, swap, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Question 4

An incident responder needs to collect memory from a Linux system during an incident. Which tool should the responder use?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory from Linux systems, loading as a kernel module to safely dump RAM contents. During incident response, memory acquisition must be performed with minimal system interference, and LiME supports both raw and compressed output formats suitable for analysis with tools like Volatility.

Answer

avml

Answer

WinPmem

Answer

FTK Imager

Question 5

During a post-incident review, the team identifies that detection was delayed because alerts from multiple sources were not correlated. Which improvement would BEST address this issue?

Accepted Answer

Implement a SIEM solution. Implementing a SIEM (Security Information and Event Management) system correlates alerts from various sources, reducing false positives and improving detection speed.

Answer

Disable non-critical alerts

Answer

Increase the number of security staff

Answer

Increase logging verbosity

Question 6

An analyst is investigating a suspected data breach and needs to preserve network logs. Which of the following actions is MOST appropriate?

Accepted Answer

Perform a packet capture (pcap) and store it on write-protected media. To preserve network logs, the analyst should create a forensic copy (e.g., using netflow or packet capture) and store it on write-once media to prevent tampering.

Answer

Delete old logs to free space for new logs

Answer

Forward logs to a remote syslog server

Answer

Copy the log files to a USB drive and analyze them

Question 7

An organization's incident response team is handling a ransomware incident where critical servers have been encrypted. The team has identified the ransomware variant and determined that decryption is not possible. Which of the following is the BEST post-incident activity to prevent recurrence?

Accepted Answer

Conduct a root cause analysis to determine the initial infection vector.. Root cause analysis identifies how the ransomware entered, allowing the organization to implement preventive controls like patching, access controls, or user training.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with the industry ISAC.

Answer

Reimage all affected servers from backups.

Question 8

An analyst needs to capture the contents of volatile memory from a Windows system suspected of being compromised. Which tool should the analyst use to acquire a memory image?

Accepted Answer

WinPmem. WinPmem is a memory acquisition tool for Windows systems, capable of capturing RAM contents for analysis.

Answer

LiME

Answer

FTK Imager

Answer

dd

Question 9

During a phishing incident, an analyst extracts a URL from the email body and searches VirusTotal. The URL is associated with a credential harvesting page. Which type of indicator is this URL?

Accepted Answer

Indicator of Compromise (IOC). The URL is an observable that indicates malicious activity and can be used to detect and block further phishing attempts, making it an IOC.

Answer

Indicator of Attack (IOA)

Answer

Campaign

Answer

TTP

Question 10

An incident responder needs to collect forensic evidence from a server that was attacked. The evidence includes network connections, running processes, memory contents, and disk data. According to the order of volatility, which piece of evidence should the responder collect FIRST?

Accepted Answer

Network connections. The order of volatility dictates that the most volatile data (e.g., CPU registers, network connections) should be collected first. Network connections change rapidly.

Answer

Memory contents

Answer

Running processes

Answer

Disk data

Question 11

After containing a data breach, the incident response team discovers that an attacker exfiltrated sensitive data over DNS tunneling. Which of the following detection rules would BEST identify similar activity in the future?

Accepted Answer

A YARA rule that flags DNS queries with high entropy domain names. DNS tunneling often involves unusual domain names with high entropy or long subdomains. A YARA rule targeting DNS query patterns can detect such anomalies.

Answer

An SIEM alert for any DNS query exceeding 100 bytes

Answer

A Snort rule blocking traffic to known malicious IPs

Answer

A firewall rule that blocks all DNS requests from internal servers

Question 12

An organization's security team receives a report of a potential insider threat. An employee is suspected of accessing sensitive files without authorization. Which incident category BEST describes this scenario?

Accepted Answer

Insider threat. An insider threat is a security risk originating from within the organization, often involving unauthorized access or data exfiltration by employees.

Answer

Malware

Answer

Data breach

Answer

Ransomware

Question 13

A security analyst is performing static analysis on a suspicious PE file. Which initial step should the analyst take to understand the file's imports and potential capabilities?

Accepted Answer

Analyze the PE header and import table.. Analyzing the import table reveals which Windows API functions the file uses, providing insight into its functionality (e.g., network, file, or registry operations).

Answer

Create a YARA rule based on hash characteristics.

Answer

Run the file in a sandbox and observe behavior.

Answer

Extract strings from the file.

Question 14

An organization is implementing an incident response plan. Which phase of the NIST SP 800-61 lifecycle includes activities such as creating policies, establishing IR teams, and acquiring necessary tools?

Accepted Answer

Preparation. Preparation involves all proactive measures to enable effective incident response, including policy, team, and tool readiness.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 15

During a DDoS attack, the incident response team notices that the attack traffic originates from multiple IP addresses across different countries. The team decides to implement a long-term containment strategy. Which action is MOST appropriate for long-term containment?

Accepted Answer

Implement BGP blackholing with the ISP.. Long-term containment focuses on preventing recurrence. Implementing BGP blackholing at the ISP level can mitigate future DDoS attacks by dropping traffic to the targeted IPs upstream.

Answer

Block the source IPs on the firewall.

Answer

Increase server bandwidth to absorb the traffic.

Answer

Deploy additional load balancers.