CS0-003 Incident Response and Management Practice Test 3 — 15 Questions

Question 1

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a workstation to an external IP address known for command and control (C2) activity. Which classification should the analyst assign to this incident?

Accepted Answer

Malware. The incident involves communication with a known C2 server, which is characteristic of a malware infection (specifically, a botnet or trojan). This falls under the malware category.

Answer

Insider threat

Answer

Data breach

Answer

Phishing

Question 2

A security analyst receives an alert about a possible ransomware outbreak. Which short-term containment action should be performed FIRST to prevent further spread?

Accepted Answer

Isolate the system from the network. Network isolation (disconnecting the affected system from the network) is a quick short-term containment step that stops the ransomware from communicating with C2 or spreading laterally.

Answer

Disable the user account

Answer

Rebuild the system

Answer

Update antivirus signatures

Question 3

During forensic analysis of a compromised server, an analyst needs to preserve evidence in order of volatility. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Acquire a memory dump using WinPmem. According to the order of volatility, CPU registers and cache are the most volatile. However, in practice, capturing memory (RAM) is the first feasible step after powering on the system, as registers are lost on shutdown. The correct order: capture memory first, then try to capture swap, then disk, etc.

Answer

Collect log files from the system

Answer

Create a forensic image of the hard drive

Answer

Run antivirus scan

Question 4

A security analyst is conducting static analysis of a suspicious executable. Which of the following tools or techniques is BEST suited for extracting strings and viewing the import table?

Accepted Answer

PEview or CFF Explorer. Static analysis often involves examining the PE header, imports, and strings. Tools like PEview, CFF Explorer, or simply using 'strings' command can extract readable strings. The import table shows DLLs and functions the executable uses.

Answer

LiME

Answer

FTK Imager

Answer

Cuckoo Sandbox

Question 5

After containing a security incident, the incident response team conducts a root cause analysis. Which of the following is the PRIMARY purpose of this activity?

Accepted Answer

To identify the initial attack vector. Root cause analysis aims to identify the underlying cause of the incident to prevent recurrence. It is a key part of post-incident activity.

Answer

To calculate the financial loss

Answer

To document the timeline

Answer

To assign blame to individuals

Question 6

An analyst receives a threat intelligence feed containing IOCs in STIX format. Which of the following BEST describes the purpose of STIX?

Accepted Answer

A standardized language for threat intelligence. STIX (Structured Threat Information Expression) is a standardized language for representing and sharing threat intelligence.

Answer

A protocol for real-time log collection

Answer

A framework for automating incident response

Answer

A tool for malware analysis

Question 7

During post-incident activities, the security team reviews metrics. Which metric measures the average time taken to detect an incident?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) measures detection efficiency. MTTR is for response/repair.

Answer

MTTR

Answer

SLA

Answer

RTO

Question 8

A security analyst is performing dynamic analysis of a suspicious file in a sandbox. Which of the following observations is most indicative of ransomware behavior?

Accepted Answer

The file opens and overwrites documents with a new extension and drops a ransom note. Ransomware typically encrypts files and renames them with a new extension. Dropping a ransom note and leaving encrypted files is characteristic.

Answer

The file injects code into a legitimate process

Answer

The file creates a registry run key

Answer

The file attempts to connect to multiple external IPs

Question 9

Which of the following is the correct order of volatility for digital evidence?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility: CPU registers and cache (most volatile), then RAM, then swap/page file, then disk, then network logs, then archived media (least volatile).

Answer

Swap, RAM, CPU registers, disk, logs

Answer

Disk, RAM, swap, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Question 10

An incident responder needs to collect memory from a Linux system during an incident. Which tool should the responder use?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is the correct tool because it is specifically designed to capture volatile memory from Linux systems, loading as a kernel module to safely dump RAM contents. During incident response, memory acquisition must be performed with minimal system interference, and LiME supports both raw and compressed output formats suitable for analysis with tools like Volatility.

Answer

avml

Answer

WinPmem

Answer

FTK Imager

Question 11

During a post-incident review, the team identifies that detection was delayed because alerts from multiple sources were not correlated. Which improvement would BEST address this issue?

Accepted Answer

Implement a SIEM solution. Implementing a SIEM (Security Information and Event Management) system correlates alerts from various sources, reducing false positives and improving detection speed.

Answer

Disable non-critical alerts

Answer

Increase the number of security staff

Answer

Increase logging verbosity

Question 12

An analyst is investigating a suspected data breach and needs to preserve network logs. Which of the following actions is MOST appropriate?

Accepted Answer

Perform a packet capture (pcap) and store it on write-protected media. To preserve network logs, the analyst should create a forensic copy (e.g., using netflow or packet capture) and store it on write-once media to prevent tampering.

Answer

Delete old logs to free space for new logs

Answer

Forward logs to a remote syslog server

Answer

Copy the log files to a USB drive and analyze them

Question 13

A security analyst is performing incident response for a suspected malware outbreak. Which TWO actions are examples of long-term containment? (Select TWO.)

Accepted Answer

Apply security patches to all systems. Long-term containment includes actions that permanently remediate the threat, such as patching vulnerabilities and rebuilding systems. Isolating the network is short-term.

Answer

Isolate the affected network segment

Answer

Disable compromised user accounts

Answer

Block malicious IPs at the firewall

Question 14

During a forensic investigation, an analyst must preserve evidence in accordance with forensic sound procedures. Which THREE of the following practices should the analyst follow? (Select THREE.)

Accepted Answer

Document all actions taken in a chain of custody form. Forensic sound procedures include using write blockers to prevent alteration, verifying integrity with hashes, and documenting the chain of custody. Running a live scan would alter data.

Answer

Run a full antivirus scan on the target drive

Answer

Boot the system to ensure it is operational

Question 15

An incident response team is analyzing indicators of compromise (IOCs) from a phishing campaign. Which THREE of the following are commonly used IOC types? (Select THREE.)

Accepted Answer

IP addresses. Common IOC types include IP addresses, file hashes, domains, URLs, and email indicators. Software versions are not typically IOCs.

Answer

CPU registers

Answer

Software version numbers