CS0-003 Incident Response and Management Practice Test 4 — 15 Questions

Question 1

A security analyst is conducting static analysis of a suspicious executable. Which of the following tools or techniques is BEST suited for extracting strings and viewing the import table?

Accepted Answer

PEview or CFF Explorer. Static analysis often involves examining the PE header, imports, and strings. Tools like PEview, CFF Explorer, or simply using 'strings' command can extract readable strings. The import table shows DLLs and functions the executable uses.

Answer

LiME

Answer

FTK Imager

Answer

Cuckoo Sandbox

Question 2

After containing a security incident, the incident response team conducts a root cause analysis. Which of the following is the PRIMARY purpose of this activity?

Accepted Answer

To identify the initial attack vector. Root cause analysis aims to identify the underlying cause of the incident to prevent recurrence. It is a key part of post-incident activity.

Answer

To calculate the financial loss

Answer

To document the timeline

Answer

To assign blame to individuals

Question 3

An analyst receives a threat intelligence feed containing IOCs in STIX format. Which of the following BEST describes the purpose of STIX?

Accepted Answer

A standardized language for threat intelligence. STIX (Structured Threat Information Expression) is a standardized language and serialization format for representing cyber threat intelligence, including indicators, threat actors, campaigns, and relationships. It is designed to be machine-readable and interoperable, allowing organizations to share threat intelligence consistently. Therefore, the best description is that STIX is a standardized language for threat intelligence.

Answer

A protocol for real-time log collection

Answer

A framework for automating incident response

Answer

A tool for malware analysis

Question 4

During post-incident activities, the security team reviews metrics. Which metric measures the average time taken to detect an incident?

Accepted Answer

MTTD. MTTD (Mean Time to Detect) is the metric that measures the average time between when an incident actually occurs and when it is detected by the security team. It is a core SOC effectiveness metric used in post-incident reviews to evaluate detection capability.

Answer

MTTR

Answer

SLA

Answer

RTO

Question 5

A security analyst is performing dynamic analysis of a suspicious file in a sandbox. Which of the following observations is most indicative of ransomware behavior?

Accepted Answer

The file opens and overwrites documents with a new extension and drops a ransom note. Ransomware typically encrypts files and renames them with a new extension. Dropping a ransom note and leaving encrypted files is characteristic.

Answer

The file injects code into a legitimate process

Answer

The file creates a registry run key

Answer

The file attempts to connect to multiple external IPs

Question 6

Which of the following is the correct order of volatility for digital evidence?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility: CPU registers and cache (most volatile), then RAM, then swap/page file, then disk, then network logs, then archived media (least volatile).

Answer

Swap, RAM, CPU registers, disk, logs

Answer

Disk, RAM, swap, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Question 7

During a post-incident review, the team identifies that detection was delayed because alerts from multiple sources were not correlated. Which improvement would BEST address this issue?

Accepted Answer

Implement a SIEM solution. A SIEM solution aggregates logs and alerts from multiple sources, normalizes them, and correlates events across systems to surface related activity that individual tools would miss. This directly addresses the root cause — lack of correlation — by providing centralized detection and alerting. It is the standard architectural answer for improving cross-source detection.

Answer

Disable non-critical alerts

Answer

Increase the number of security staff

Answer

Increase logging verbosity

Question 8

During a forensic investigation, an analyst must preserve evidence in accordance with forensic sound procedures. Which THREE of the following practices should the analyst follow? (Select THREE.)

Accepted Answer

Document all actions taken in a chain of custody form. Option B is correct because maintaining a chain of custody form that documents every action, transfer, and access of the evidence is essential for forensic soundness and admissibility in court. Option C is correct because a write blocker prevents any modification to the original hard drive during imaging, preserving the integrity of the evidence. Option D is correct because creating a cryptographic hash (e.g., MD5 or SHA-256) of the original media before imaging provides a verifiable baseline to prove the image is an exact copy and that the original was not altered. Option A is not appropriate because running an antivirus scan modifies the drive (e.g., quarantining or deleting files), which violates forensic soundness. Option E is not appropriate because booting the system can alter the state of the drive (e.g., changing timestamps, creating temporary files), compromising evidence integrity.

Answer

Run a full antivirus scan on the target drive

Answer

Boot the system to ensure it is operational

Question 9

An incident response team is analyzing indicators of compromise (IOCs) from a phishing campaign. Which THREE of the following are commonly used IOC types? (Select THREE.)

Accepted Answer

IP addresses. IP addresses (B) are a standard network-based IOC, since malicious command-and-control servers, phishing hosts, and payload delivery endpoints are tracked by their IPv4/IPv6 addresses. Domain names (C) are equally common IOCs, as phishing URLs, C2 domains, and DNS-based exfiltration are identified by fully qualified domain names. File hashes (E), typically MD5, SHA-1, or SHA-256 values, are host-based IOCs used to uniquely identify known malicious files such as phishing attachments or malware binaries. CPU registers (A) are volatile runtime processor state, not a shareable indicator of compromise, and software version numbers (D) describe legitimate application builds rather than evidence of malicious activity.

Answer

CPU registers

Answer

Software version numbers

Question 10

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a finance workstation to a known malicious IP address at 2:00 AM. The analyst checks the firewall logs and sees a single connection. Which action should the analyst take FIRST according to NIST SP 800-61?

Accepted Answer

Validate the incident by reviewing additional data sources.. NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.

Answer

Run a full antivirus scan on the workstation.

Answer

Isolate the workstation from the network immediately.

Answer

Notify law enforcement per the incident response plan.

Question 11

An organization's incident response team is handling a ransomware incident where critical servers have been encrypted. The team has identified the ransomware variant and determined that decryption is not possible. Which of the following is the BEST post-incident activity to prevent recurrence?

Accepted Answer

Conduct a root cause analysis to determine the initial infection vector.. A root cause analysis identifies how the ransomware actually entered — phishing email, exposed RDP, unpatched VPN, supply chain — which is the only way to close the specific gap that allowed the incident. Without knowing the initial infection vector, any remediation is guesswork and the same attack can recur. Post-incident activities in NIST SP 800-61 and CompTIA's IR lifecycle explicitly call for lessons-learned/root-cause work to drive preventive controls.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with the industry ISAC.

Answer

Reimage all affected servers from backups.

Question 12

An analyst needs to capture the contents of volatile memory from a Windows system suspected of being compromised. Which tool should the analyst use to acquire a memory image?

Accepted Answer

WinPmem. WinPmem is a memory acquisition tool for Windows systems, capable of capturing RAM contents for analysis.

Answer

LiME

Answer

FTK Imager

Answer

dd

Question 13

During a phishing incident, an analyst extracts a URL from the email body and searches VirusTotal. The URL is associated with a credential harvesting page. Which type of indicator is this URL?

Accepted Answer

Indicator of Compromise (IOC). The URL is an observable that indicates malicious activity and can be used to detect and block further phishing attempts, making it an IOC.

Answer

Indicator of Attack (IOA)

Answer

Campaign

Answer

TTP

Question 14

An incident responder needs to collect forensic evidence from a server that was attacked. The evidence includes network connections, running processes, memory contents, and disk data. According to the order of volatility, which piece of evidence should the responder collect FIRST?

Accepted Answer

Network connections. The order of volatility dictates that the most volatile data (e.g., CPU registers, network connections) should be collected first. Network connections change rapidly.

Answer

Memory contents

Answer

Running processes

Answer

Disk data

Question 15

After containing a data breach, the incident response team discovers that an attacker exfiltrated sensitive data over DNS tunneling. Which of the following detection rules would BEST identify similar activity in the future?

Accepted Answer

A YARA rule that flags DNS queries with high entropy domain names. DNS tunneling often involves unusual domain names with high entropy or long subdomains. A YARA rule targeting DNS query patterns can detect such anomalies.

Answer

An SIEM alert for any DNS query exceeding 100 bytes

Answer

A Snort rule blocking traffic to known malicious IPs

Answer

A firewall rule that blocks all DNS requests from internal servers