CS0-003 Incident Response and Management Practice Test 4 — 15 Questions

Question 1

An analyst is examining a disk image acquired from a compromised Linux server. The analyst needs to verify that the image is an exact bit-for-bit copy of the original drive. Which forensic sound procedure should the analyst perform?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compare the hash of the image to the hash of the original drive.. Hash verification ensures the image matches the original by comparing cryptographic hashes (e.g., MD5, SHA-256) generated during acquisition.

Answer

Use a write blocker when acquiring the image.

Answer

Mount the image in read-only mode.

Answer

Analyze the image with a hex editor.

Question 2

During the preparation phase of the NIST SP 800-61 incident response lifecycle, a security analyst is tasked with ensuring the team has the necessary tools and resources. Which of the following is the MOST important activity to perform during this phase?

Accepted Answer

Developing and testing incident response playbooks. The preparation phase focuses on establishing policies, procedures, and resources. Developing and testing incident response playbooks ensures the team is ready to handle incidents efficiently.

Answer

Sharing indicators of compromise with threat intel platforms

Answer

Conducting root cause analysis of past incidents

Answer

Analyzing malware samples in a sandbox

Question 3

A security operations center (SOC) analyst receives an alert about a potential ransomware infection on a critical server. The incident response team needs to contain the threat quickly. Which of the following should be performed FIRST as a short-term containment measure?

Accepted Answer

Isolate the affected network segment. Short-term containment focuses on immediate isolation to prevent further damage. Isolating the affected network segment stops the ransomware from spreading to other systems.

Answer

Disable the user account associated with the alert

Answer

Run a full antivirus scan on the server

Answer

Rebuild the server from a clean backup

Question 4

An organization has experienced a data breach involving personally identifiable information (PII). The incident response team has contained the breach and eradicated the threat. During the post-incident activity phase, which activity is MOST critical to prevent future similar incidents?

Accepted Answer

Conducting a root cause analysis. Conducting a root cause analysis helps identify the underlying vulnerability or weakness that led to the breach, enabling the organization to implement corrective measures and prevent recurrence.

Answer

Resetting all user passwords

Answer

Updating the firewall rules to block the attacker's IP

Answer

Restoring data from backups

Question 5

A security analyst is reviewing indicators of compromise (IOCs) from a recent phishing campaign. Which of the following is an example of an email-related IOC?

Accepted Answer

Suspicious sender email address. Email indicators of compromise include sender email addresses, subject lines, and attachment hashes. A suspicious sender address is a common IOC used to detect phishing.

Answer

Domain name in the URL

Answer

IP address of the sender's mail server

Answer

File hash of an attachment

Question 6

During a dynamic malware analysis session, a security analyst uses a sandbox to detonate a suspicious file. Which of the following observations would be considered a behavioral indicator of compromise (IOC)?

Accepted Answer

The file makes outbound connections to an unknown IP address. During dynamic analysis, behavioral IOCs include actions performed by malware, such as network connections, file creation, or registry changes. Outbound connections to an unknown IP address are a classic behavioral indicator of command-and-control activity, making option D correct. While option C (creating a scheduled task) is also a behavioral action, it is not considered a definitive behavioral IOC in this context because scheduled tasks can be created by legitimate software and are often used for persistence rather than immediate malicious activity. The question expects the most direct behavioral indicator, which is the network connection. Options A and B are static indicators, not behavioral.

Answer

The file has a suspicious import table

Answer

The file's PE header indicates it is packed

Answer

The file creates a scheduled task

Question 7

A security analyst is investigating a suspected insider threat incident. The analyst needs to preserve evidence before containment. Which of the following actions should the analyst prioritize to maintain the integrity of digital evidence?

Accepted Answer

Using a write blocker to create a forensic image of the hard drive. Preserving evidence before containment is crucial. Using a write blocker when imaging a hard drive ensures that the original data is not altered, maintaining the integrity of the evidence.

Answer

Imaging the suspect's hard drive using dd without a write blocker

Answer

Rebooting the suspect's computer to ensure no hidden processes are running

Answer

Deleting suspicious files to prevent further damage

Question 8

An incident responder is classifying an incident. The incident involves ransomware encrypting files on multiple workstations, causing significant business disruption. Which severity level should be assigned to this incident?

Accepted Answer

High. Ransomware affecting multiple workstations causes high impact and likely critical business disruption, so it should be classified as high or critical severity. The highest typical level is 'Critical' (or similar).

Answer

Medium

Answer

Informational

Answer

Low

Question 9

During a forensic analysis, an analyst needs to collect data in order of volatility. Which of the following represents the correct order from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility dictates that volatile data in memory (CPU registers, RAM) is collected first, then less volatile data like swap, disk, and logs. The correct sequence is CPU registers, RAM, swap, disk, then logs.

Answer

Disk, swap, RAM, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Answer

Logs, disk, swap, RAM, CPU registers

Question 10

An analyst is performing static analysis on a suspicious executable. The analyst discovers that the PE file has a suspicious section name and a high entropy value. Which tool or technique would be MOST useful for further analyzing the packed nature of the file?

Accepted Answer

Using PEiD or similar packer identifier. PEiD or similar tools can detect packers by scanning for known signatures. High entropy and suspicious section names often indicate packing, so using a packer identifier is appropriate.

Answer

Extracting strings from the binary

Answer

Using a YARA rule to detect the packer

Answer

Running the file in a sandbox

Question 11

After a DDoS attack, the incident response team wants to improve detection and prevention. Which of the following metrics would be MOST useful for evaluating the effectiveness of the response?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to respond to incidents, which is a key metric for evaluating response effectiveness.

Answer

Number of false positives

Answer

Mean Time to Detect (MTTD)

Answer

Incidents per week

Question 12

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies an alert indicating a high volume of outbound traffic from a critical server to an unknown IP address. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Correlate the alert with firewall logs and other security tools.. According to NIST SP 800-61, during detection and analysis, the first step is to determine if an incident has occurred. Correlating the alert with other sources helps validate the incident and reduce false positives.

Answer

Notify law enforcement immediately.

Answer

Isolate the server from the network to prevent data exfiltration.

Answer

Rebuild the server from a known good backup.

Question 13

A security analyst is classifying an incident where an employee's workstation is infected with ransomware that encrypts files and displays a ransom note. Which incident category and severity level best describe this scenario?

Accepted Answer

Malware, moderate. Ransomware is a specific subtype of malware that encrypts files and demands payment, making 'Malware' the appropriate incident category. The severity is 'moderate' because while the infection impacts a single workstation and causes data loss, it does not immediately compromise the entire network or expose sensitive data at scale, aligning with typical moderate-severity criteria for isolated malware incidents.

Answer

DDoS, low

Answer

Data breach, high

Answer

Insider threat, high

Question 14

During forensic analysis of a compromised Linux server, an analyst needs to acquire memory evidence. The server is running and the analyst has root access. Which of the following tools should the analyst use to capture the contents of RAM with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that dumps memory and is designed to minimize footprint. It is commonly used for Linux memory acquisition.

Answer

WinPmem

Answer

FTK Imager

Answer

dd if=/dev/mem of=mem.dump

Question 15

A security team is responding to a phishing incident that led to credential compromise. Which of the following is the BEST short-term containment action to prevent further damage?

Accepted Answer

Disable the compromised user account.. Short-term containment aims to stop the attack quickly. Disabling the compromised account prevents the attacker from using the stolen credentials to access resources.

Answer

Rebuild the user's workstation.

Answer

Block the phishing email's source IP at the firewall.

Answer

Rotate all domain admin passwords.