CS0-003 Incident Response and Management Practice Test 4 — 15 Questions

Question 1

During the detection and analysis phase of incident response, a security analyst identifies suspicious outbound traffic from a finance workstation to a known malicious IP address at 2:00 AM. The analyst checks the firewall logs and sees a single connection. Which action should the analyst take FIRST according to NIST SP 800-61?

Accepted Answer

Validate the incident by reviewing additional data sources.. NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.

Answer

Run a full antivirus scan on the workstation.

Answer

Isolate the workstation from the network immediately.

Answer

Notify law enforcement per the incident response plan.

Question 2

An organization's incident response team is handling a ransomware incident where critical servers have been encrypted. The team has identified the ransomware variant and determined that decryption is not possible. Which of the following is the BEST post-incident activity to prevent recurrence?

Accepted Answer

Conduct a root cause analysis to determine the initial infection vector.. Root cause analysis identifies how the ransomware entered, allowing the organization to implement preventive controls like patching, access controls, or user training.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with the industry ISAC.

Answer

Reimage all affected servers from backups.

Question 3

An analyst needs to capture the contents of volatile memory from a Windows system suspected of being compromised. Which tool should the analyst use to acquire a memory image?

Accepted Answer

WinPmem. WinPmem is a memory acquisition tool for Windows systems, capable of capturing RAM contents for analysis.

Answer

LiME

Answer

FTK Imager

Answer

dd

Question 4

During a phishing incident, an analyst extracts a URL from the email body and searches VirusTotal. The URL is associated with a credential harvesting page. Which type of indicator is this URL?

Accepted Answer

Indicator of Compromise (IOC). The URL is an observable that indicates malicious activity and can be used to detect and block further phishing attempts, making it an IOC.

Answer

Indicator of Attack (IOA)

Answer

Campaign

Answer

TTP

Question 5

An incident responder needs to collect forensic evidence from a server that was attacked. The evidence includes network connections, running processes, memory contents, and disk data. According to the order of volatility, which piece of evidence should the responder collect FIRST?

Accepted Answer

Network connections. The order of volatility dictates that the most volatile data (e.g., CPU registers, network connections) should be collected first. Network connections change rapidly.

Answer

Memory contents

Answer

Running processes

Answer

Disk data

Question 6

After containing a data breach, the incident response team discovers that an attacker exfiltrated sensitive data over DNS tunneling. Which of the following detection rules would BEST identify similar activity in the future?

Accepted Answer

A YARA rule that flags DNS queries with high entropy domain names. DNS tunneling often involves unusual domain names with high entropy or long subdomains. A YARA rule targeting DNS query patterns can detect such anomalies.

Answer

An SIEM alert for any DNS query exceeding 100 bytes

Answer

A Snort rule blocking traffic to known malicious IPs

Answer

A firewall rule that blocks all DNS requests from internal servers

Question 7

An organization's security team receives a report of a potential insider threat. An employee is suspected of accessing sensitive files without authorization. Which incident category BEST describes this scenario?

Accepted Answer

Insider threat. An insider threat is a security risk originating from within the organization, often involving unauthorized access or data exfiltration by employees.

Answer

Malware

Answer

Data breach

Answer

Ransomware

Question 8

An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?

Accepted Answer

Disconnect the network cable from the server.. Disconnecting the network cable (Option B) is the correct short-term containment strategy because it immediately isolates the compromised database server from the network, preventing further lateral movement or data exfiltration, while preserving the volatile system state (memory, running processes, open network connections) for forensic analysis. This action stops active network-based attacks without altering the contents of RAM or disk, which is critical for evidence integrity.

Answer

Reboot the server into safe mode.

Answer

Power off the server to freeze the system state.

Answer

Run a memory dump with WinPmem before any action.

Question 9

A security analyst is performing static analysis on a suspicious PE file. Which initial step should the analyst take to understand the file's imports and potential capabilities?

Accepted Answer

Analyze the PE header and import table.. Analyzing the import table reveals which Windows API functions the file uses, providing insight into its functionality (e.g., network, file, or registry operations).

Answer

Create a YARA rule based on hash characteristics.

Answer

Run the file in a sandbox and observe behavior.

Answer

Extract strings from the file.

Question 10

An organization is implementing an incident response plan. Which phase of the NIST SP 800-61 lifecycle includes activities such as creating policies, establishing IR teams, and acquiring necessary tools?

Accepted Answer

Preparation. Preparation involves all proactive measures to enable effective incident response, including policy, team, and tool readiness.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 11

During a DDoS attack, the incident response team notices that the attack traffic originates from multiple IP addresses across different countries. The team decides to implement a long-term containment strategy. Which action is MOST appropriate for long-term containment?

Accepted Answer

Implement BGP blackholing with the ISP.. Long-term containment focuses on preventing recurrence. Implementing BGP blackholing at the ISP level can mitigate future DDoS attacks by dropping traffic to the targeted IPs upstream.

Answer

Block the source IPs on the firewall.

Answer

Increase server bandwidth to absorb the traffic.

Answer

Deploy additional load balancers.

Question 12

An analyst is examining a disk image acquired from a compromised Linux server. The analyst needs to verify that the image is an exact bit-for-bit copy of the original drive. Which forensic sound procedure should the analyst perform?

Accepted Answer

Compare the hash of the image to the hash of the original drive.. Hash verification ensures the image matches the original by comparing cryptographic hashes (e.g., MD5, SHA-256) generated during acquisition.

Answer

Use a write blocker when acquiring the image.

Answer

Mount the image in read-only mode.

Answer

Analyze the image with a hex editor.

Question 13

An incident response team is conducting post-incident activities after a ransomware attack. The team wants to improve detection and response for future incidents. Which TWO actions are most appropriate for updating detection rules? (Select TWO.)

Accepted Answer

Create YARA rules to identify the ransomware file hashes and patterns.. Updating SIEM correlation rules based on the attack TTPs and creating YARA rules for the ransomware family will enhance detection of similar threats.

Answer

Conduct a tabletop exercise for the incident response team.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with external threat intelligence platforms.

Question 14

A security analyst is investigating a potential data exfiltration incident. The analyst captures memory from a Windows system and finds a process that is injecting code into other processes. Which THREE indicators from the memory analysis would MOST strongly suggest malicious activity? (Select THREE.)

Accepted Answer

The process has memory regions with RWX permissions.. Suspicious memory regions (like RWX), unusual API calls (e.g., WriteProcessMemory), and hidden processes are strong indicators of malware or code injection.

Answer

The process name is a known Windows system process.

Answer

The process has a valid digital signature.

Question 15

An organization's incident response team is classifying an incident based on severity and priority. Which TWO factors should the team consider when determining the priority of an incident? (Select TWO.)

Accepted Answer

The potential business impact of the incident.. Priority is often based on the criticality of the affected assets and the potential business impact, as these determine how quickly the incident needs to be addressed.

Answer

The number of users reporting the issue.

Answer

The time of day the incident occurred.

Answer

The type of threat actor involved.