CS0-003 Incident Response and Management Practice Test 5 — 15 Questions

Question 1

An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disconnect the network cable from the server.. Disconnecting the network cable (Option B) is the correct short-term containment strategy because it immediately isolates the compromised database server from the network, preventing further lateral movement or data exfiltration, while preserving the volatile system state (memory, running processes, open network connections) for forensic analysis. This action stops active network-based attacks without altering the contents of RAM or disk, which is critical for evidence integrity.

Answer

Reboot the server into safe mode.

Answer

Power off the server to freeze the system state.

Answer

Run a memory dump with WinPmem before any action.

Question 2

A security analyst is performing static analysis on a suspicious PE file. Which initial step should the analyst take to understand the file's imports and potential capabilities?

Accepted Answer

Analyze the PE header and import table.. Analyzing the import table reveals which Windows API functions the file uses, providing insight into its functionality (e.g., network, file, or registry operations).

Answer

Create a YARA rule based on hash characteristics.

Answer

Run the file in a sandbox and observe behavior.

Answer

Extract strings from the file.

Question 3

An organization is implementing an incident response plan. Which phase of the NIST SP 800-61 lifecycle includes activities such as creating policies, establishing IR teams, and acquiring necessary tools?

Accepted Answer

Preparation. Preparation involves all proactive measures to enable effective incident response, including policy, team, and tool readiness.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Post-Incident Activity

Question 4

An analyst is examining a disk image acquired from a compromised Linux server. The analyst needs to verify that the image is an exact bit-for-bit copy of the original drive. Which forensic sound procedure should the analyst perform?

Accepted Answer

Compare the hash of the image to the hash of the original drive.. Hash verification ensures the image matches the original by comparing cryptographic hashes (e.g., MD5, SHA-256) generated during acquisition.

Answer

Use a write blocker when acquiring the image.

Answer

Mount the image in read-only mode.

Answer

Analyze the image with a hex editor.

Question 5

An incident response team is conducting post-incident activities after a ransomware attack. The team wants to improve detection and response for future incidents. Which TWO actions are most appropriate for updating detection rules? (Select TWO.)

Accepted Answer

Create YARA rules to identify the ransomware file hashes and patterns.. Option C is correct because YARA rules are specifically designed to identify malware based on file hashes, byte patterns, and strings, so creating them from the ransomware samples observed during the incident directly improves future detection of that malware. Option E is correct because updating SIEM correlation rules to detect the observed TTPs (tactics, techniques, and procedures) enables the organization to alert on the attacker's behavior, not just static indicators, which strengthens detection and response for future incidents. Option A is not appropriate here because a tabletop exercise tests response processes and decision-making rather than updating detection rules. Option B does not belong because increasing vulnerability scan frequency addresses vulnerability management, not detection rule improvement. Option D is also not the best fit because sharing IOCs with external platforms contributes to threat intelligence sharing and community defense, but it does not itself update the organization's detection rules.

Answer

Conduct a tabletop exercise for the incident response team.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with external threat intelligence platforms.

Question 6

A security analyst is investigating a potential data exfiltration incident. The analyst captures memory from a Windows system and finds a process that is injecting code into other processes. Which THREE indicators from the memory analysis would MOST strongly suggest malicious activity? (Select THREE.)

Accepted Answer

The process has memory regions with RWX permissions.. Option A is correct because memory regions marked RWX (read-write-execute) are a strong indicator of code injection, since legitimate code typically resides in RX (read-execute) or read-only pages, and RWX allows an attacker to write and then execute shellcode in the same region. Option B is correct because a process hidden from Task Manager indicates an attempt to evade user and analyst detection, which is characteristic of rootkits or injected/hooked processes used in exfiltration tooling. Option C is correct because WriteProcessMemory followed by CreateRemoteThread is the canonical Windows API sequence for process injection, letting an attacker place code in a remote process and start a thread to run it, which strongly suggests malicious activity. Option D is not correct on its own because malware frequently masquerades as a known Windows system process (e.g., svchost.exe), so a familiar name alone is not a reliable malicious indicator. Option E is not correct because a valid digital signature generally indicates trusted, unmodified software and argues against malicious tampering, not for it.

Answer

The process name is a known Windows system process.

Answer

The process has a valid digital signature.

Question 7

An organization's incident response team is classifying an incident based on severity and priority. Which TWO factors should the team consider when determining the priority of an incident? (Select TWO.)

Accepted Answer

The potential business impact of the incident.. Option B is correct because incident priority is driven primarily by the potential business impact — how severely the incident could disrupt operations, revenue, reputation, or regulatory obligations — which determines how urgently the response must be escalated. Option C is correct because the criticality of the affected systems or data (for example, a domain controller, PII database, or payment processing system) directly shapes priority, since a compromise of high-value assets warrants faster and more aggressive response than one on a low-value endpoint. Together, business impact and asset criticality are the standard inputs for priority scoring in frameworks such as NIST SP 800-61, which separates severity (technical impact) from priority (business-driven urgency). Option A is not a priority factor per se; the number of users reporting an issue may indicate scope but does not by itself establish business urgency. Option D is not a defining factor, since time of day may affect staffing but not the inherent priority of the incident. Option E is also not a priority determinant; the type of threat actor is relevant to threat intelligence and attribution, not to how urgently the business must respond.

Answer

The number of users reporting the issue.

Answer

The time of day the incident occurred.

Answer

The type of threat actor involved.

Question 8

During the preparation phase of the NIST SP 800-61 incident response lifecycle, a security analyst is tasked with ensuring the team has the necessary tools and resources. Which of the following is the MOST important activity to perform during this phase?

Accepted Answer

Developing and testing incident response playbooks. In the NIST SP 800-61 preparation phase, the most important activity is establishing the capability to respond before an incident occurs, which centers on developing, documenting, and testing incident response playbooks. Playbooks codify roles, communication paths, and step-by-step procedures so the team can act consistently under pressure. Testing them (tabletop exercises, simulations) validates that tools, contacts, and escalation paths actually work.

Answer

Sharing indicators of compromise with threat intel platforms

Answer

Conducting root cause analysis of past incidents

Answer

Analyzing malware samples in a sandbox

Question 9

A security operations center (SOC) analyst receives an alert about a potential ransomware infection on a critical server. The incident response team needs to contain the threat quickly. Which of the following should be performed FIRST as a short-term containment measure?

Accepted Answer

Isolate the affected network segment. Short-term containment focuses on immediate isolation to prevent further damage. Isolating the affected network segment stops the ransomware from spreading to other systems.

Answer

Disable the user account associated with the alert

Answer

Run a full antivirus scan on the server

Answer

Rebuild the server from a clean backup

Question 10

An organization has experienced a data breach involving personally identifiable information (PII). The incident response team has contained the breach and eradicated the threat. During the post-incident activity phase, which activity is MOST critical to prevent future similar incidents?

Accepted Answer

Conducting a root cause analysis. Conducting a root cause analysis helps identify the underlying vulnerability or weakness that led to the breach, enabling the organization to implement corrective measures and prevent recurrence.

Answer

Resetting all user passwords

Answer

Updating the firewall rules to block the attacker's IP

Answer

Restoring data from backups

Question 11

A security analyst is reviewing indicators of compromise (IOCs) from a recent phishing campaign. Which of the following is an example of an email-related IOC?

Accepted Answer

Suspicious sender email address. A suspicious sender email address is an email-header-level artifact — it appears in the From, Reply-To, or Return-Path fields and is directly tied to the phishing email itself. That makes it an email-related IOC, unlike network or file artifacts.

Answer

Domain name in the URL

Answer

IP address of the sender's mail server

Answer

File hash of an attachment

Question 12

An organization uses MISP (Malware Information Sharing Platform) to share threat intelligence with trusted partners. Which of the following standards is commonly used by MISP to structure and exchange threat intelligence data?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Answer

NetFlow

Answer

SNMP

Answer

Syslog

Question 13

An incident responder is classifying an incident. The incident involves ransomware encrypting files on multiple workstations, causing significant business disruption. Which severity level should be assigned to this incident?

Accepted Answer

High. Ransomware affecting multiple workstations causes high impact and likely critical business disruption, so it should be classified as high or critical severity. The highest typical level is 'Critical' (or similar).

Answer

Medium

Answer

Informational

Answer

Low

Question 14

During a forensic analysis, an analyst needs to collect data in order of volatility. Which of the following represents the correct order from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility dictates that volatile data in memory (CPU registers, RAM) is collected first, then less volatile data like swap, disk, and logs. The correct sequence is CPU registers, RAM, swap, disk, then logs.

Answer

Disk, swap, RAM, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Answer

Logs, disk, swap, RAM, CPU registers

Question 15

An analyst is performing static analysis on a suspicious executable. The analyst discovers that the PE file has a suspicious section name and a high entropy value. Which tool or technique would be MOST useful for further analyzing the packed nature of the file?

Accepted Answer

Using PEiD or similar packer identifier. PEiD or similar tools can detect packers by scanning for known signatures. High entropy and suspicious section names often indicate packing, so using a packer identifier is appropriate.

Answer

Extracting strings from the binary

Answer

Using a YARA rule to detect the packer

Answer

Running the file in a sandbox