CS0-003 Incident Response and Management Practice Test 5 — 15 Questions

Question 1

During the preparation phase of the NIST SP 800-61 incident response lifecycle, a security analyst is tasked with ensuring the team has the necessary tools and resources. Which of the following is the MOST important activity to perform during this phase?

Accepted Answer

Developing and testing incident response playbooks. The preparation phase focuses on establishing policies, procedures, and resources. Developing and testing incident response playbooks ensures the team is ready to handle incidents efficiently.

Answer

Sharing indicators of compromise with threat intel platforms

Answer

Conducting root cause analysis of past incidents

Answer

Analyzing malware samples in a sandbox

Question 2

A security operations center (SOC) analyst receives an alert about a potential ransomware infection on a critical server. The incident response team needs to contain the threat quickly. Which of the following should be performed FIRST as a short-term containment measure?

Accepted Answer

Isolate the affected network segment. Short-term containment focuses on immediate isolation to prevent further damage. Isolating the affected network segment stops the ransomware from spreading to other systems.

Answer

Disable the user account associated with the alert

Answer

Run a full antivirus scan on the server

Answer

Rebuild the server from a clean backup

Question 3

During a forensic investigation, an analyst needs to acquire volatile memory from a compromised Linux server running a critical application. The server cannot be powered off. Which tool should the analyst use to capture memory with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that captures memory with minimal footprint, suitable for live acquisition on Linux systems.

Answer

avml

Answer

WinPmem

Answer

dd

Question 4

An organization has experienced a data breach involving personally identifiable information (PII). The incident response team has contained the breach and eradicated the threat. During the post-incident activity phase, which activity is MOST critical to prevent future similar incidents?

Accepted Answer

Conducting a root cause analysis. Conducting a root cause analysis helps identify the underlying vulnerability or weakness that led to the breach, enabling the organization to implement corrective measures and prevent recurrence.

Answer

Resetting all user passwords

Answer

Updating the firewall rules to block the attacker's IP

Answer

Restoring data from backups

Question 5

A security analyst is reviewing indicators of compromise (IOCs) from a recent phishing campaign. Which of the following is an example of an email-related IOC?

Accepted Answer

Suspicious sender email address. Email indicators of compromise include sender email addresses, subject lines, and attachment hashes. A suspicious sender address is a common IOC used to detect phishing.

Answer

Domain name in the URL

Answer

IP address of the sender's mail server

Answer

File hash of an attachment

Question 6

During a dynamic malware analysis session, a security analyst uses a sandbox to detonate a suspicious file. Which of the following observations would be considered a behavioral indicator of compromise (IOC)?

Accepted Answer

The file makes outbound connections to an unknown IP address. Behavioral IOCs include actions performed by the malware, such as network connections, file creation, or registry changes. Outbound connections to an unknown IP indicate command-and-control activity.

Answer

The file has a suspicious import table

Answer

The file's PE header indicates it is packed

Answer

The file creates a scheduled task

Question 7

A security analyst is investigating a suspected insider threat incident. The analyst needs to preserve evidence before containment. Which of the following actions should the analyst prioritize to maintain the integrity of digital evidence?

Accepted Answer

Using a write blocker to create a forensic image of the hard drive. Preserving evidence before containment is crucial. Using a write blocker when imaging a hard drive ensures that the original data is not altered, maintaining the integrity of the evidence.

Answer

Imaging the suspect's hard drive using dd without a write blocker

Answer

Rebooting the suspect's computer to ensure no hidden processes are running

Answer

Deleting suspicious files to prevent further damage

Question 8

An organization uses MISP (Malware Information Sharing Platform) to share threat intelligence with trusted partners. Which of the following standards is commonly used by MISP to structure and exchange threat intelligence data?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Answer

NetFlow

Answer

SNMP

Answer

Syslog

Question 9

An incident responder is classifying an incident. The incident involves ransomware encrypting files on multiple workstations, causing significant business disruption. Which severity level should be assigned to this incident?

Accepted Answer

High. Ransomware affecting multiple workstations causes high impact and likely critical business disruption, so it should be classified as high or critical severity. The highest typical level is 'Critical' (or similar).

Answer

Medium

Answer

Informational

Answer

Low

Question 10

During a forensic analysis, an analyst needs to collect data in order of volatility. Which of the following represents the correct order from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs. The order of volatility dictates that volatile data in memory (CPU registers, RAM) is collected first, then less volatile data like swap, disk, and logs. The correct sequence is CPU registers, RAM, swap, disk, then logs.

Answer

Disk, swap, RAM, CPU registers, logs

Answer

RAM, CPU registers, swap, disk, logs

Answer

Logs, disk, swap, RAM, CPU registers

Question 11

An analyst is performing static analysis on a suspicious executable. The analyst discovers that the PE file has a suspicious section name and a high entropy value. Which tool or technique would be MOST useful for further analyzing the packed nature of the file?

Accepted Answer

Using PEiD or similar packer identifier. PEiD or similar tools can detect packers by scanning for known signatures. High entropy and suspicious section names often indicate packing, so using a packer identifier is appropriate.

Answer

Extracting strings from the binary

Answer

Using a YARA rule to detect the packer

Answer

Running the file in a sandbox

Question 12

After a DDoS attack, the incident response team wants to improve detection and prevention. Which of the following metrics would be MOST useful for evaluating the effectiveness of the response?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to respond to incidents, which is a key metric for evaluating response effectiveness.

Answer

Number of false positives

Answer

Mean Time to Detect (MTTD)

Answer

Incidents per week

Question 13

A security analyst is investigating a potential malware infection on a Windows workstation. The analyst needs to collect evidence while preserving the order of volatility. Which TWO pieces of data should the analyst collect FIRST? (Select TWO)

Accepted Answer

Contents of RAM. According to the order of volatility, the most volatile data should be collected first. CPU registers and cache are at the top of the order, followed by routing table, ARP cache, process table, kernel statistics, and then memory. However, among the options, running processes (memory) and network connections are among the most volatile. Typically, memory (RAM) is collected before disk data.

Answer

System event logs

Answer

Contents of the hard drive

Answer

Registry hives

Question 14

An incident responder is performing containment of a ransomware incident that has encrypted files on several file servers. Which THREE actions are appropriate for long-term containment and recovery? (Select THREE)

Accepted Answer

Patching the vulnerability exploited by the ransomware. Long-term containment aims to prevent recurrence and restore normal operations. Rebuilding systems from clean backups ensures removal of malware. Rotating credentials prevents attacker re-entry. Patching vulnerabilities closes the initial attack vector.

Answer

Blocking the ransomware's command-and-control IP at the firewall

Answer

Isolating the affected network segment

Question 15

During a forensic investigation, an analyst needs to acquire disk images from multiple suspect drives. Which THREE practices ensure forensic soundness? (Select THREE)

Accepted Answer

Documenting the chain of custody for each drive. Forensic soundness requires maintaining evidence integrity. Using a verified write blocker prevents alteration. Hashing the original and copy ensures integrity. Documenting the chain of custody maintains accountability.

Answer

Using the fastest available imaging method without verification

Answer

Acquiring the image while the system is running (live acquisition)