CS0-003 Incident Response and Management Practice Test 6 — 15 Questions

Question 1

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies an alert indicating a high volume of outbound traffic from a critical server to an unknown IP address. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Correlate the alert with firewall logs and other security tools.. According to NIST SP 800-61, during detection and analysis, the first step is to determine if an incident has occurred. Correlating the alert with other sources helps validate the incident and reduce false positives.

Answer

Notify law enforcement immediately.

Answer

Isolate the server from the network to prevent data exfiltration.

Answer

Rebuild the server from a known good backup.

Question 2

A security analyst is classifying an incident where an employee's workstation is infected with ransomware that encrypts files and displays a ransom note. Which incident category and severity level best describe this scenario?

Accepted Answer

Malware, moderate. Option B is correct because ransomware is a specific subtype of malware that encrypts files and demands payment, making 'Malware' the appropriate incident category. The severity is 'moderate' because while the infection impacts a single workstation and causes data loss, it does not immediately compromise the entire network or expose sensitive data at scale, aligning with typical moderate-severity criteria for isolated malware incidents.

Answer

DDoS, low

Answer

Data breach, high

Answer

Insider threat, high

Question 3

During forensic analysis of a compromised Linux server, an analyst needs to acquire memory evidence. The server is running and the analyst has root access. Which of the following tools should the analyst use to capture the contents of RAM with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that dumps memory and is designed to minimize footprint. It is commonly used for Linux memory acquisition.

Answer

WinPmem

Answer

FTK Imager

Answer

dd if=/dev/mem of=mem.dump

Question 4

A security team is responding to a phishing incident that led to credential compromise. Which of the following is the BEST short-term containment action to prevent further damage?

Accepted Answer

Disable the compromised user account.. Short-term containment aims to stop the attack quickly. Disabling the compromised account prevents the attacker from using the stolen credentials to access resources.

Answer

Rebuild the user's workstation.

Answer

Block the phishing email's source IP at the firewall.

Answer

Rotate all domain admin passwords.

Question 5

An analyst is performing static analysis on a suspicious executable file. Which of the following would be MOST useful to identify potential malicious behavior without executing the file?

Accepted Answer

Analyzing the import table.. Static analysis involves examining the file without executing it. The import table shows which Windows API functions the executable uses, which can indicate capabilities such as network communication, file operations, or registry modifications.

Answer

Running the file in a sandbox.

Answer

Monitoring network connections during execution.

Answer

Checking the file's digital signature.

Question 6

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for incidents is significantly higher than industry benchmarks. Which of the following improvements would most directly reduce MTTD?

Accepted Answer

Implementing automated alerting based on threat intelligence.. MTTD is the average time to detect an incident. Implementing automated alerting and correlation rules from threat intelligence can speed up detection by reducing manual analysis time.

Answer

Increasing the number of forensic analysts on call.

Answer

Conducting more frequent tabletop exercises.

Answer

Rotating credentials after each incident.

Question 7

Which of the following is the FIRST step in the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation. The NIST SP 800-61 lifecycle begins with Preparation, which includes establishing policies, tools, and training before an incident occurs.

Answer

Detection and Analysis

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 8

An analyst is using YARA to create rules for detecting a specific malware strain. Which of the following pieces of information is MOST useful for writing a YARA rule?

Accepted Answer

A unique string within the malware.. YARA rules are based on patterns in the file, such as strings and byte sequences. A unique string found in the malware sample can be used to create a rule that identifies the malware.

Answer

The malware's file size.

Answer

The date the malware was first seen.

Answer

The malware's MD5 hash.

Question 9

When performing digital forensics, which of the following represents the correct order of volatility from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs, archived media. The order of volatility dictates that evidence should be collected from most volatile to least volatile to avoid losing transient data. CPU registers are the most volatile, followed by RAM, swap, disk, logs, and archived media.

Answer

RAM, CPU registers, disk, swap, logs, archived media

Answer

Swap, RAM, CPU registers, disk, logs, archived media

Answer

Archived media, logs, disk, swap, RAM, CPU registers

Question 10

A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is a standardized language for describing threat intelligence, and TAXII (Trusted Automated eXchange of Indicator Information) is a transport mechanism. Together, they enable sharing.

Answer

REST

Answer

SOAP

Answer

SNMP

Question 11

During a ransomware incident, the incident response team needs to preserve evidence before containment. Which of the following actions should be performed BEFORE isolating the infected system from the network?

Accepted Answer

Capture the contents of RAM.. The order of volatility requires capturing volatile data like RAM before shutting down or isolating the system, as isolation may alter or lose memory contents.

Answer

Run an antivirus scan.

Answer

Disable the network interface.

Answer

Capture a forensic image of the hard drive.

Question 12

An organization is experiencing a DDoS attack targeting its web servers. Which of the following is the BEST short-term containment strategy?

Accepted Answer

Reroute traffic through a DDoS mitigation service.. Short-term containment for DDoS often involves rerouting traffic through a scrubbing center or cloud-based DDoS mitigation service that filters malicious traffic.

Answer

Rebuild the web servers from backups.

Answer

Implement rate limiting on the firewall.

Answer

Disable the web server accounts.

Question 13

A security analyst is investigating a potential data breach. The analyst needs to collect digital evidence while preserving its integrity. Which TWO actions should the analyst take? (Choose TWO.)

Accepted Answer

Verify the hash of the acquired image against the original.. Write blockers prevent modification of the original media during acquisition, and hash verification ensures the integrity of the acquired image by comparing hashes.

Answer

Run a full antivirus scan on the system.

Answer

Delete any malicious files found during the investigation.

Answer

Connect the suspect drive to a forensic workstation without a write blocker.

Question 14

During dynamic analysis of a suspicious file in a sandbox environment, which THREE behaviors are considered indicators of compromise (IOCs) that suggest malicious activity? (Choose THREE.)

Accepted Answer

Creating a registry run key to achieve persistence.. Dynamic analysis monitors behavior. Outbound connections to known bad IPs, creation of suspicious registry keys, and dropping files in startup folders are common malicious behaviors.

Answer

The file reading its own content.

Answer

Opening a text file that was already present.

Question 15

An incident response team is conducting post-incident activities after containing a malware outbreak. Which TWO activities should be included in the lessons learned phase? (Choose TWO.)

Accepted Answer

Conducting a root cause analysis.. Lessons learned involves analyzing the incident to improve future response. Updating detection rules based on IOCs and conducting a root cause analysis are key activities.

Answer

Deleting all logs from the incident.

Answer

Rewriting the organization's security policy from scratch.

Answer

Patching all systems immediately.