CS0-003 Incident Response and Management Practice Test 6 — 15 Questions

Question 1

After a DDoS attack, the incident response team wants to improve detection and prevention. Which of the following metrics would be MOST useful for evaluating the effectiveness of the response?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) measures the average time taken to respond to and resolve an incident after it is detected. In the context of evaluating the effectiveness of the response to a DDoS attack, MTTR directly reflects how quickly the team mitigated the attack and restored normal operations. A lower MTTR indicates a more effective response process, making it the most useful metric among the options.

Answer

Number of false positives

Answer

Mean Time to Detect (MTTD)

Answer

Incidents per week

Question 2

A security analyst is investigating a potential malware infection on a Windows workstation. The analyst needs to collect evidence while preserving the order of volatility. Which TWO pieces of data should the analyst collect FIRST? (Select TWO)

Accepted Answer

Contents of RAM. Options D and E are correct because they represent the most volatile data on a Windows workstation, which must be captured before it is lost on shutdown, reboot, or continued system activity. Contents of RAM (D) hold live memory artifacts such as injected code, encryption keys, and uncommitted malware traces that vanish when power is removed, making it the highest-priority acquisition under the order of volatility. Running processes and network connections (E) are also highly volatile, since process tables, handles, and active TCP/UDP sessions change or disappear rapidly and reveal the malware's execution and command-and-control activity. By contrast, system event logs (A) and registry hives (C) persist on disk and are less volatile, so they are collected after memory and live-state data, while the contents of the hard drive (B) are the least volatile and typically imaged last.

Answer

System event logs

Answer

Contents of the hard drive

Answer

Registry hives

Question 3

An incident responder is performing containment of a ransomware incident that has encrypted files on several file servers. Which THREE actions are appropriate for long-term containment and recovery? (Select THREE)

Accepted Answer

Patching the vulnerability exploited by the ransomware. Patching the exploited vulnerability (B) is correct because it removes the initial access vector, preventing the ransomware from re-infecting systems during long-term containment and recovery. Rebuilding affected servers from known-good backups (C) is correct because encrypted systems cannot be trusted after compromise; restoring from clean backups ensures integrity and enables recovery. Rotating all service account credentials (D) is correct because ransomware often harvests credentials for lateral movement and persistence, so rotating them invalidates stolen secrets and blocks re-entry. Blocking the C2 IP (A) and isolating the affected segment (E) are valid immediate/short-term containment measures, but they do not address the root cause or restore operations, so they are not the long-term containment and recovery actions requested.

Answer

Blocking the ransomware's command-and-control IP at the firewall

Answer

Isolating the affected network segment

Question 4

During a forensic investigation, an analyst needs to acquire disk images from multiple suspect drives. Which THREE practices ensure forensic soundness? (Select THREE)

Accepted Answer

Documenting the chain of custody for each drive. Option A is correct because documenting the chain of custody for each drive creates an auditable record of who handled the evidence, when, and under what conditions, which is essential for the evidence to be admissible and for forensic soundness. Option C is correct because computing and verifying cryptographic hashes such as SHA-256 (or MD5) of both the original drive and the resulting image proves the image is a bit-for-bit duplicate and that no alteration occurred during acquisition. Option D is correct because a hardware write blocker enforces a read-only connection to the source drive at the hardware level, preventing any writes or metadata changes that would taint the original evidence. Option B is not appropriate because speed without verification sacrifices integrity; forensic imaging must prioritize accuracy and validation over raw throughput. Option E is not appropriate because live acquisition alters the running system's state and memory, introduces volatility and potential contamination, and is generally reserved for situations where a dead-box acquisition is impossible.

Answer

Using the fastest available imaging method without verification

Answer

Acquiring the image while the system is running (live acquisition)

Question 5

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies an alert indicating a high volume of outbound traffic from a critical server to an unknown IP address. Which of the following actions should the analyst perform FIRST?

Accepted Answer

Correlate the alert with firewall logs and other security tools.. In the NIST SP 800-61 Detection and Analysis phase, the analyst's first priority is to validate and understand the alert before taking disruptive action. Correlating the alert with firewall logs and other security tools confirms whether the outbound traffic is truly malicious, identifies the destination, and establishes scope — this is the analysis step that precedes containment. Acting on an unverified alert risks unnecessary downtime and destroys evidence needed for the investigation.

Answer

Notify law enforcement immediately.

Answer

Isolate the server from the network to prevent data exfiltration.

Answer

Rebuild the server from a known good backup.

Question 6

A security analyst is classifying an incident where an employee's workstation is infected with ransomware that encrypts files and displays a ransom note. Which incident category and severity level best describe this scenario?

Accepted Answer

Malware, moderate. Ransomware is a specific subtype of malware that encrypts files and demands payment, making 'Malware' the appropriate incident category. The severity is 'moderate' because while the infection impacts a single workstation and causes data loss, it does not immediately compromise the entire network or expose sensitive data at scale, aligning with typical moderate-severity criteria for isolated malware incidents.

Answer

DDoS, low

Answer

Data breach, high

Answer

Insider threat, high

Question 7

During forensic analysis of a compromised Linux server, an analyst needs to acquire memory evidence. The server is running and the analyst has root access. Which of the following tools should the analyst use to capture the contents of RAM with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that dumps memory and is designed to minimize footprint. It is commonly used for Linux memory acquisition.

Answer

WinPmem

Answer

FTK Imager

Answer

dd if=/dev/mem of=mem.dump

Question 8

A security team is responding to a phishing incident that led to credential compromise. Which of the following is the BEST short-term containment action to prevent further damage?

Accepted Answer

Disable the compromised user account.. Short-term containment aims to stop the attack quickly. Disabling the compromised account prevents the attacker from using the stolen credentials to access resources.

Answer

Rebuild the user's workstation.

Answer

Block the phishing email's source IP at the firewall.

Answer

Rotate all domain admin passwords.

Question 9

An analyst is performing static analysis on a suspicious executable file. Which of the following would be MOST useful to identify potential malicious behavior without executing the file?

Accepted Answer

Analyzing the import table.. Static analysis involves examining the file without executing it. The import table shows which Windows API functions the executable uses, which can indicate capabilities such as network communication, file operations, or registry modifications.

Answer

Running the file in a sandbox.

Answer

Monitoring network connections during execution.

Answer

Checking the file's digital signature.

Question 10

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for incidents is significantly higher than industry benchmarks. Which of the following improvements would most directly reduce MTTD?

Accepted Answer

Implementing automated alerting based on threat intelligence.. Mean time to detect (MTTD) measures how quickly incidents are identified. Implementing automated alerting based on threat intelligence directly improves detection speed by continuously monitoring for known indicators of compromise and generating alerts in real time. This reduces the time between an incident occurring and the team becoming aware of it.

Answer

Increasing the number of forensic analysts on call.

Answer

Conducting more frequent tabletop exercises.

Answer

Rotating credentials after each incident.

Question 11

Which of the following is the FIRST step in the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation. NIST SP 800-61 Rev. 2 defines the incident response lifecycle as four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation is the first phase because it establishes the CSIRT, tools, communications plans, and playbooks before any incident occurs. Without preparation, later phases cannot be executed effectively.

Answer

Detection and Analysis

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 12

An analyst is using YARA to create rules for detecting a specific malware strain. Which of the following pieces of information is MOST useful for writing a YARA rule?

Accepted Answer

A unique string within the malware.. YARA rules are based on patterns in the file, such as strings and byte sequences. A unique string found in the malware sample can be used to create a rule that identifies the malware.

Answer

The malware's file size.

Answer

The date the malware was first seen.

Answer

The malware's MD5 hash.

Question 13

When performing digital forensics, which of the following represents the correct order of volatility from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs, archived media. The order of volatility, per RFC 3227, runs from most volatile to least: CPU registers and cache, RAM, swap/pagefile, disk (local), logs (remote), and archived media. Option D follows this sequence exactly. Capturing the most volatile data first preserves evidence that would otherwise be lost when the system powers down or memory is overwritten.

Answer

RAM, CPU registers, disk, swap, logs, archived media

Answer

Swap, RAM, CPU registers, disk, logs, archived media

Answer

Archived media, logs, disk, swap, RAM, CPU registers

Question 14

A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is a standardized language for describing cyber threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is the protocol for exchanging that intelligence over HTTPS. Together, they provide a standardized format and transport mechanism for sharing threat intel between organizations, as required by the question.

Answer

REST

Answer

SOAP

Answer

SNMP

Question 15

During a ransomware incident, the incident response team needs to preserve evidence before containment. Which of the following actions should be performed BEFORE isolating the infected system from the network?

Accepted Answer

Capture the contents of RAM.. The order of volatility requires capturing volatile data like RAM before shutting down or isolating the system, as isolation may alter or lose memory contents.

Answer

Run an antivirus scan.

Answer

Disable the network interface.

Answer

Capture a forensic image of the hard drive.