CS0-003 Incident Response and Management Practice Test 6 — 15 Questions

Question 1

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which of the following is the most appropriate next step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Collect additional logs and perform a deeper analysis to confirm the compromise.. After detection, the analyst should collect additional data to confirm the incident and scope the impact before proceeding to containment.

Answer

Notify law enforcement immediately.

Answer

Immediately isolate the host from the network.

Answer

Rebuild the host from a known good image.

Question 2

A security team is responding to a suspected data breach involving exfiltration of customer data via email. During the containment phase, which TWO actions should the team perform to preserve evidence while preventing further data loss?

Accepted Answer

Disable the compromised user account.. Disabling the compromised account stops further data exfiltration, and taking a memory dump of the email server preserves volatile evidence for forensic analysis.

Answer

Rebuild the email server from backup.

Answer

Notify all customers immediately.

Answer

Apply all available patches to the email server.

Question 3

A security analyst is responding to a potential data exfiltration incident. As part of the containment strategy, the analyst must preserve evidence. Which TWO actions should the analyst take before containment? (Select two.)

Accepted Answer

Capture a forensic image of the affected systems. Forensic imaging of the affected systems captures the state before containment actions alter it. Recording current network connections captures volatile evidence that may be lost when the system is isolated.

Answer

Change passwords for affected accounts

Answer

Disconnect the system from the network

Answer

Kill malicious processes

Question 4

A CSIRT is investigating a ransomware incident that encrypted files on multiple servers. The team needs to determine the initial infection vector. Which THREE pieces of evidence should the team prioritize collecting? (Select three.)

Accepted Answer

Email gateway logs for the week prior to the incident. Email logs can reveal phishing attachments or links. Endpoint logs may show process execution or downloads. Network logs can identify C2 communication or lateral movement. These three together help trace the initial entry.

Answer

Physical access logs to the data center

Answer

Firewall configuration backups

Question 5

A security analyst is reviewing IOCs from a threat intelligence feed. The analyst wants to enrich the IOCs using open-source tools. Which THREE tools are commonly used for IOC enrichment? (Select three.)

Accepted Answer

WHOIS. VirusTotal provides file and URL reputation. Shodan gives information about exposed services. WHOIS reveals domain registration details. These are standard enrichment sources.

Answer

Wireshark

Answer

Nmap

Question 6

A security analyst is investigating a phishing incident that resulted in credential theft. Which TWO actions should the analyst take as part of short-term containment? (Choose two.)

Accepted Answer

Block the phishing domain at the email gateway. Short-term containment aims to stop the immediate threat. Disabling accounts and blocking malicious domains are quick containment actions.

Answer

Rebuild the affected workstations from a clean image

Answer

Conduct a full vulnerability scan of the network

Answer

Change all user passwords in the domain

Question 7

During a forensic investigation, an analyst must acquire digital evidence while maintaining forensic soundness. Which THREE practices should the analyst follow? (Choose three.)

Accepted Answer

Verify the hash of the image against the original. Write blockers prevent modification, hash verification ensures integrity, and proper documentation maintains chain of custody.

Answer

Use the suspect's operating system to copy files

Answer

Power on the system to capture volatile data first

Question 8

A company has experienced a ransomware attack that encrypted critical servers. The incident response team is in the containment, eradication, and recovery phase. Which THREE actions are part of long-term containment? (Choose three.)

Accepted Answer

Apply security patches to vulnerable systems. Long-term containment involves actions to prevent recurrence, such as patching, rebuilding systems, and rotating credentials.

Answer

Isolate the infected systems from the network

Answer

Block the ransomware's C2 domain at the firewall

Question 9

A security analyst is performing incident response for a suspected malware outbreak. Which TWO actions are examples of long-term containment? (Select TWO.)

Accepted Answer

Apply security patches to all systems. Long-term containment includes actions that permanently remediate the threat, such as patching vulnerabilities and rebuilding systems. Isolating the network is short-term.

Answer

Isolate the affected network segment

Answer

Disable compromised user accounts

Answer

Block malicious IPs at the firewall

Question 10

During a forensic investigation, an analyst must preserve evidence in accordance with forensic sound procedures. Which THREE of the following practices should the analyst follow? (Select THREE.)

Accepted Answer

Document all actions taken in a chain of custody form. Forensic sound procedures include using write blockers to prevent alteration, verifying integrity with hashes, and documenting the chain of custody. Running a live scan would alter data.

Answer

Run a full antivirus scan on the target drive

Answer

Boot the system to ensure it is operational

Question 11

An incident response team is analyzing indicators of compromise (IOCs) from a phishing campaign. Which THREE of the following are commonly used IOC types? (Select THREE.)

Accepted Answer

IP addresses. Common IOC types include IP addresses, file hashes, domains, URLs, and email indicators. Software versions are not typically IOCs.

Answer

CPU registers

Answer

Software version numbers

Question 12

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, a security analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which of the following is the most appropriate next step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Validate the incident by reviewing additional data sources.. NIST SP 800-61 emphasizes that during detection and analysis, the first step is to validate the incident as a true positive before escalating or containing. The analyst should confirm the alert is not a false positive by gathering additional evidence.

Answer

Run a full antivirus scan on the workstation.

Answer

Isolate the workstation from the network immediately.

Answer

Notify law enforcement per the incident response plan.

Question 13

An incident responder is called to a server room where a critical database server is exhibiting signs of compromise. The responder must preserve evidence while preventing further damage. Which of the following is a short-term containment strategy that also preserves evidence?

Accepted Answer

Disconnect the network cable from the server.. Disconnecting the network cable (Option B) is the correct short-term containment strategy because it immediately isolates the compromised database server from the network, preventing further lateral movement or data exfiltration, while preserving the volatile system state (memory, running processes, open network connections) for forensic analysis. This action stops active network-based attacks without altering the contents of RAM or disk, which is critical for evidence integrity.

Answer

Reboot the server into safe mode.

Answer

Power off the server to freeze the system state.

Answer

Run a memory dump with WinPmem before any action.

Question 14

An incident response team is conducting post-incident activities after a ransomware attack. The team wants to improve detection and response for future incidents. Which TWO actions are most appropriate for updating detection rules? (Select TWO.)

Accepted Answer

Create YARA rules to identify the ransomware file hashes and patterns.. Updating SIEM correlation rules based on the attack TTPs and creating YARA rules for the ransomware family will enhance detection of similar threats.

Answer

Conduct a tabletop exercise for the incident response team.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with external threat intelligence platforms.

Question 15

A security analyst is investigating a potential data exfiltration incident. The analyst captures memory from a Windows system and finds a process that is injecting code into other processes. Which THREE indicators from the memory analysis would MOST strongly suggest malicious activity? (Select THREE.)

Accepted Answer

The process has memory regions with RWX permissions.. Suspicious memory regions (like RWX), unusual API calls (e.g., WriteProcessMemory), and hidden processes are strong indicators of malware or code injection.

Answer

The process name is a known Windows system process.

Answer

The process has a valid digital signature.