CS0-003 Incident Response and Management Practice Test 7 — 15 Questions

Question 1

An organization is experiencing a DDoS attack targeting its web servers. Which of the following is the BEST short-term containment strategy?

Accepted Answer

Reroute traffic through a DDoS mitigation service.. Short-term containment for DDoS often involves rerouting traffic through a scrubbing center or cloud-based DDoS mitigation service that filters malicious traffic.

Answer

Rebuild the web servers from backups.

Answer

Implement rate limiting on the firewall.

Answer

Disable the web server accounts.

Question 2

A security analyst is investigating a potential data breach. The analyst needs to collect digital evidence while preserving its integrity. Which TWO actions should the analyst take? (Choose TWO.)

Accepted Answer

Verify the hash of the acquired image against the original.. Option C is correct because verifying the hash (e.g., MD5 or SHA-256) of the acquired forensic image against the original source confirms that the copy is bit-for-bit identical and has not been altered, which is essential for maintaining evidence integrity and admissibility. Option D is correct because using a hardware or software write blocker when imaging the hard drive prevents any write operations to the suspect drive, ensuring the original evidence remains unmodified during acquisition. Option A is incorrect because running a full antivirus scan modifies system state, timestamps, and potentially quarantines or alters files, which contaminates evidence. Option B is incorrect because deleting malicious files destroys evidence and violates chain-of-custody and preservation principles. Option E is incorrect because connecting a suspect drive without a write blocker allows the forensic workstation's OS to write to the drive, altering metadata and compromising evidentiary integrity.

Answer

Run a full antivirus scan on the system.

Answer

Delete any malicious files found during the investigation.

Answer

Connect the suspect drive to a forensic workstation without a write blocker.

Question 3

During dynamic analysis of a suspicious file in a sandbox environment, which THREE behaviors are considered indicators of compromise (IOCs) that suggest malicious activity? (Choose THREE.)

Accepted Answer

Creating a registry run key to achieve persistence.. Option A is correct because creating a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\...\Run) is a classic persistence mechanism that causes malware to execute automatically at user logon or system startup, making it a strong IOC. Option B is correct because outbound network connections to a known malicious IP indicate command-and-control (C2) communication, data exfiltration, or payload retrieval, which are hallmark malicious behaviors observed during sandbox dynamic analysis. Option D is correct because dropping an executable into the Startup folder (e.g., %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup) establishes persistence by launching the file automatically at user logon, another well-known IOC. Option C is not an IOC because a file reading its own content is common benign behavior (e.g., self-verification, configuration parsing) and does not by itself indicate malicious activity. Option E is not an IOC because opening a pre-existing text file is normal, expected behavior for many legitimate applications and lacks the persistence, network, or payload-dropping characteristics of malicious activity.

Answer

The file reading its own content.

Answer

Opening a text file that was already present.

Question 4

An incident response team is conducting post-incident activities after containing a malware outbreak. Which TWO activities should be included in the lessons learned phase? (Choose TWO.)

Accepted Answer

Conducting a root cause analysis.. Option B (Conducting a root cause analysis) is correct because the lessons learned phase of incident response requires determining why the malware outbreak occurred and how it bypassed existing controls, so the team can address the underlying weakness rather than just the symptom. Option D (Updating detection rules based on IOCs) is correct because indicators of compromise gathered during the incident should be operationalized into SIEM correlation rules, IDS/IPS signatures, or EDR detections to improve future detection and reduce time to identify similar threats. Option A is wrong because deleting logs destroys forensic evidence and violates retention and chain-of-custody requirements; logs should be preserved and reviewed. Option C is wrong because rewriting the entire security policy from scratch is an overreaction not scoped to lessons learned, which should produce targeted improvements. Option E is wrong because patching all systems immediately is a remediation action that belongs to the eradication/recovery phase, not the post-incident lessons learned review.

Answer

Deleting all logs from the incident.

Answer

Rewriting the organization's security policy from scratch.

Answer

Patching all systems immediately.

Question 5

During the preparation phase of the NIST SP 800-61 incident response lifecycle, which of the following is the MOST important activity to ensure effective incident response?

Accepted Answer

Creating and training the incident response team. The preparation phase of NIST SP 800-61 is about establishing the capability to respond before an incident occurs. The single most critical element is having a trained, organized incident response team with defined roles, responsibilities, and communication channels. Without a competent team, detection tools, segmentation, and post-incident analysis cannot be effectively leveraged. NIST explicitly lists 'Incident Response Team' as a key preparation component, including team formation, training, and equipping.

Answer

Using YARA rules to detect malware in the environment

Answer

Implementing network segmentation to limit lateral movement

Answer

Conducting a root cause analysis after each incident

Question 6

A security analyst is triaging an alert indicating that a user's workstation has been infected with ransomware. The file server shows signs of encryption. The analyst needs to contain the incident. Which action should the analyst take FIRST to minimize damage?

Accepted Answer

Disconnecting the workstation from the network. Disconnecting the infected workstation from the network stops the ransomware from spreading to other systems via network shares.

Answer

Running a full antivirus scan on the workstation

Answer

Disabling the user's Active Directory account

Answer

Rebuilding the workstation from a known good image

Question 7

During a forensic investigation of a compromised Linux server, the analyst needs to acquire memory for analysis. The system is running and the analyst cannot power it off. Which tool is MOST appropriate for acquiring memory in this scenario?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a tool designed for acquiring memory from Linux systems while they are running, and it can be loaded as a kernel module without shutting down.

Answer

FTK Imager

Answer

WinPmem

Answer

dd

Question 8

An analyst is investigating a suspected data breach. The analyst needs to identify which files were exfiltrated and preserve evidence. According to the order of volatility, which of the following should the analyst capture FIRST?

Accepted Answer

CPU registers and cache. Order of volatility prioritizes capturing volatile data first. CPU registers and cache are the most volatile, then RAM, swap, disk, etc.

Answer

Contents of the hard drive

Answer

Network connections and listening ports

Answer

System logs

Question 9

A security analyst is analyzing a suspicious file using static analysis. The analyst wants to identify imported functions to determine the file's capabilities. Which tool or technique is BEST suited for this task?

Accepted Answer

Analyzing the PE header's import table. PE header analysis includes examining the import table to see which Windows API functions the executable calls, revealing its potential behavior.

Answer

Extracting strings from the file

Answer

Submitting the file to VirusTotal

Answer

Running the file in a sandbox like Cuckoo

Question 10

During dynamic analysis of a malware sample in a sandbox, the analyst observes that the malware attempts to connect to an IP address 198.51.100.23 and modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Which IOC type is the IP address an example of?

Accepted Answer

Network indicator. IP addresses are a common type of indicator of compromise, representing network-based IOCs that can be used for detection.

Answer

File hash

Answer

Email indicator

Answer

Domain name

Question 11

After containing a ransomware incident, the incident response team is conducting post-incident activities. Which action is MOST important to prevent a similar attack in the future?

Accepted Answer

Performing a root cause analysis and implementing remediation. Conducting a root cause analysis identifies the underlying vulnerability or weakness that allowed the attack, enabling targeted remediation.

Answer

Sharing IOCs with other organizations via a threat intelligence platform

Answer

Reimaging all affected systems

Answer

Updating the incident response plan

Question 12

An analyst is investigating a possible data exfiltration incident. The analyst has acquired a memory dump from the compromised system. Which of the following would be the BEST approach to extract evidence of exfiltration?

Accepted Answer

Using a memory analysis framework like Volatility to analyze network connections and process memory. Memory analysis tools like Volatility can extract network connections, process memory, and other artifacts that may show exfiltration activity.

Answer

Calculating the MD5 hash of the memory dump and comparing it to known good hashes

Answer

Searching the memory dump for strings containing 'password'

Answer

Rebooting the system and capturing a new memory dump

Question 13

An organization wants to automate the sharing of threat intelligence with other trusted entities using a standardized protocol. Which protocol is specifically designed for this purpose?

Accepted Answer

TAXII. TAXII (Trusted Automated eXchange of Indicator Information) is a protocol for exchanging cyber threat intelligence in a standardized format, often used with STIX.

Answer

STIX

Answer

REST API

Answer

MISP

Question 14

During the detection and analysis phase of an incident, an analyst identifies a file with a hash that matches a known malware signature. The analyst wants to enrich this IOC with additional context. Which resource is BEST suited for this enrichment?

Accepted Answer

VirusTotal. VirusTotal aggregates antivirus scan results and provides additional context such as file metadata, behavior, and community comments.

Answer

Shodan

Answer

WHOIS lookup

Answer

Passive DNS

Question 15

A security analyst is performing forensic analysis of a compromised system. The analyst needs to acquire disk evidence in a forensically sound manner. Which TWO actions should the analyst take to ensure the integrity of the evidence? (Choose TWO.)

Accepted Answer

Calculate a hash of the original drive before imaging. Option A is correct because calculating a cryptographic hash (e.g., MD5 or SHA-256) of the original drive before imaging establishes a baseline value that can later be compared to the hash of the forensic image, proving the data was not altered. Option C is correct because a hardware or software write blocker prevents any write operations to the source drive during acquisition, preserving the original evidence in an unmodified state as required for forensic soundness. Option B is incorrect because disabling the write blocker would allow the forensic workstation to write to the source drive, contaminating or altering the evidence. Option D is incorrect because powering on the system and running an antivirus scan modifies file system metadata, timestamps, and potentially deletes or quarantines files, destroying evidence integrity. Option E is incorrect because rebooting the system alters volatile data and can modify file system artifacts such as temporary files, log entries, and timestamps, which compromises the evidence.

Answer

Disable the write blocker to speed up the imaging process

Answer

Power on the system and run a full antivirus scan before imaging

Answer

Reboot the system to clear any temporary files