CS0-003 Incident Response and Management Practice Test 7 — 15 Questions

Question 1

An organization's incident response team is classifying an incident based on severity and priority. Which TWO factors should the team consider when determining the priority of an incident? (Select TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The potential business impact of the incident.. Priority is often based on the criticality of the affected assets and the potential business impact, as these determine how quickly the incident needs to be addressed.

Answer

The number of users reporting the issue.

Answer

The time of day the incident occurred.

Answer

The type of threat actor involved.

Question 2

During a forensic investigation, an analyst needs to acquire volatile memory from a compromised Linux server running a critical application. The server cannot be powered off. Which tool should the analyst use to capture memory with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that captures memory with minimal footprint, suitable for live acquisition on Linux systems.

Answer

avml

Answer

WinPmem

Answer

dd

Question 3

An organization uses MISP (Malware Information Sharing Platform) to share threat intelligence with trusted partners. Which of the following standards is commonly used by MISP to structure and exchange threat intelligence data?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Answer

NetFlow

Answer

SNMP

Answer

Syslog

Question 4

A security analyst is investigating a potential malware infection on a Windows workstation. The analyst needs to collect evidence while preserving the order of volatility. Which TWO pieces of data should the analyst collect FIRST? (Select TWO)

Accepted Answer

Contents of RAM. According to the order of volatility, the most volatile data should be collected first. CPU registers and cache are at the top of the order, followed by routing table, ARP cache, process table, kernel statistics, and then memory. However, among the options, running processes (memory) and network connections are among the most volatile. Typically, memory (RAM) is collected before disk data.

Answer

System event logs

Answer

Contents of the hard drive

Answer

Registry hives

Question 5

An incident responder is performing containment of a ransomware incident that has encrypted files on several file servers. Which THREE actions are appropriate for long-term containment and recovery? (Select THREE)

Accepted Answer

Patching the vulnerability exploited by the ransomware. Long-term containment aims to prevent recurrence and restore normal operations. Rebuilding systems from clean backups ensures removal of malware. Rotating credentials prevents attacker re-entry. Patching vulnerabilities closes the initial attack vector.

Answer

Blocking the ransomware's command-and-control IP at the firewall

Answer

Isolating the affected network segment

Question 6

During a forensic investigation, an analyst needs to acquire disk images from multiple suspect drives. Which THREE practices ensure forensic soundness? (Select THREE)

Accepted Answer

Documenting the chain of custody for each drive. Forensic soundness requires maintaining evidence integrity. Using a verified write blocker prevents alteration. Hashing the original and copy ensures integrity. Documenting the chain of custody maintains accountability.

Answer

Using the fastest available imaging method without verification

Answer

Acquiring the image while the system is running (live acquisition)

Question 7

Which of the following is the FIRST step in the NIST SP 800-61 incident response lifecycle?

Accepted Answer

Preparation. The NIST SP 800-61 lifecycle begins with Preparation, which includes establishing policies, tools, and training before an incident occurs.

Answer

Detection and Analysis

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 8

When performing digital forensics, which of the following represents the correct order of volatility from most volatile to least volatile?

Accepted Answer

CPU registers, RAM, swap, disk, logs, archived media. The order of volatility dictates that evidence should be collected from most volatile to least volatile to avoid losing transient data. CPU registers are the most volatile, followed by RAM, swap, disk, logs, and archived media.

Answer

RAM, CPU registers, disk, swap, logs, archived media

Answer

Swap, RAM, CPU registers, disk, logs, archived media

Answer

Archived media, logs, disk, swap, RAM, CPU registers

Question 9

A security analyst is investigating a potential data breach. The analyst needs to collect digital evidence while preserving its integrity. Which TWO actions should the analyst take? (Choose TWO.)

Accepted Answer

Verify the hash of the acquired image against the original.. Write blockers prevent modification of the original media during acquisition, and hash verification ensures the integrity of the acquired image by comparing hashes.

Answer

Run a full antivirus scan on the system.

Answer

Delete any malicious files found during the investigation.

Answer

Connect the suspect drive to a forensic workstation without a write blocker.

Question 10

During dynamic analysis of a suspicious file in a sandbox environment, which THREE behaviors are considered indicators of compromise (IOCs) that suggest malicious activity? (Choose THREE.)

Accepted Answer

Creating a registry run key to achieve persistence.. Dynamic analysis monitors behavior. Outbound connections to known bad IPs, creation of suspicious registry keys, and dropping files in startup folders are common malicious behaviors.

Answer

The file reading its own content.

Answer

Opening a text file that was already present.

Question 11

An incident response team is conducting post-incident activities after containing a malware outbreak. Which TWO activities should be included in the lessons learned phase? (Choose TWO.)

Accepted Answer

Conducting a root cause analysis.. Lessons learned involves analyzing the incident to improve future response. Updating detection rules based on IOCs and conducting a root cause analysis are key activities.

Answer

Deleting all logs from the incident.

Answer

Rewriting the organization's security policy from scratch.

Answer

Patching all systems immediately.

Question 12

During the preparation phase of the NIST SP 800-61 incident response lifecycle, which of the following is the MOST important activity to ensure effective incident response?

Accepted Answer

Creating and training the incident response team. Preparation includes creating and training the incident response team, acquiring tools, and establishing procedures. A well-trained team is critical to executing the response effectively.

Answer

Using YARA rules to detect malware in the environment

Answer

Implementing network segmentation to limit lateral movement

Answer

Conducting a root cause analysis after each incident

Question 13

A security analyst is triaging an alert indicating that a user's workstation has been infected with ransomware. The file server shows signs of encryption. The analyst needs to contain the incident. Which action should the analyst take FIRST to minimize damage?

Accepted Answer

Disconnecting the workstation from the network. Disconnecting the infected workstation from the network stops the ransomware from spreading to other systems via network shares.

Answer

Running a full antivirus scan on the workstation

Answer

Disabling the user's Active Directory account

Answer

Rebuilding the workstation from a known good image

Question 14

A security analyst is performing forensic analysis of a compromised system. The analyst needs to acquire disk evidence in a forensically sound manner. Which TWO actions should the analyst take to ensure the integrity of the evidence? (Choose TWO.)

Accepted Answer

Calculate a hash of the original drive before imaging. Using a write blocker prevents alteration of the original disk, and computing a hash verifies that the acquired image is an exact copy.

Answer

Disable the write blocker to speed up the imaging process

Answer

Power on the system and run a full antivirus scan before imaging

Answer

Reboot the system to clear any temporary files

Question 15

An organization is experiencing a distributed denial-of-service (DDoS) attack targeting its web servers. The incident response team is implementing containment strategies. Which TWO actions are appropriate for short-term containment of a DDoS attack? (Choose TWO.)

Accepted Answer

Rerouting traffic through a DDoS mitigation service or scrubbing center. Short-term containment for DDoS includes blocking attack traffic at the network perimeter and diverting traffic via a scrubbing center. Patching servers does not stop the attack, and rebuilding is recovery.

Answer

Disabling the accounts of the attackers

Answer

Applying a security patch to the web server software

Answer

Rebuilding the web servers from clean images