CS0-003 Incident Response and Management — Timed 40 Questions

Question 1

During the detection and analysis phase of the NIST SP 800-61 incident response lifecycle, an analyst identifies suspicious network traffic from an internal host to a known malicious IP address. Which step should the analyst perform next to validate the alert?

40 minute time limit — choose an answer to begin.

Accepted Answer

Correlate the alert with other logs and endpoint data to confirm malicious activity.. During the detection and analysis phase, the primary goal is to validate the alert by correlating it with additional data sources (e.g., firewall logs, DNS logs, endpoint detection and response (EDR) telemetry) to confirm whether the traffic is truly malicious or a false positive. Simply searching external threat intelligence (Option A) provides context but does not confirm activity on the host; escalation (Option C) and containment (Option D) are premature without validated evidence.

Answer

Search for the IP address on VirusTotal and Shodan.

Answer

Escalate the alert to the incident response team for containment.

Answer

Contain the host immediately by disconnecting it from the network.

Question 2

An organization's security team receives an alert about a potential ransomware infection on a critical server. The severity classification is 'high' because the server supports a production database. According to the incident response plan, which containment action should be taken first to minimize data loss?

Accepted Answer

Disconnect the server from the network.. Isolating the network connection prevents lateral movement and further encryption while preserving evidence for forensic analysis.

Answer

Reboot the server to clear the ransomware from memory.

Answer

Kill the ransomware process using task manager.

Answer

Create a full disk image of the server before any action.

Question 3

A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?

Accepted Answer

RAM → CPU registers → Swap → Network connections → Disk → Archived media. The correct order of volatility is: RAM, CPU registers, swap, network connections, disk, archived media. This sequence ensures that the most volatile data (RAM) is captured first, followed by CPU registers (which are volatile but require special tools), then swap (virtual memory), network connections (which can change rapidly but are less volatile than system memory), disk (persistent storage), and finally archived media (least volatile). Option B is correct because it places network connections before disk and maintains the overall correct sequence.

Answer

Disk → RAM → Swap → CPU registers → Network connections → Archived media

Answer

Network connections → CPU registers → RAM → Swap → Disk → Archived media

Answer

CPU registers → RAM → Swap → Disk → Network connections → Archived media

Question 4

After containing a malware outbreak, the incident response team performs static malware analysis on a suspicious executable. Which of the following artifacts would be most helpful in creating a YARA rule to detect variants of the malware?

Accepted Answer

The import table showing API calls like WriteProcessMemory and CreateRemoteThread. Import table analysis reveals API calls and DLLs used by the malware, which are often consistent across variants and useful for detection.

Answer

The creation timestamp of the file

Answer

The file size of the executable

Answer

The packer used to obfuscate the executable

Question 5

During dynamic malware analysis in a sandbox, an analyst observes that the malware attempts to connect to a remote IP address on port 443, modifies the Windows registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and drops a DLL in the system32 folder. Which type of IOC is most indicative of persistence?

Accepted Answer

The registry modification to the Run key. The registry modification to HKCU\Software\Microsoft\Windows\CurrentVersion\Run is the most indicative of persistence because this specific key is designed to automatically launch programs when a user logs in. By adding a value here, the malware ensures it executes on every system startup, which is the definition of persistence. In contrast, network connections and file drops are common during execution but do not inherently guarantee re-execution after a reboot.

Answer

The network connection over port 443

Answer

The remote IP address

Answer

The dropped DLL file hash

Question 6

An organization uses MISP as its threat intelligence platform. After a security incident, the team wants to share IOCs with other trusted organizations. Which standard should they use to package and exchange the threat intelligence?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is the standard for describing threat intelligence, and TAXII is the protocol for sharing it.

Answer

SNMP

Answer

NetFlow

Answer

SMTP

Question 7

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for a recent breach was 14 days, while the mean time to respond (MTTR) was 6 hours. Which metric should the team prioritize to improve in future incidents?

Accepted Answer

Mean time to detect (MTTD). A high MTTD indicates the organization is not detecting incidents quickly enough, which increases dwell time and potential damage.

Answer

Percentage of incidents containing malware

Answer

Number of incidents per week

Answer

Mean time to respond (MTTR)

Question 8

A security analyst is performing memory acquisition on a compromised Linux server using LiME. The analyst needs to capture the memory image with minimal impact on the system. Which of the following parameters should the analyst use to ensure the output is forensically sound?

Accepted Answer

Ensure the output path is on a write-blocked device. Using a write blocker ensures the memory capture does not alter the storage media, preserving forensic integrity.

Answer

Use the --digest option to calculate a SHA256 hash during acquisition

Answer

Specify a format that compresses the output to reduce size

Answer

Use the --reload option to reload the original kernel module after acquisition

Question 9

An analyst receives an alert about a user account that has been locked out multiple times within an hour. The account belongs to a system administrator. Which incident category does this scenario most likely fall under?

Accepted Answer

Insider threat. A system administrator account being locked out multiple times in an hour suggests a deliberate attempt to guess or brute-force the credentials, or the admin themselves may be performing unauthorized actions that trigger lockout policies. This aligns with an insider threat because the account has elevated privileges and the anomalous lockout pattern indicates either a compromised credential or malicious insider activity, not an external network-based attack.

Answer

DDoS

Answer

Ransomware

Answer

Phishing

Question 10

During a forensic investigation, an analyst creates a disk image using dd with a SHA256 hash. Later, the analyst needs to verify the integrity of the image before analysis. Which command should the analyst use to compare the original hash with a newly computed hash?

Accepted Answer

sha256sum image.dd. Recomputing the hash with sha256sum and comparing it to the original verifies that the image has not been altered.

Answer

md5sum original.dd

Answer

dd if=image.dd | sha256sum

Answer

chksum -a sha256 image.dd

Question 11

An organization has been experiencing repeated phishing attacks that bypass email filters. The incident response team wants to enhance detection by creating rules based on characteristics of the phishing emails. Which of the following IOCs would be most effective for detecting similar phishing campaigns?

Accepted Answer

Email subject lines and sender domain. Email indicators such as subject lines, sender addresses, or embedded URLs are directly observable in emails and help identify phishing patterns.

Answer

Registry keys modified by the payload

Answer

File hashes of attached malware

Answer

IP addresses of the phishing servers

Question 12

During a post-incident activity, the CSIRT performs a root cause analysis for a data breach. They discover that the breach originated from a misconfigured S3 bucket that allowed public read access. Which of the following actions should be included in the lessons learned to prevent recurrence?

Accepted Answer

Implement automated compliance checks for cloud storage configurations. Implementing automated compliance checks using tools like AWS Config ensures that storage configurations are continuously monitored and misconfigurations are flagged or corrected.

Answer

Rotate all access keys for the affected account

Answer

Disable public access to all S3 buckets permanently

Answer

Conduct a penetration test on the cloud environment

Question 13

During which phase of the NIST SP 800-61 incident response lifecycle would an organization conduct a lessons learned meeting?

Accepted Answer

Post-Incident Activity. The post-incident activity phase includes lessons learned, root cause analysis, and improvement actions.

Answer

Containment, Eradication, and Recovery

Answer

Detection and Analysis

Answer

Preparation

Question 14

A security analyst detects ransomware on a critical server. Which containment strategy should be implemented FIRST to minimize damage?

Accepted Answer

Disconnect the server from the network. Immediate network isolation (short-term containment) stops lateral spread and limits damage.

Answer

Run a full antivirus scan on the server

Answer

Block the ransomware's command-and-control IP at the firewall

Answer

Rebuild the server from a clean backup

Question 15

During a forensic investigation, an analyst needs to acquire memory from a Linux server. Which tool is specifically designed for this purpose?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module for acquiring volatile memory from Linux systems.

Answer

dd

Answer

FTK Imager

Answer

WinPmem

Question 16

Which of the following is the MOST volatile data according to the order of volatility?

Accepted Answer

CPU registers and cache. CPU registers and cache are the most volatile because they store data only while the system is powered on and actively executing instructions. Unlike RAM, which retains data for a short time after power loss, registers and cache lose their contents almost instantly when power is removed, making them the highest priority in the order of volatility (OOV) for forensic acquisition.

Answer

Disk storage

Answer

Swap space

Answer

RAM

Question 17

An analyst is reviewing a suspicious executable using static analysis. Which of the following would provide information about the functions the executable imports from system libraries?

Accepted Answer

Import table analysis. The import table lists DLLs and functions that the executable uses, revealing potential capabilities.

Answer

PE header analysis

Answer

String extraction

Answer

YARA rule creation

Question 18

A SOC analyst receives an alert from a threat intelligence platform (TIP) about a new phishing campaign. The indicator is a URL. Which enrichment source is BEST for determining the URL's current hosting infrastructure?

Accepted Answer

Passive DNS. Passive DNS allows querying historical and current IP addresses associated with a domain, revealing hosting changes.

Answer

VirusTotal

Answer

WHOIS

Answer

Shodan

Question 19

During a post-incident review, the CSIRT identifies that the mean time to detect (MTTD) is significantly higher than the industry benchmark. Which initiative would MOST likely reduce MTTD?

Accepted Answer

Deploying additional endpoint detection and response (EDR) sensors. Improving detection capabilities through enhanced monitoring and alerting reduces detection time.

Answer

Conducting more frequent tabletop exercises

Answer

Rotating credentials for all service accounts

Answer

Implementing a new patch management process

Question 20

An organization has identified indicators of compromise (IOCs) from a recent incident. Which data format is specifically designed for sharing threat intelligence in a standardized, machine-readable way?

Accepted Answer

STIX. STIX (Structured Threat Information Expression) is a language for sharing threat intelligence.

Answer

PDF

Answer

CSV

Answer

JSON