CS0-003 Hard Questions — 25 Difficult Questions

Question 1

A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Review scanner account permissions, allowed authentication methods, and sudo command restrictions. SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) can break credentialed scans if the scanner's account lacks proper permissions or uses an unsupported authentication method. The best next step is to verify that the scanner's SSH key or password is accepted, that the account has sudo privileges for required commands (e.g., `sudo -n` for non-interactive execution), and that no `sudoers` restrictions block the scanner's commands. This directly addresses the root cause without compromising security.

Answer

Disable SSH on all servers

Answer

Assume the hosts have no vulnerabilities

Answer

Run only unauthenticated scans forever

Question 2

An incident may involve regulated personal data. Who should be engaged early to determine notification obligations?

Accepted Answer

Legal, privacy, and compliance stakeholders. When an incident involves regulated personal data (e.g., PII, PHI, or GDPR-protected data), legal, privacy, and compliance stakeholders must be engaged early to determine statutory notification obligations. These stakeholders interpret applicable regulations (such as GDPR Article 33, HIPAA Breach Notification Rule, or state breach notification laws) to decide if, when, and how to notify affected parties and regulators.

Answer

Only the facilities manager

Answer

Only the vulnerability scanner vendor

Answer

Only the graphic design team

Question 3

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. The alert describes a workstation requesting a high number of Kerberos service tickets for many SPNs without subsequent service access. This is characteristic of Kerberoasting reconnaissance, where an attacker with domain credentials (e.g., a compromised user account) requests TGS tickets for service accounts to extract their NTLM hashes offline for cracking. The lack of actual service access confirms the tickets are being harvested, not used for legitimate authentication.

Answer

ARP spoofing

Answer

Pass-the-hash using NTLM only

Answer

DNS cache poisoning

Question 4

A security analyst is reviewing a vulnerability scan report that includes a plugin output with the following CVSS v3.1 vector: AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. Which of the following best describes the characteristics of this vulnerability?

Accepted Answer

Requires local access, high attack complexity, high privileges, and user interaction. The vector indicates local attack vector, high complexity, high privileges required, user interaction required, changed scope, and high impact on all three CIA metrics. This suggests a local privilege escalation vulnerability.

Answer

Easily exploitable by an unauthenticated remote attacker

Answer

Requires physical access to exploit

Answer

Remotely exploitable with low complexity

Question 5

During an audit, the compliance team needs to provide evidence that access reviews are performed regularly. Which of the following is the BEST evidence?

Accepted Answer

Signed and dated access review reports. Completed access review reports with timestamps and signatures provide clear evidence that reviews were conducted.

Answer

A list of user accounts with last login dates

Answer

A policy stating that access reviews should be done quarterly

Answer

Email reminders sent to managers to perform reviews

Question 6

A post-incident report finds that no one owned a failed alert integration. What should the corrective action include? If the primary audience is legal/privacy stakeholder, which content choice is most appropriate?

Accepted Answer

Named owner, due date, acceptance criteria, and retest plan. A post-incident report identifying an unowned failed alert integration requires a corrective action that assigns clear accountability and a measurable remediation plan. Naming an owner, setting a due date, defining acceptance criteria, and scheduling a retest ensure the integration is properly configured and monitored, directly addressing the root cause of the alert failure. This aligns with the NIST Incident Response Lifecycle's post-incident activity phase, which mandates actionable follow-up items to prevent recurrence.

Answer

A vague recommendation to improve security

Answer

Deletion of the integration record

Answer

No action because the incident is closed

Question 7

During forensic analysis of a compromised Linux server, an analyst needs to acquire memory evidence. The server is running and the analyst has root access. Which of the following tools should the analyst use to capture the contents of RAM with the least impact on the system?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a loadable kernel module that dumps memory and is designed to minimize footprint. It is commonly used for Linux memory acquisition.

Answer

WinPmem

Answer

FTK Imager

Answer

dd if=/dev/mem of=mem.dump

Question 8

While supporting a hybrid workforce, a developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first?

Accepted Answer

Disable or rotate the key and review actions performed with it. The correct first step is to disable or rotate the compromised cloud access key and review actions performed with it. This immediately revokes the attacker's access, preventing further unauthorized use, while the review of logs and API calls determines the scope of the breach. Waiting or blocking the developer's laptop does not address the exposed credential or the active threat from the unfamiliar IP.

Answer

Wait to see whether charges increase

Answer

Block the developer's laptop from Wi-Fi

Answer

Ask the developer to delete the commit only

Question 9

An incident may involve regulated personal data. Who should be engaged early to determine notification obligations?

Accepted Answer

Legal, privacy, and compliance stakeholders. When an incident involves regulated personal data (such as PII, PHI, or GDPR-protected data), legal, privacy, and compliance stakeholders must be engaged early to determine notification obligations. These stakeholders interpret breach notification laws and advise on required timelines, affected parties, and regulatory reporting.

Answer

Only the facilities manager

Answer

Only the vulnerability scanner vendor

Answer

Only the graphic design team

Question 10

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. It combines threat intelligence (CISA KEV and high EPSS) with environmental context (asset exposure) to prioritize the vulnerability that is actively exploited and likely to be used in attacks, even though its CVSS base score is medium. This aligns with risk-based vulnerability management, which weights exploitability and business impact over raw severity scores.

Answer

Always sort only by CVSS base score

Answer

Remediate alphabetically by CVE ID

Answer

Remediate only vulnerabilities with vendor logos in the report

Question 11

During a forensic investigation of a compromised Linux server, the analyst needs to acquire memory for analysis. The system is running and the analyst cannot power it off. Which tool is MOST appropriate for acquiring memory in this scenario?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a tool designed for acquiring memory from Linux systems while they are running, and it can be loaded as a kernel module without shutting down.

Answer

FTK Imager

Answer

WinPmem

Answer

dd

Question 12

A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

A retest showing the vulnerable condition is no longer present. The vulnerability manager must obtain objective evidence that the vulnerability has been remediated. A retest, either automated or manual, confirms that the specific vulnerable condition (e.g., a missing patch, misconfiguration, or outdated library) is no longer present on the asset. This aligns with the NIST SP 800-115 and PCI DSS 11.3.2 requirement for verification of remediation before closure.

Answer

Wait one year before testing

Answer

Close it immediately based on the email

Answer

Create a duplicate ticket for every asset

Question 13

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for incidents is significantly higher than industry benchmarks. Which of the following improvements would most directly reduce MTTD?

Accepted Answer

Implementing automated alerting based on threat intelligence.. MTTD is the average time to detect an incident. Implementing automated alerting and correlation rules from threat intelligence can speed up detection by reducing manual analysis time.

Answer

Increasing the number of forensic analysts on call.

Answer

Conducting more frequent tabletop exercises.

Answer

Rotating credentials after each incident.

Question 14

During a ransomware incident, the incident response team needs to preserve evidence before containment. Which of the following actions should be performed BEFORE isolating the infected system from the network?

Accepted Answer

Capture the contents of RAM.. The order of volatility requires capturing volatile data like RAM before shutting down or isolating the system, as isolation may alter or lose memory contents.

Answer

Run an antivirus scan.

Answer

Disable the network interface.

Answer

Capture a forensic image of the hard drive.

Question 15

A security analyst is using Nessus to scan a network. The scan completes and reports a vulnerability with a CVSS v3.1 base score of 5.3 and vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is a low-information disclosure issue that reveals the server's internal IP address in HTTP headers. The asset is a public-facing web server. Which of the following best describes the risk level and appropriate response?

Accepted Answer

Medium risk; schedule a configuration change to remove the header during the next maintenance window.. The CVSS score is 5.3 (Medium) with low impact on confidentiality and no impact on integrity or availability. Although it is a public-facing server, the risk is low because the information disclosed is minimal (internal IP), which may already be known or easily guessable. The appropriate response is to schedule remediation during normal maintenance, not an emergency.

Answer

Low risk; no action needed because internal IP disclosure is not a vulnerability.

Answer

Critical risk because the server is public-facing; immediate patching is required.

Answer

High risk due to public exposure; apply an emergency patch to hide the header.

Question 16

During a vulnerability assessment of a Kubernetes cluster, a security analyst finds that a container is running with privileged mode enabled and has a hostPath mount that grants write access to the host's /var/log directory. Which of the following is the most significant security risk associated with this configuration?

Accepted Answer

Potential for container escape and host node compromise. Privileged containers combined with hostPath mounts can allow container escape, enabling an attacker to gain root access on the host node.

Answer

Data leakage through unrestricted storage access

Answer

Excessive network permissions allowing lateral movement

Answer

Increased attack surface due to unnecessary services running in the container

Question 17

A vulnerability report is being prepared for an organization's management. Which of the following is the MOST appropriate structure for this report?

Accepted Answer

Executive summary, findings by severity, risk acceptance, remediation timeline. A standard vulnerability report includes an executive summary for high-level decision-makers, findings grouped by severity, risk acceptance decisions, and a remediation timeline.

Answer

Charts showing open vulnerability counts over time, without any narrative

Answer

List of all vulnerabilities sorted by CVSS score, followed by detailed technical descriptions

Answer

Network diagram with vulnerability locations, patch status, and compliance checklists

Question 18

A security team is scanning container images with Trivy and finds a vulnerability with CVSS v3.1 vector AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in a container running as a privileged container on a Kubernetes cluster. The team is prioritizing based on risk. Given the CVSS vector, which factor most significantly reduces the likelihood of exploitation in this context?

Accepted Answer

Attack Vector: Local. AV:L (Local) means the attacker must have local access to exploit. AC:H (High) and PR:H (High) are also limiting, but the attack vector being local means remote exploitation is not possible, which is a strong limiting factor. However, the question asks 'most significantly reduces the likelihood'. While local access is limiting, Attack Complexity High also reduces likelihood. But AV:L is more significant because it restricts the attack source. In the context of a container, local access might be more achievable, but still the vector shows it's not remotely exploitable. The best answer is Attack Vector: Local.

Answer

Privileges Required: High

Answer

Attack Complexity: High

Answer

User Interaction: None

Question 19

An analyst is reviewing a CASB alert indicating that a user accessed a cloud application from a geolocation that is not typical for the organization. Which THREE additional data sources would be most helpful to determine if the activity is malicious?

Accepted Answer

User activity logs from the cloud application. Authentication logs show if the login was successful and from which IP; threat intel can identify if the IP is malicious; user activity logs show behavior patterns.

Answer

Firewall logs showing outbound connections

Answer

Vulnerability scan results for the user's workstation

Question 20

A threat hunter is analyzing EDR telemetry and discovers that the process svchost.exe spawned a child process powershell.exe. The powershell.exe then established a network connection to an external IP address. Which of the following best describes this behavior in the context of threat hunting?

Accepted Answer

Living off the land binary (LOLBin) usage. Svchost.exe is a legitimate Windows process, but it should not spawn PowerShell. This is an unusual parent-child relationship often indicative of lateral movement or code injection, where attackers use svchost to execute malicious code.

Answer

A Windows update process

Answer

Normal administrative activity

Answer

A false positive from EDR