CS0-003 Incident Response and Management Practice Test 2 — 15 Questions

Question 1

A server suspected of running fileless malware is still powered on. Which evidence should be captured first if it is safe to do so? During detection and analysis, which decision is most defensible?

Accepted Answer

Volatile memory and active network/process state. Volatile memory (RAM) and active network/process state must be captured first because fileless malware resides only in memory and leaves no persistent artifacts on disk. Any shutdown or reboot would destroy this evidence, making it impossible to analyze the malware's behavior, network connections, or injected processes. This follows the forensic order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Answer

Marketing screenshots

Answer

Archived monthly reports

Answer

The office seating plan

Question 2

After containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible?

Accepted Answer

Remove persistence, rotate affected credentials, and verify no related hosts remain compromised. Option D is correct because before recovery, you must remove the persistence mechanism (the scheduled task), rotate the stolen service account credentials to prevent re-entry, and verify that no other hosts are compromised using the same foothold. This ensures the attacker cannot regain access after the host is restored to production, which is a fundamental step in the eradication phase of incident response.

Answer

Reconnect the host because users need it

Answer

Disable logging to improve performance

Answer

Close the incident after isolation

Question 3

An incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible?

Accepted Answer

Specific playbook updates, escalation triggers, owners, and due dates. Option D is correct because a post-incident review must produce actionable improvements to prevent recurrence. Delayed escalation indicates a failure in detection or notification procedures; therefore, specific playbook updates, escalation triggers, owners, and due dates directly address the root cause by refining incident response workflows and ensuring timely escalation in future incidents.

Answer

A generic statement that security is important

Answer

Deletion of all incident tickets

Answer

A blame list of individual analysts

Question 4

A malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible?

Accepted Answer

Business impact, privilege level, asset criticality, and spread potential. Option B is correct because severity in incident response is determined by business impact, privilege level, asset criticality, and spread potential, not by timing or trivial factors. A domain admin workstation has elevated privileges and access to sensitive systems, making the same malware far more dangerous than on an isolated kiosk. During recovery, prioritizing based on these factors ensures defensible decisions align with risk management frameworks like NIST SP 800-61.

Answer

Whether the alert arrived first

Answer

Alphabetical order of hostnames

Answer

The analyst's preferred dashboard theme

Question 5

A company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible?

Accepted Answer

Tabletop exercise using a realistic ransomware scenario. A tabletop exercise is the correct choice because it allows stakeholders (legal, PR, IT, executives) to validate their roles and decision-making processes during a ransomware incident without impacting production systems. This aligns with the NIST SP 800-61 incident response testing framework, which emphasizes discussion-based exercises for validating procedures and communication flows. Unlike destructive tests, a tabletop exercise uses a realistic scenario to simulate the incident lifecycle, ensuring role clarity and procedural readiness.

Answer

Purchasing a new SIEM without testing procedures

Answer

Annual password reset only

Answer

Full destructive malware detonation in production

Question 6

In a regulated payment environment, a user reports approving an unexpected OAuth consent prompt for an app named 'Invoice Reader'. The app now has mailbox read permissions. What should the incident responder do first? During detection and analysis, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Revoke the app grant, review mailbox access, and identify other users who consented. Option D is correct because the immediate priority is to revoke the malicious OAuth app grant to stop ongoing unauthorized access, then review the mailbox for any data exfiltration or tampering, and finally identify other users who may have consented to the same app to contain a broader compromise. This aligns with the NIST SP 800-61 incident response process for detection and analysis, where the most defensible decision is to remove the attacker's foothold while preserving evidence for forensic analysis. Revoking the grant directly addresses the OAuth consent attack vector, which bypasses traditional password-based controls and MFA.

Answer

Ignore it if MFA is enabled

Answer

Delete all emails from the mailbox

Answer

Only reset the user's Windows password

Question 7

During containment of a compromised cloud access key, which actions are appropriate? (Choose two.)

Accepted Answer

Review audit logs for actions performed with the key. Reviewing audit logs for actions performed with the compromised key is appropriate during containment because it allows the incident response team to determine the scope of unauthorized access, identify affected resources, and understand the attacker's actions. This step is critical for informed decision-making before revoking or rotating the key, ensuring that legitimate operations are not disrupted and that forensic evidence is preserved.

Answer

Only delete the public repository commit

Answer

Grant the key administrator privileges for investigation

Question 8

In a regulated payment environment, a developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Disable or rotate the key and review actions performed with it. Option B is correct because the immediate priority is to revoke the compromised cloud access key to prevent further unauthorized use, while simultaneously reviewing logs to understand the scope of the attacker's actions. In a regulated payment environment (e.g., PCI DSS), failing to disable the key promptly could lead to a data breach and non-compliance penalties. Reviewing actions with the key is essential for incident response and forensic evidence collection.

Answer

Wait to see whether charges increase

Answer

Block the developer's laptop from Wi-Fi

Answer

Ask the developer to delete the commit only

Question 9

In a regulated payment environment, a web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Option C is correct because web-shell activity requires evidence of both the initial compromise (web access logs showing the malicious file request, file timestamps indicating creation/modification) and the subsequent command execution (process execution logs from the web service account, outbound connections from that account). This combination confirms the attacker used the query parameter to execute commands and exfiltrate data, which is the core indicator of a web shell in a regulated payment environment.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata

Question 10

In a regulated payment environment, a laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Option D is correct because legal and regulatory requirements demand a complete chain of custody for digital evidence. Documenting who collected the laptop, when, where, hash values (e.g., SHA-256), transfer details, and storage location ensures the evidence is admissible and tamper-proof. This aligns with NIST SP 800-86 and ISO 27037 forensic best practices.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title

Question 11

In a regulated payment environment, a server suspected of running fileless malware is still powered on. Which evidence should be captured first if it is safe to do so? During detection and analysis, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Volatile memory and active network/process state. In a fileless malware incident, the malware resides in volatile memory (RAM) and active system processes, leaving no persistent artifacts on disk. Capturing volatile memory (e.g., via `memdump` or `LiME`) and active network/process state (e.g., `netstat`, `ps`, `lsof`) preserves the most ephemeral evidence before it is lost upon shutdown or power loss. This aligns with the NIST SP 800-86 forensic order of volatility, which mandates collecting volatile data first.

Answer

Marketing screenshots

Answer

Archived monthly reports

Answer

The office seating plan

Question 12

In a regulated payment environment, after containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Remove persistence, rotate affected credentials, and verify no related hosts remain compromised. Option D is correct because after containing a compromised host, the recovery phase requires removing the persistence mechanism (the scheduled task), rotating the stolen service account credentials to prevent re-authentication, and verifying that no other hosts are compromised via lateral movement. This ensures the threat is fully eradicated before returning the host to production, which is critical in a regulated payment environment where PCI DSS or similar standards mandate thorough remediation.

Answer

Reconnect the host because users need it

Answer

Disable logging to improve performance

Answer

Close the incident after isolation

Question 13

In a regulated payment environment, an incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Specific playbook updates, escalation triggers, owners, and due dates. Option D is correct because a post-incident review in a regulated payment environment must produce actionable improvements to prevent recurrence. Delayed escalation indicates a failure in detection or notification procedures, so the review should yield specific playbook updates, escalation triggers, assigned owners, and due dates to ensure timely response in future incidents. This aligns with NIST SP 800-61r2 and PCI DSS requirements for continuous improvement of incident response processes.

Answer

A generic statement that security is important

Answer

Deletion of all incident tickets

Answer

A blame list of individual analysts

Question 14

In a regulated payment environment, a malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Business impact, privilege level, asset criticality, and spread potential. Option B is correct because severity in incident response must be driven by business impact, privilege level, asset criticality, and spread potential. The domain admin workstation has elevated privileges and access to sensitive systems, making it a higher priority than a non-sensitive kiosk, regardless of alert order. This aligns with NIST SP 800-61 and common IR frameworks that prioritize containment based on risk, not chronology.

Answer

Whether the alert arrived first

Answer

Alphabetical order of hostnames

Answer

The analyst's preferred dashboard theme

Question 15

In a regulated payment environment, a company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Tabletop exercise using a realistic ransomware scenario. A tabletop exercise (A) is the correct choice because it allows the company to validate roles, communication paths, and decision-making processes for a ransomware incident without any risk to production systems. This aligns with the need to test understanding across legal, PR, IT, and executives in a regulated environment where touching live systems is prohibited. Full destructive detonation (D) would violate regulatory compliance and cause data loss, while purchasing a new SIEM (B) or an annual password reset (C) does not test incident response roles at all.

Answer

Purchasing a new SIEM without testing procedures

Answer

Annual password reset only

Answer

Full destructive malware detonation in production