CS0-003 Incident Response and Management Practice Test 3 — 15 Questions

Question 1

While supporting a hybrid workforce, a user reports approving an unexpected OAuth consent prompt for an app named 'Invoice Reader'. The app now has mailbox read permissions. What should the incident responder do first? During detection and analysis, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Revoke the app grant, review mailbox access, and identify other users who consented. Option D is correct because the immediate priority is to revoke the malicious OAuth grant to stop the attacker's access, then review the mailbox for any data exfiltration or abuse, and finally identify other users who may have consented to the same app to contain the incident. This follows the NIST SP 800-61 incident response process for detection and analysis, where the most defensible decision is to remove the attacker's foothold and assess the scope of compromise. Ignoring the issue or taking non-targeted actions like password resets or email deletion fails to address the root cause—the OAuth consent grant—which persists independently of user credentials.

Answer

Ignore it if MFA is enabled

Answer

Delete all emails from the mailbox

Answer

Only reset the user's Windows password

Question 2

In a regulated payment environment, file shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action? During containment, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Isolate the workstation and disable its active sessions to file servers. Option D is correct because isolating the workstation immediately stops the ransomware from encrypting additional file shares and prevents lateral movement. Disabling active sessions to file servers cuts off the encryption process at the network level, preserving the forensic evidence on the host and shares. This aligns with the NIST SP 800-61 containment strategy of 'stop the bleeding' before any other action.

Answer

Run vulnerability scans on every subnet first

Answer

Restore backups before isolating the host

Answer

Email all users the ransom note

Question 3

While supporting a hybrid workforce, a developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Disable or rotate the key and review actions performed with it. The correct first step is to disable or rotate the compromised cloud access key and review actions performed with it. This immediately revokes the attacker's access, preventing further unauthorized use, while the review of logs and API calls determines the scope of the breach. Waiting or blocking the developer's laptop does not address the exposed credential or the active threat from the unfamiliar IP.

Answer

Wait to see whether charges increase

Answer

Block the developer's laptop from Wi-Fi

Answer

Ask the developer to delete the commit only

Question 4

While supporting a hybrid workforce, a web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Option C is correct because web-shell activity on a web server is best confirmed by correlating web access logs showing unusual query parameters with file timestamps indicating the creation of a new executable file, process execution logs revealing the web service account spawning a shell (e.g., cmd.exe or /bin/sh), and outbound connections from that account to an external IP—this multi-source evidence chain directly matches the behavior of a web shell executing commands via HTTP GET/POST parameters. During recovery, the most defensible decision is to isolate the server and preserve these logs as forensic artifacts, guided by the evidence of unauthorized command execution and outbound C2 traffic.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata

Question 5

While supporting a hybrid workforce, a laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Option D is correct because forensic acquisition requires a complete chain of custody to ensure evidence admissibility in legal proceedings. Documenting who collected the evidence, when and where it was collected, hash values (e.g., SHA-256) for integrity verification, transfer details (e.g., using a write-blocker and forensic imaging tool like FTK Imager), and the storage location (e.g., secure evidence locker or encrypted NAS) satisfies legal and organizational standards such as NIST SP 800-86.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title

Question 6

While supporting a hybrid workforce, a server suspected of running fileless malware is still powered on. Which evidence should be captured first if it is safe to do so? During detection and analysis, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Volatile memory and active network/process state. Volatile memory (RAM) and active network/process state must be captured first because fileless malware resides only in memory and leaves no persistent artifacts on disk. If the system is powered off, all evidence of the malware's execution (e.g., injected code, network connections, running processes) is lost forever. This follows the order of volatility (RFC 3227), which prioritizes capturing the most ephemeral data before any other forensic step.

Answer

Marketing screenshots

Answer

Archived monthly reports

Answer

The office seating plan

Question 7

While supporting a hybrid workforce, after containing a compromised host, analysis shows persistence through a scheduled task and a stolen service account. What is required before recovery? During containment, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Remove persistence, rotate affected credentials, and verify no related hosts remain compromised. Option D is correct because before recovery, you must remove the persistence mechanism (the scheduled task) to prevent re-infection, rotate the stolen service account credentials to close the attacker's access, and verify no other hosts are compromised via the same account. This aligns with the NIST SP 800-61 recovery phase, which requires eliminating all footholds and validating the scope of compromise before returning the host to production.

Answer

Reconnect the host because users need it

Answer

Disable logging to improve performance

Answer

Close the incident after isolation

Question 8

While supporting a hybrid workforce, an incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Specific playbook updates, escalation triggers, owners, and due dates. Option D is correct because the post-incident review should produce actionable improvements to the incident response process. Specific playbook updates, escalation triggers, owners, and due dates directly address the delayed escalation and excessive dwell time by formalizing when and how to escalate, ensuring accountability and timely response in future incidents.

Answer

A generic statement that security is important

Answer

Deletion of all incident tickets

Answer

A blame list of individual analysts

Question 9

While supporting a hybrid workforce, a malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Business impact, privilege level, asset criticality, and spread potential. Option B is correct because severity in incident response is determined by business impact, privilege level, asset criticality, and spread potential. The domain admin workstation has elevated privileges and access to critical systems, making the same malware far more dangerous than on a kiosk. This aligns with NIST SP 800-61 and common IR frameworks that prioritize containment based on risk, not chronology or naming.

Answer

Whether the alert arrived first

Answer

Alphabetical order of hostnames

Answer

The analyst's preferred dashboard theme

Question 10

While supporting a hybrid workforce, a company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Tabletop exercise using a realistic ransomware scenario. A tabletop exercise (option A) is the correct choice because it simulates a realistic ransomware scenario in a discussion-based format, allowing legal, PR, IT, and executives to validate their roles and decision-making processes without impacting production systems. This aligns with NIST SP 800-61r2 guidelines for testing incident response plans through low-impact, discussion-driven exercises, ensuring cross-functional coordination without risking data integrity or availability.

Answer

Purchasing a new SIEM without testing procedures

Answer

Annual password reset only

Answer

Full destructive malware detonation in production

Question 11

After a high-priority SOC escalation, a user reports approving an unexpected OAuth consent prompt for an app named 'Invoice Reader'. The app now has mailbox read permissions. What should the incident responder do first? During detection and analysis, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Revoke the app grant, review mailbox access, and identify other users who consented. Option D is correct because the immediate priority is to revoke the malicious OAuth consent grant, which removes the app's access to the mailbox via the Microsoft Graph API. Reviewing mailbox access (e.g., via Exchange Online audit logs) is necessary to assess data exfiltration, and identifying other users who consented helps contain a potential phishing campaign targeting the same app. This follows the NIST SP 800-61 incident response process for containment, eradication, and recovery.

Answer

Ignore it if MFA is enabled

Answer

Delete all emails from the mailbox

Answer

Only reset the user's Windows password

Question 12

While supporting a hybrid workforce, file shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action? During containment, which decision is most defensible? which evidence should guide the decision?

Accepted Answer

Isolate the workstation and disable its active sessions to file servers. Option D is correct because the immediate priority in a ransomware incident is to stop the spread of encryption. Isolating the workstation (e.g., disabling its network interface or physically unplugging it) and terminating its active SMB sessions to file servers prevents the ransomware from encrypting additional shares. This containment step preserves evidence and limits damage without relying on potentially compromised backups or alerting the attacker.

Answer

Run vulnerability scans on every subnet first

Answer

Restore backups before isolating the host

Answer

Email all users the ransom note

Question 13

After a high-priority SOC escalation, a developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Disable or rotate the key and review actions performed with it. Option B is correct because the immediate priority in incident response is to contain the breach by disabling or rotating the compromised cloud access key, which prevents further unauthorized use. Reviewing actions performed with the key is essential to assess the scope of the incident, such as data exfiltration or resource manipulation, aligning with the NIST SP 800-61 containment, eradication, and recovery phases. This approach follows the SANS PICERL model, where containment (disabling the key) precedes eradication and recovery.

Answer

Wait to see whether charges increase

Answer

Block the developer's laptop from Wi-Fi

Answer

Ask the developer to delete the commit only

Question 14

After a high-priority SOC escalation, a web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Option C is correct because web-shell activity requires correlating multiple evidence sources: web access logs show the initial malicious request (e.g., a POST to a PHP file with a query parameter like `?cmd=whoami`), file timestamps confirm when the shell was created, process execution logs (e.g., Sysmon Event ID 1) reveal the spawned child processes (e.g., cmd.exe, powershell.exe), and outbound connections from the web service account (e.g., netstat or firewall logs) indicate command-and-control (C2) or data exfiltration. This multi-source correlation aligns with the NIST SP 800-61 incident-response methodology for validating a compromise.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata

Question 15

After a high-priority SOC escalation, a laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Option D is correct because forensic acquisition requires a complete chain of custody to ensure evidence admissibility in legal proceedings. The responder must document who collected the evidence, the exact date/time, the physical location, cryptographic hash values (e.g., SHA-256) to verify integrity, transfer details (e.g., write-blocker used, destination media), and the final storage location. This aligns with NIST SP 800-86 and ISO 27037 forensic best practices.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title