CS0-003 Incident Response and Management Practice Test 5 — 15 Questions

Question 1

An organization has detected a ransomware outbreak that has encrypted critical file servers. The incident response team has activated the plan. Which three of the following actions should be taken during the containment and eradication phases? (Choose three.)

Accepted Answer

Restore encrypted data from verified, offline backups.. Isolating affected systems from the network immediately is correct because it stops the ransomware from spreading laterally to other hosts via SMB, RDP, or other network protocols. This containment step is critical to limit the scope of the outbreak and protect unencrypted assets.

Answer

Notify law enforcement before any containment actions.

Answer

Disable the antivirus software to reduce system load.

Answer

Power down all systems to prevent further encryption.

Question 2

During a security incident, a digital forensics investigator must preserve evidence according to best practices. Which three of the following actions align with proper forensic procedures? (Choose three.)

Accepted Answer

Calculate and document cryptographic hashes of acquired images.. Calculating and documenting cryptographic hashes (e.g., SHA-256) of acquired images ensures data integrity by providing a verifiable fingerprint that can prove the image has not been altered since acquisition. Maintaining a documented chain of custody tracks every person who handled the evidence, preserving its admissibility in legal proceedings. Using a write blocker when creating disk images prevents any accidental writes to the original media, which is critical to avoid altering the evidence.

Answer

Boot the suspect system to check for running processes.

Answer

Store original evidence on the same network as the investigation.

Answer

Reinstall the operating system before imaging to ensure stability.

Question 3

A security analyst is reviewing lessons learned after a data breach. Which three of the following are key objectives of a post-incident activity phase? (Choose three.)

Accepted Answer

Conduct a root cause analysis to identify the underlying vulnerabilities.. Conducting a root cause analysis is a key objective of the post-incident activity phase because it identifies the underlying vulnerabilities and weaknesses that allowed the breach to occur. This analysis informs the development of corrective actions to prevent recurrence, which is a core goal of lessons learned. Without this step, the organization cannot effectively harden its defenses against similar attacks.

Answer

Discipline the employees responsible for the breach.

Answer

Delete all logs to prevent future misuse of data.

Answer

Restore affected systems to their pre-incident state immediately.

Question 4

An organization has just experienced a successful phishing attack that led to credential theft. The incident response team is performing analysis. Which three of the following indicators of compromise (IOCs) would be most relevant to investigate? (Choose three.)

Accepted Answer

Unusual outbound network connections from user workstations.. Unusual outbound network connections from user workstations are a key IOC because after credential theft, attackers often use stolen credentials to establish remote access or exfiltrate data, generating connections to command-and-control (C2) servers or unexpected external IPs. New scheduled tasks created on endpoints without user knowledge indicate persistence mechanisms, as attackers commonly use schtasks.exe or at.exe to maintain access and execute malicious code at regular intervals. Emails with similar subject lines being sent from internal accounts suggest lateral phishing or spam campaigns using compromised accounts to spread malware or harvest additional credentials, a classic post-exploitation behavior.

Answer

A spike in failed login attempts from a single IP address.

Answer

A sudden increase in available disk space on file servers.

Answer

The antivirus definition file being updated automatically.

Question 5

During the post-incident analysis phase of an incident response process, which of the following activities are considered essential best practices? Choose all that apply. (There are four correct answers.)

Accepted Answer

Creating a detailed timeline of the incident from detection to containment and recovery.. A detailed timeline is essential for reconstructing the sequence of events, identifying the initial compromise vector, and measuring response effectiveness. It provides a factual basis for all subsequent analysis and reporting, ensuring that the incident response team can accurately assess the scope and impact of the incident.

Answer

Immediately deleting all logs related to the incident to free up storage space.

Answer

Notifying law enforcement and regulatory bodies before conducting any internal investigation.

Question 6

Arrange the steps for a typical penetration testing engagement in the correct order.

Question 7

Arrange the steps for conducting a risk assessment in the correct order.

Question 8

Match each network protocol to its well-known port number.

Question 9

Match each security control to its category.

Question 10

A security analyst notices a single external IP address attempting to log in to multiple user accounts on the company's VPN server over the past hour. All attempts have failed. What should the analyst do FIRST?

Accepted Answer

Verify the logs and escalate to the incident response team.. Option C is correct because the first step in incident response is to verify the logs to confirm the activity is not a false positive (e.g., a misconfigured client or legitimate brute-force testing) and then escalate to the incident response team for coordinated action. This aligns with the NIST SP 800-61 incident response lifecycle, where identification and validation precede containment. Blocking or disabling without verification could disrupt legitimate access or destroy forensic evidence.

Answer

Block the IP address at the firewall.

Answer

Notify law enforcement.

Answer

Disable the VPN server.

Question 11

During a ransomware attack, several workstations have been encrypted. The incident response team has identified the ransomware variant and determined it does not have a known decryption tool. Which containment strategy is MOST appropriate?

Accepted Answer

Disconnect the affected workstations from the network, but leave them powered on.. Disconnecting the affected workstations from the network (but leaving them powered on) preserves volatile evidence in memory (e.g., encryption keys, process artifacts) and prevents the ransomware from spreading to other hosts via SMB, RDP, or other lateral movement protocols. Powering off would destroy this critical forensic data, while leaving them connected risks further encryption of network shares.

Answer

Power off all affected workstations immediately.

Answer

Run a full antivirus scan on the affected workstations.

Answer

Restore all affected workstations from backups immediately.

Question 12

An incident responder is collecting evidence from a compromised Linux server. The server is still running. Which order of collection adheres to the order of volatility?

Accepted Answer

Memory → network connections → swap space → disk.. Option C is correct because the order of volatility (OOV) dictates that the most volatile data (memory/registers) must be collected first, followed by network connections, then swap space, and finally disk. Memory contains running processes and encryption keys that vanish on power loss; network connections change rapidly; swap space persists longer but is still more volatile than disk. This sequence ensures maximum preservation of ephemeral evidence before it is lost.

Answer

Memory → network connections → disk → swap space.

Answer

Disk → memory → network connections → swap space.

Answer

Network connections → memory → disk → swap space.

Question 13

A company has been notified by a partner that sensitive data from their shared database was leaked. The CSIRT has been activated. Who should be notified FIRST according to the incident response plan?

Accepted Answer

The incident response team.. According to standard incident response frameworks (NIST SP 800-61, SANS PICERL), the incident response team (CSIRT) must be notified first because they are the trained responders who will contain, analyze, and coordinate the response. In this scenario, the CSIRT has already been activated, but the question asks who should be notified first per the plan—the IR team is the initial point of contact to ensure proper triage and evidence preservation before any external communication occurs.

Answer

The legal department.

Answer

The affected partner.

Answer

The CEO.

Question 14

A SOC analyst receives a file from an unknown source via email. The analyst wants to analyze the file without executing it to determine its functionality. Which type of analysis should be performed?

Accepted Answer

Static analysis.. Static analysis involves examining a file's code, structure, and metadata without executing it, making it the correct choice for determining functionality while avoiding execution risks. Techniques include inspecting strings, headers, and disassembled code to identify malicious indicators like embedded URLs or API calls.

Answer

Behavioral analysis.

Answer

Memory analysis.

Answer

Dynamic analysis.

Question 15

After a data breach involving customer PII, the incident response team has contained the incident and eradicated the malware. What is the NEXT step in the remediation process?

Accepted Answer

Close the vulnerability that was exploited.. Option D is correct because closing the vulnerability prevents recurrence. Root cause analysis is part of post-incident, customer notification is legal/compliance, and system restoration is part of recovery.

Answer

Restore systems from clean backups.

Answer

Conduct a root cause analysis.

Answer

Notify all affected customers.