CS0-003 Incident Response and Management — Timed 15 Questions

Question 1

A host is suspected of running fileless malware. Which artefacts should be collected quickly? (Choose two.)

Accepted Answer

Memory image or live response data. Fileless malware operates in memory without writing to disk, so capturing a memory image or live response data preserves the malicious code, injected DLLs, and process hollowing artifacts that would vanish on reboot. Active network connections and running processes reveal the malware's C2 communications and its in-memory execution context, which are critical for identifying the infection vector and scope.

Answer

A list of cafeteria purchases

Answer

A printed office map

Question 2

A phishing incident led to credential theft. Which containment actions are appropriate? (Choose two.)

Accepted Answer

Reset affected credentials and revoke active sessions. Option A is correct because immediately resetting compromised credentials and revoking active sessions (e.g., via Azure AD 'Revoke-AzureADUserAllRefreshToken' or Active Directory 'Reset-ADAccountPassword' combined with 'Revoke-AuthenticationTokens') invalidates the attacker's access tokens and session cookies, preventing further lateral movement or data exfiltration. This aligns with the NIST SP 800-61 containment phase, which prioritizes cutting off attacker access while preserving forensic evidence.

Answer

Delete all user mailboxes

Answer

Disable DNS for the entire company indefinitely

Question 3

Which actions belong in eradication after a confirmed web-shell compromise? (Choose two.)

Accepted Answer

Remove the web shell and close the exploited vulnerability. Option A is correct because removing the web shell eliminates the attacker's foothold, and closing the exploited vulnerability (e.g., patching the application, disabling vulnerable functions like `eval()` or `system()`, or updating a CMS plugin) prevents re-exploitation. This aligns with the eradication phase of incident response, which aims to remove all artifacts of the compromise and harden the system against the same attack vector.

Answer

Reconnect the server before checking persistence

Answer

Only block the analyst's IP address

Question 4

What should be included in incident scoping for ransomware? (Choose three.)

Accepted Answer

Initial infected host and user context. Option A is correct because identifying the initial infected host and user context is critical for understanding the attack vector, containing the threat, and preventing further spread. In ransomware incidents, the first compromised system often reveals the entry point (e.g., phishing email, RDP brute force) and the user account used, which helps scope the blast radius and prioritize remediation.

Answer

The brand of office chairs near the server room

Question 5

A legal hold is issued during an investigation. Which actions support it? (Choose two.)

Accepted Answer

Preserve relevant logs, mailboxes, images, and tickets. A legal hold (litigation hold) requires preservation of all potentially relevant electronically stored information (ESI). Preserving logs, mailboxes, images, and tickets ensures that data is not altered or deleted, maintaining its integrity for forensic analysis and legal proceedings. This action directly supports the hold by preventing spoliation and ensuring compliance with discovery obligations.

Answer

Let each team decide informally what to delete

Answer

Purge audit logs to save storage

Question 6

A tabletop exercise reveals that no one knows who can approve public statements. What should be updated? (Choose two.)

Accepted Answer

Contact list and escalation matrix. The tabletop exercise revealed a gap in the incident response process: no one knows who can approve public statements. This is a procedural and communication failure, not a technical one. Updating the incident communication plan with named approval roles (Option D) directly addresses this by defining the specific person or role authorized to speak publicly. The contact list and escalation matrix (Option B) must also be updated to ensure the correct approver can be reached quickly, as it provides the hierarchical path and contact details needed to execute the plan.

Answer

The office seating plan only

Answer

The malware signature database only

Question 7

A responder is acquiring evidence from a potentially compromised server. Which actions support forensic integrity? (Choose two.)

Accepted Answer

Calculate and record hashes of acquired images. Calculating and recording hashes (e.g., SHA-256) of acquired disk images ensures data integrity by providing a cryptographic fingerprint that can be used later to verify that the evidence has not been altered. This is a foundational step in forensic acquisition, as any modification to the image will produce a different hash, proving tampering or corruption.

Answer

Disable all logging before acquisition

Answer

Edit suspicious files to see whether malware reacts

Question 8

An attacker used a stolen cloud token. Which evidence helps determine blast radius? (Choose two.)

Accepted Answer

Permissions assigned to the principal during the compromise window. Option B is correct because the permissions assigned to the principal (e.g., an IAM role or user) during the compromise window directly define what actions the attacker could perform with the stolen token. Cloud providers like AWS evaluate permissions at the time of the API call, so the blast radius is limited to the resources and actions allowed by the policies attached at that moment. Without knowing these permissions, you cannot determine which data or services were accessible.

Answer

The user's monitor brightness

Answer

The logo on the cloud provider website

Question 9

Which actions are appropriate before restoring systems after malware eradication? (Choose two.)

Accepted Answer

Validate backups are clean and restorable. Option C is correct because restoring from backups that are themselves infected or corrupted would reintroduce the malware or cause system instability. Before restoration, backups must be validated as clean (e.g., scanned with updated antivirus or checked against known file hashes) and restorable (e.g., tested via a restore dry-run or checksum verification). This ensures the recovery process does not perpetuate the incident.

Answer

Disable all monitoring during restoration

Answer

Reuse known-compromised credentials

Question 10

A root-cause analysis finds that an alert fired but was never triaged. Which corrective actions are useful? (Choose two.)

Accepted Answer

Define queue ownership and escalation thresholds. Option C is correct because defining queue ownership and escalation thresholds ensures that alerts are assigned to a specific team or individual and have a clear path for escalation if not acknowledged within a defined time. This directly addresses the root cause of the alert never being triaged by enforcing accountability and automated follow-up, which is a standard incident response practice per NIST SP 800-61.

Answer

Blame an individual without process review

Answer

Delete the alert rule because it was inconvenient

Question 11

A user reports approving an unexpected OAuth consent prompt for an app named 'Invoice Reader'. The app now has mailbox read permissions. What should the incident responder do first? During detection and analysis, which decision is most defensible?

Accepted Answer

Revoke the app grant, review mailbox access, and identify other users who consented. Option D is correct because the incident responder must first revoke the malicious OAuth app grant to immediately stop the attacker's access via the delegated mailbox permissions. Following revocation, reviewing mailbox access logs (e.g., Mailbox Audit Log, EWS/Graph API calls) is essential to assess the scope of compromise, and identifying other users who consented to the same app is critical to contain lateral movement. This aligns with the NIST SP 800-61 incident response lifecycle's containment and eradication phase.

Answer

Ignore it if MFA is enabled

Answer

Delete all emails from the mailbox

Answer

Only reset the user's Windows password

Question 12

File shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action? During containment, which decision is most defensible?

Accepted Answer

Isolate the workstation and disable its active sessions to file servers. Option D is correct because the immediate priority is to stop the ransomware from encrypting more data and spreading laterally. Isolating the workstation (e.g., disabling its network interface or disconnecting the cable) and terminating its active SMB sessions to file servers cuts off the encryption process at the source, preventing further damage while preserving forensic evidence.

Answer

Run vulnerability scans on every subnet first

Answer

Restore backups before isolating the host

Answer

Email all users the ransom note

Question 13

A developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible?

Accepted Answer

Disable or rotate the key and review actions performed with it. Option B is correct because the immediate priority is to revoke the compromised credential to prevent further unauthorized access. Disabling or rotating the cloud access key stops any ongoing malicious activity, and reviewing the actions performed with it allows the incident response team to assess the scope of the breach, identify affected resources, and determine if any data was exfiltrated or modified. This aligns with the containment and eradication phases of incident response.

Answer

Wait to see whether charges increase

Answer

Block the developer's laptop from Wi-Fi

Answer

Ask the developer to delete the commit only

Question 14

A web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible?

Accepted Answer

Web access logs, file timestamps, process execution, and outbound connections from the web service account. Option C is correct because web-shell activity is confirmed by correlating multiple evidence sources: web access logs show the initial exploit request with a query parameter (e.g., ?cmd=whoami), file timestamps reveal the creation of the malicious file, process execution logs (e.g., Sysmon Event ID 1) show cmd.exe or PowerShell spawned by the web service account, and outbound connections from that account indicate command-and-control (C2) traffic. This multi-source correlation is essential to distinguish a web shell from legitimate administrative activity.

Answer

Only printer logs

Answer

Only the CEO's mailbox audit events

Answer

Only SSL certificate metadata

Question 15

A laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible?

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Option D is correct because proper chain of custody documentation is critical for evidence admissibility in legal proceedings. The responder must record who collected the evidence, the exact date and time, the physical location, cryptographic hash values (e.g., SHA-256) to verify integrity, transfer details (e.g., chain-of-custody forms), and the secure storage location. This ensures the evidence is not tampered with and can be defended in court.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title