CS0-003 Multiple Select — 20 Questions

Question 1

A security analyst is evaluating a Kubernetes cluster for misconfigurations. Which TWO of the following are common Kubernetes misconfigurations that increase security risk? (Select the two best answers.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using hostPath mounts. Option B (Using hostPath mounts) is correct because a hostPath volume mounts a file or directory directly from the node's filesystem into the pod, allowing a compromised container to read or write sensitive node paths such as /etc, /var/run/docker.sock, or kubelet credentials, which can lead to node takeover or cluster compromise. Option C (Using privileged containers) is correct because a privileged container runs with essentially all Linux capabilities and full access to host devices and kernel interfaces (equivalent to --privileged), disabling isolation and enabling container escape and host compromise. Option A is not a misconfiguration but a security best practice, since running as non-root reduces privilege. Option D is not a misconfiguration because enabling RBAC is a recommended access-control hardening measure. Option E is not a misconfiguration because network policies that restrict pod traffic reduce lateral movement and are a security best practice.

Answer

Running containers as non-root user

Answer

Enabling Role-Based Access Control (RBAC)

Answer

Implementing network policies to restrict traffic

Question 2

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Accepted Answer

Financial impact. Business risk communication should focus on financial impact, reputational impact, and regulatory penalties as these resonate with business leaders. Technical impact is too detailed.

Answer

Operational impact

Answer

Technical impact

Question 3

A security analyst is reviewing alerts from an IDS. Which TWO indicators are most likely to suggest a successful command and control (C2) communication? (Choose two.)

Accepted Answer

A high volume of outbound traffic to an unusual destination IP on port 443. Option B is correct because sustained outbound traffic to an unusual external IP over port 443 is a classic C2 indicator: attackers frequently tunnel C2 over HTTPS (TCP 443) to blend with legitimate web traffic, and the destination being atypical for the environment raises suspicion. Option E is correct because regular beaconing to an external IP with consistent payload sizes reflects the periodic check-in pattern used by implants (e.g., fixed intervals with jitter and uniform packet sizes), which is a hallmark of established C2 channels. Option A does not belong because an inbound connection from a malicious IP to a mail server suggests scanning, exploitation, or spam relay activity rather than an internal host initiating C2. Option C does not belong because a single large upload to cloud storage is more indicative of data exfiltration than C2, and cloud storage is a legitimate service. Option D does not belong because a DNS query for a malicious domain indicates possible resolution or attempted contact, but a single query alone does not demonstrate the sustained, bidirectional communication characteristic of successful C2.

Answer

An inbound connection from a known malicious IP to the mail server

Answer

A single large file upload to a cloud storage service

Answer

An internal host performing a DNS query for a known malicious domain

Question 4

A root-cause analysis finds that an alert fired but was never triaged. Which corrective actions are useful? (Choose two.)

Accepted Answer

Define queue ownership and escalation thresholds. Defining queue ownership and escalation thresholds ensures that alerts are assigned to a specific team or individual and have a clear path for escalation if not acknowledged within a defined time. This directly addresses the root cause of the alert never being triaged by enforcing accountability and automated follow-up, which is a standard incident response practice per NIST SP 800-61.

Answer

Blame an individual without process review

Answer

Delete the alert rule because it was inconvenient

Question 5

A cloud security posture tool reports public access on object storage. Which follow-up checks matter? (Choose two.)

Accepted Answer

Whether sensitive objects were accessed or downloaded. The primary concern with public access to object storage is data exposure. Checking whether sensitive objects were accessed or downloaded determines if a breach actually occurred, which is a critical follow-up step in vulnerability management. Without this check, you cannot assess the real-world impact of the misconfiguration.

Answer

Whether the storage account name is short

Answer

Whether the administrator uses dark mode

Question 6

A security analyst suspects an insider threat based on unusual data access patterns by an employee. According to best practices, which TWO actions should the analyst take FIRST?

Accepted Answer

Restrict the employee's access to sensitive data.. Restricting the employee's access to sensitive data (A) is a correct first action because it immediately reduces the risk of further data exfiltration or damage while preserving the ability to investigate. Collecting additional evidence without alerting the employee (D) is also correct because it allows the analyst to build a forensic case covertly, preventing the insider from destroying evidence or altering behavior. Both actions align with the incident response principle of containment before eradication and the need to avoid tipping off a potential adversary.

Answer

Suspend the employee's accounts outright.

Answer

Immediately notify law enforcement.

Answer

Confront the employee about the behavior.

Question 7

After a data breach incident, a post-incident review team is collecting lessons learned. Which THREE items should be included in the lessons learned documentation?

Accepted Answer

Timeline of events during the incident. The timeline of events is a critical component of lessons learned documentation. It provides a chronological sequence of actions, detections, and responses during the incident, which is essential for identifying gaps in detection, delays in response, and opportunities for improvement. Without a precise timeline, the team cannot accurately assess the effectiveness of their incident response procedures or the speed of containment.

Answer

Individual performance evaluations of team members

Answer

Legal liability of the organization

Question 8

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Accepted Answer

Notify all affected data subjects without undue delay if high risk. GDPR requires notification to the supervisory authority within 72 hours, documentation of the breach, and notification to affected individuals if high risk.

Answer

Publish a public notice in the local newspaper

Answer

Notify law enforcement within 24 hours

Question 9

An analyst suspects DNS tunnelling but wants to avoid over-escalating normal CDN behaviour. Which comparisons help? (Choose two.)

Accepted Answer

Baseline query length, entropy, and subdomain uniqueness for the host. DNS tunnelling encodes non-DNS data (e.g., file exfiltration or C2 commands) into DNS queries, often producing abnormally long, high-entropy subdomains. Comparing current query length, entropy, and subdomain uniqueness against a baseline for the same host helps distinguish tunnelling from legitimate CDN traffic, which typically uses short, predictable subdomains. This approach focuses on the structural characteristics of the queries themselves, avoiding false positives from normal CDN behaviour.

Answer

Check whether the user likes the website

Answer

Count the number of icons on the desktop

Question 10

A vulnerability report is going to system owners. Which elements make it actionable? (Choose three.)

Accepted Answer

Affected assets and owners. Identifying affected assets and their owners is essential for accountability and remediation. Without this information, system owners cannot determine which systems require patching or configuration changes, making the report non-actionable. This aligns with the NIST SP 800-40 Rev. 4 guidance on vulnerability management, which emphasizes asset ownership as a prerequisite for response.

Answer

Only a generic statement that risk exists

Question 11

Which TWO methods help ensure the accuracy of security metrics reported to management?

Accepted Answer

Periodic validation of data against original logs. Periodic validation of security metrics against original logs (e.g., firewall logs, IDS/IPS alerts, or authentication logs) ensures data integrity by detecting discrepancies introduced during aggregation or transformation. This practice aligns with the principle of 'trust but verify,' where raw log sources serve as the authoritative baseline for metric accuracy, preventing reporting of corrupted or incomplete data.

Answer

Using colorful charts to impress stakeholders

Answer

Reporting only positive metrics to maintain confidence

Answer

Manual entry of data from multiple spreadsheets

Question 12

A Security Operations Center (SOC) analyst is tuning a SIEM rule to reduce false positives. Which three of the following are valid approaches to improve the signal-to-noise ratio of a detection rule? (Choose three.)

Accepted Answer

Adjusting the time window for event correlation to reduce overlapping alerts.. Adding a whitelist for known benign source IP addresses or user accounts is a valid approach because it directly reduces false positives by excluding traffic that is known to be safe from triggering the rule. This improves the signal-to-noise ratio by ensuring that only truly suspicious activity generates alerts, without altering the detection logic itself.

Answer

Removing the rule entirely to eliminate all associated noise.

Answer

Increasing the severity level of the alert to ensure faster response.

Answer

Adding additional event sources to broaden the scope of detection.

Question 13

A SOC is onboarding endpoint logs into a SIEM. Which fields are most important for process-chain investigations? (Choose three.)

Accepted Answer

Parent process name and command line. Parent process name and command line are critical for process-chain investigations because they establish the lineage of an execution event. In a SIEM, these fields allow analysts to trace how a process was spawned, identifying whether it originated from a legitimate application (e.g., explorer.exe) or a suspicious parent (e.g., wscript.exe launching cmd.exe). Without this context, it is impossible to reconstruct the attack kill chain from initial execution to lateral movement or privilege escalation.

Answer

Monitor refresh rate

Question 14

A SIEM receives endpoint, firewall, identity, and cloud logs for the same incident, but timestamps do not align across sources. Which actions should the analyst take before finalizing the timeline? (Choose two.)

Accepted Answer

Verify time synchronization and timezone parsing for each source. Without verifying time synchronization (e.g., NTP configuration) and timezone parsing for each log source, the analyst cannot trust the chronological order of events. A SIEM relies on accurate timestamps to correlate logs from endpoints, firewalls, identity systems, and cloud platforms; misaligned timestamps can lead to incorrect incident reconstruction.

Answer

Assume the latest arriving event happened last

Answer

Discard every source except the firewall

Question 15

Which items belong in a vulnerability exception request? (Choose three.)

Accepted Answer

Business justification for delayed remediation. A vulnerability exception request is a formal process to accept the risk of not remediating a vulnerability within the standard timeframe. A business justification for delayed remediation is a core component because it documents the operational, financial, or technical reasons why the fix cannot be applied immediately, which is required for risk acceptance by management. Without this justification, the exception lacks the necessary context for approval and audit compliance.

Answer

A request to remove the asset from inventory

Question 16

A regulator asks for incident evidence after a data exposure. Which items should be coordinated before disclosure? (Choose two.)

Accepted Answer

Evidence package with timeline, scope, and affected data categories. A coordinated evidence package ensures that the disclosure to the regulator includes a verified timeline, scope, and affected data categories, which is essential for demonstrating due diligence and compliance with breach notification laws. Without this coordination, the evidence may be incomplete or inconsistent, potentially leading to regulatory penalties or loss of trust.

Answer

Unreviewed analyst speculation

Answer

Passwords for all production systems

Question 17

A remediation report shows repeated SLA breaches by one business unit. Which recommendations are appropriate? (Choose two.)

Accepted Answer

Review ownership, resourcing, and change-window constraints. Reviewing ownership, resourcing, and change-window constraints directly addresses the root causes of repeated SLA breaches. SLA breaches often stem from inadequate staffing, misaligned change windows, or unclear ownership of remediation tasks, not from technical failures alone. This recommendation aligns with the reporting and communication domain's emphasis on actionable, root-cause analysis rather than superficial fixes.

Answer

Automatically accept all future risk permanently

Answer

Hide the business unit from future reports

Question 18

Which items help make a post-incident report useful for technical teams? (Choose two.)

Accepted Answer

Root cause and exploited control gaps. A post-incident report must include the root cause and exploited control gaps to enable technical teams to implement targeted remediation. Without identifying the specific vulnerability (e.g., unpatched CVE, misconfigured firewall rule, weak authentication mechanism) and the control failure that allowed the exploit, the report lacks actionable intelligence for hardening defenses.

Answer

Generic motivational slogans

Answer

Unrelated financial forecasts

Question 19

An application has a high CVSS vulnerability, but a WAF rule blocks known exploit payloads. What should the team still do? (Choose two.)

Accepted Answer

Validate the WAF rule against bypass and false-positive risk. A WAF rule blocking known exploit payloads does not guarantee complete protection, as attackers can craft bypass techniques such as encoding, parameter pollution, or using different HTTP methods. Validating the rule against bypass and false-positive risks ensures the WAF is effective without disrupting legitimate traffic, which is critical for maintaining both security and availability.

Answer

Remove the application from vulnerability scans

Answer

Mark the vulnerability as permanently remediated

Question 20

When briefing legal and privacy teams after a suspected data exposure, which details matter? (Choose two.)

Accepted Answer

Data types and jurisdictions potentially affected. Data types (e.g., PII, PHI, PCI) and affected jurisdictions determine legal notification obligations under regulations like GDPR, HIPAA, or CCPA. Jurisdictions dictate breach notification timelines and penalties, making this information critical for legal and privacy teams to assess risk and compliance. Without this detail, the response cannot be properly scoped or legally defensible.

Answer

A complete list of unrelated server patches

Answer

Speculation about attacker identity without evidence