CS0-003 Multiple Select — 60 Questions

Question 1

A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exclude failed logins from known service accounts. Aggregating alerts by source IP reduces noise; excluding known service accounts eliminates expected failures.

Answer

Disable the rule entirely

Answer

Increase the alert severity to critical for all failed logins

Answer

Add a correlation rule to trigger on successful login after multiple failures

Question 2

A security analyst is conducting a vulnerability assessment of a Kubernetes cluster. Which TWO of the following are common misconfigurations that could lead to security risks? (Select TWO.)

Accepted Answer

Running containers in privileged mode. Privileged containers and hostPath mounts are common Kubernetes misconfigurations that can lead to container breakout and host access.

Answer

Setting resource limits on containers

Answer

Configuring network policies to restrict traffic

Answer

Using read-only root filesystems

Question 3

A threat hunter is analyzing network traffic and observes a system making outbound connections to multiple IP addresses on port 53 (DNS) with unusually large payload sizes. The hunter suspects DNS tunneling. Which THREE characteristics are indicative of DNS tunneling?

Accepted Answer

Large DNS payload sizes. DNS tunneling often involves large payloads, high query volume to a single domain, and non-standard record types to encode data.

Answer

DNS responses with NXDOMAIN for most queries

Answer

Use of standard A record queries

Question 4

An analyst is creating a detection rule for lateral movement using SMB. Which two network indicators should be included in the rule? (Choose two.)

Accepted Answer

SMB traffic between workstations. Lateral movement over SMB often involves file writes to admin shares (IPC$) and unusual SMB traffic patterns.

Answer

Repeated failed logins to multiple hosts

Answer

High volume of DNS queries

Answer

Unusual outbound connections on port 443

Question 5

A threat hunter is reviewing endpoint telemetry and sees a process 'svchost.exe' spawning 'cmd.exe', which then executes 'reg.exe add' to create a Run key. The hunter suspects persistence. Which TWO artifacts should the hunter examine to confirm persistence?

Accepted Answer

Registry Run keys. Run keys are stored in the registry, and scheduled tasks can also be created via command line. Examining these confirms persistence.

Answer

Windows Event Logs for service creation

Answer

Browser history

Answer

Network connections

Question 6

A security analyst is reviewing the results of a web application vulnerability scan and needs to identify the vulnerabilities that are part of the OWASP Top 10 (2021) category 'Injection'. Which THREE of the following vulnerabilities fall under this category? (Select THREE.)

Accepted Answer

SQL injection. SQL injection, Cross-Site Scripting (XSS), and OS command injection are all types of injection flaws. XXE is also injection, but it is often listed separately; however, in OWASP Top 10 2021, Injection includes XSS, SQL injection, etc. Broken access control is a separate category.

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 7

A security analyst is creating a Sigma rule to detect use of the LOLBin 'certutil' for downloading payloads. Which THREE command-line arguments should the rule look for to indicate malicious use?

Accepted Answer

-urlcache. Certutil can be abused to download files using the '-urlcache' and '-split' arguments (or '-f' for force). The combination of '-urlcache' with a URL and output file is typical for downloading malicious payloads. '-verify' is legitimate, '-encode' and '-decode' are used for encoding/decoding, but '-urlcache' and '-split' are key for download.

Answer

-encode

Answer

-verify

Question 8

A security analyst is setting up a vulnerability management program and needs to select tools for container image scanning. Which THREE of the following are commonly used container image scanning tools? (Select THREE.)

Accepted Answer

Snyk. Trivy, Clair, and Snyk are well-known container image scanning tools. OpenVAS is a network vulnerability scanner, and Burp Suite is for web application testing.

Answer

OpenVAS

Answer

Burp Suite

Question 9

A cybersecurity analyst is reviewing the configuration of a Linux server against CIS Benchmarks. The analyst notices that several settings deviate from the recommended baseline. Which TWO of the following are most likely to be considered Level 1 CIS Benchmark recommendations?

Accepted Answer

Set password expiration to 90 days. CIS Level 1 recommendations are basic security settings that do not cause significant operational impact. Setting password expiration and disabling root SSH login are common Level 1 items.

Answer

Remove all unnecessary packages and services

Answer

Enable mandatory access control (SELinux) in enforcing mode

Answer

Configure audit rules for file permission changes

Question 10

An incident response team is conducting post-incident activities after a ransomware attack. The team wants to improve detection and response for future incidents. Which TWO actions are most appropriate for updating detection rules? (Select TWO.)

Accepted Answer

Create YARA rules to identify the ransomware file hashes and patterns.. Updating SIEM correlation rules based on the attack TTPs and creating YARA rules for the ransomware family will enhance detection of similar threats.

Answer

Conduct a tabletop exercise for the incident response team.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with external threat intelligence platforms.

Question 11

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Accepted Answer

Vulnerability scan reports. Vulnerability scan reports show identified vulnerabilities, and patch management reports show remediation efforts, together demonstrating the vulnerability management lifecycle.

Answer

Network topology diagrams

Answer

Employee training logs

Answer

Incident response playbooks

Question 12

A security analyst is investigating a potential insider threat where a user is suspected of exfiltrating sensitive data via USB drives. The analyst needs to gather evidence while preserving the chain of custody. Which THREE actions should the analyst perform? (Choose THREE.)

Accepted Answer

Creating a forensic image of the USB drive using a write blocker. Forensic sound procedures include imaging the drive, hashing to verify integrity, and documenting the chain of custody. Disabling the account is containment, and interviewing is not part of evidence collection.

Answer

Disabling the user's network account immediately

Answer

Interviewing the user about their activities

Question 13

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Accepted Answer

Financial impact. Business risk communication should focus on financial impact, reputational impact, and regulatory penalties as these resonate with business leaders. Technical impact is too detailed.

Answer

Operational impact

Answer

Technical impact

Question 14

A cloud security posture tool reports public access on object storage. Which follow-up checks matter? (Choose two.)

Accepted Answer

Whether sensitive objects were accessed or downloaded. The primary concern with public access to object storage is data exposure. Checking whether sensitive objects were accessed or downloaded determines if a breach actually occurred, which is a critical follow-up step in vulnerability management. Without this check, you cannot assess the real-world impact of the misconfiguration.

Answer

Whether the storage account name is short

Answer

Whether the administrator uses dark mode

Question 15

A security analyst suspects an insider threat based on unusual data access patterns by an employee. According to best practices, which TWO actions should the analyst take FIRST?

Accepted Answer

Restrict the employee's access to sensitive data.. Restricting the employee's access to sensitive data (A) is a correct first action because it immediately reduces the risk of further data exfiltration or damage while preserving the ability to investigate. Collecting additional evidence without alerting the employee (D) is also correct because it allows the analyst to build a forensic case covertly, preventing the insider from destroying evidence or altering behavior. Both actions align with the incident response principle of containment before eradication and the need to avoid tipping off a potential adversary.

Answer

Suspend the employee's accounts outright.

Answer

Immediately notify law enforcement.

Answer

Confront the employee about the behavior.

Question 16

After a data breach incident, a post-incident review team is collecting lessons learned. Which THREE items should be included in the lessons learned documentation?

Accepted Answer

Timeline of events during the incident. The timeline of events is a critical component of lessons learned documentation. It provides a chronological sequence of actions, detections, and responses during the incident, which is essential for identifying gaps in detection, delays in response, and opportunities for improvement. Without a precise timeline, the team cannot accurately assess the effectiveness of their incident response procedures or the speed of containment.

Answer

Individual performance evaluations of team members

Answer

Legal liability of the organization

Question 17

An organization has experienced a data breach involving personal information of EU residents. The incident response team is preparing communications. Which THREE of the following are mandatory actions under GDPR? (Select THREE.)

Accepted Answer

Notify all affected data subjects without undue delay if high risk. GDPR requires notification to the supervisory authority within 72 hours, documentation of the breach, and notification to affected individuals if high risk.

Answer

Publish a public notice in the local newspaper

Answer

Notify law enforcement within 24 hours

Question 18

A vulnerability manager wants accurate Linux package findings. Which scan conditions are important? (Choose two.)

Accepted Answer

Authenticated access to inspect installed packages. For accurate Linux package findings, the vulnerability scanner must have authenticated access (e.g., via SSH with valid credentials) to inspect installed packages directly from the package manager database (e.g., RPM or dpkg). Without authentication, the scanner can only perform unauthenticated network-based checks, which cannot reliably determine installed software versions or patch levels. Authenticated access ensures the scanner can execute commands like 'rpm -qa' or 'dpkg -l' to enumerate packages with high accuracy.

Answer

Only scanning ICMP echo replies

Answer

Changing server hostnames randomly

Question 19

An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)

Accepted Answer

Isolating affected systems from the network by disabling their network interfaces.. Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.

Answer

Notifying law enforcement agencies about the incident.

Answer

Identifying and patching the vulnerability exploited by the malware.

Answer

Creating a forensic image of the infected systems for later analysis.

Question 20

A security analyst is preparing a vulnerability report for management. Which TWO elements should be included in the executive summary? (Select TWO.)

Accepted Answer

Overall risk posture summary. The executive summary should provide a high-level overview, including the overall risk posture and key findings that require management attention. Detailed technical descriptions are better left for the main body.

Answer

Raw CVSS scores for all vulnerabilities

Answer

Detailed technical description of each vulnerability

Answer

Network topology diagrams