CS0-003 Timed Practice Test 1 — 10 Questions

Question 1

A SOC wants to reduce alert fatigue without missing confirmed malicious activity. Which actions are appropriate? (Choose two.)

Accepted Answer

Suppress alerts only with documented criteria and expiry. Option A is correct because suppressing alerts based on documented criteria (e.g., known false-positive signatures, scheduled maintenance windows) with an expiry date ensures that the suppression is temporary and reviewed periodically. This reduces alert fatigue while maintaining visibility into potential threats, as expired suppressions automatically re-enable alerting. Without an expiry, a suppression could inadvertently hide malicious activity that later matches the same criteria.

Answer

Delete noisy detections permanently without review

Answer

Route every alert directly to executives

Question 2

A host is suspected of running fileless malware. Which artefacts should be collected quickly? (Choose two.)

Accepted Answer

Memory image or live response data. Fileless malware operates in memory without writing to disk, so capturing a memory image or live response data preserves the malicious code, injected DLLs, and process hollowing artifacts that would vanish on reboot. Active network connections and running processes reveal the malware's C2 communications and its in-memory execution context, which are critical for identifying the infection vector and scope.

Answer

A list of cafeteria purchases

Answer

A printed office map

Question 3

A critical vulnerability affected the customer portal, but no evidence of exploitation was found. What should the executive summary emphasize? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Business risk, customer impact assessment, remediation status, and remaining exposure. Option D is correct because executive leadership requires a high-level summary that translates technical findings into business impact. The executive summary should focus on business risk, customer impact assessment, remediation status, and remaining exposure, as these directly inform strategic decisions without overwhelming non-technical stakeholders with raw data.

Answer

Raw packet captures from the scan

Answer

A list of analyst shift times only

Answer

Every command the scanner executed

Question 4

A host alert shows certutil.exe downloading a file from an external URL, followed by execution from a user-writable directory. What should the analyst focus on? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Living-off-the-land binary misuse and the downloaded file's hash, origin, and child process. Option D is correct because certutil.exe is a known living-off-the-land binary (LOLBin) that attackers abuse to download payloads, bypassing application whitelisting. The analyst must focus on the downloaded file's hash (to check reputation), origin URL (to assess maliciousness), and child process (to trace execution), as these provide direct evidence of malicious intent or compromise.

Answer

Only check whether antivirus signatures are current

Answer

Reinstall the browser used by the user

Answer

Ignore it because certutil is signed by Microsoft

Question 5

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Network-isolating the endpoint via EDR (e.g., using a built-in quarantine feature) stops the beaconing to the malicious IP and halts credential dumping while preserving disk and memory evidence for forensic analysis. This is the best containment action because it balances incident response needs (stopping active compromise) with evidence preservation, which is critical for legal or regulatory follow-up. Powering off or deleting files would destroy volatile memory evidence and potentially violate chain-of-custody requirements.

Answer

Run disk cleanup to remove temporary files

Answer

Power off the machine immediately in every case

Answer

Allow the host to run until the next maintenance window

Question 6

A vulnerability report has 900 findings. One medium CVSS vulnerability is listed in CISA KEV and has high EPSS; several high CVSS issues are not exploitable in the environment. What should the analyst recommend? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Prioritize the KEV/high-EPSS issue after confirming asset exposure. Option D is correct because the CISA Known Exploited Vulnerabilities (KEV) catalog combined with a high Exploit Prediction Scoring System (EPSS) score indicates active exploitation in the wild, which is a higher priority than static CVSS base scores. The analyst must first confirm that the asset is exposed in the environment before recommending remediation, as a vulnerability that is not exploitable due to compensating controls or network segmentation should not be prioritized. This approach aligns with the NIST SP 800-40 risk-based prioritization framework, which emphasizes threat intelligence over severity alone.

Answer

Remediate only vulnerabilities with vendor logos in the report

Answer

Always sort only by CVSS base score

Answer

Remediate alphabetically by CVE ID

Question 7

A laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible?

Accepted Answer

Who collected it, when, where, hash values, transfer details, and storage location. Option D is correct because proper chain of custody documentation is critical for evidence admissibility in legal proceedings. The responder must record who collected the evidence, the exact date and time, the physical location, cryptographic hash values (e.g., SHA-256) to verify integrity, transfer details (e.g., chain-of-custody forms), and the secure storage location. This ensures the evidence is not tampered with and can be defended in court.

Answer

Only the laptop colour

Answer

Only the ticket priority

Answer

Only the user's job title

Question 8

A vulnerability programme wants to show whether critical findings are fixed within policy timelines. Which report is best? If the primary audience is technical remediation owner, which content choice is most appropriate?

Accepted Answer

SLA compliance by severity, asset owner, and business unit. Option A is correct because an SLA compliance report by severity, asset owner, and business unit directly maps to the goal of showing whether critical findings are fixed within policy timelines. This report filters by severity (e.g., critical), includes remediation deadlines (SLA), and groups by asset owner and business unit, enabling technical remediation owners to track overdue items and prioritize fixes. It aligns with the NIST SP 800-55 framework for measuring security effectiveness through compliance metrics.

Answer

A list of all closed tickets with no dates

Answer

A vendor price comparison

Answer

A report sorted only by scanner plugin ID

Question 9

After a high-priority SOC escalation, file shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action? During containment, which decision is most defensible? which response best matches incident-response practice?

Accepted Answer

Isolate the workstation and disable its active sessions to file servers. Option D is correct because the immediate priority in a ransomware incident is to contain the threat by isolating the infected workstation from the network to prevent further encryption of file shares. Disabling active sessions to file servers (e.g., using SMB session termination or firewall rules) stops the lateral movement and encryption of shared data. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the spread before any other action.

Answer

Run vulnerability scans on every subnet first

Answer

Restore backups before isolating the host

Answer

Email all users the ransom note

Question 10

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. Option D is correct because the SIEM alert describes a workstation requesting a high number of Kerberos service tickets for many Service Principal Names (SPNs) without subsequent service access. This is classic Kerberoasting reconnaissance: the attacker uses a valid domain account to request TGS tickets for services, then extracts and cracks the service account passwords offline. The lack of corresponding service access confirms the tickets were not used for legitimate authentication.

Answer

DNS cache poisoning

Answer

ARP spoofing

Answer

Pass-the-hash using NTLM only