CS0-003 Timed Practice Test 1 — 10 Questions

Question 1

A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?

10 minute time limit — choose an answer to begin.

Accepted Answer

Exclude failed logins from known service accounts. Aggregating alerts by source IP reduces noise; excluding known service accounts eliminates expected failures.

Answer

Disable the rule entirely

Answer

Increase the alert severity to critical for all failed logins

Answer

Add a correlation rule to trigger on successful login after multiple failures

Question 2

An organization uses MISP (Malware Information Sharing Platform) to share threat intelligence with trusted partners. Which of the following standards is commonly used by MISP to structure and exchange threat intelligence data?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Indicator Information) are standards for exchanging cyber threat intelligence. MISP supports STIX and TAXII for sharing.

Answer

NetFlow

Answer

SNMP

Answer

Syslog

Question 3

You are a security analyst for a mid-sized financial services company. At 2:30 PM, the endpoint detection and response (EDR) console alerts on three workstations in the accounting department, indicating that files are being encrypted with a '.encrypt' extension and a ransom note named 'READ_ME_NOW.html' has been dropped. The workstations are connected to a file server that hosts shared financial records and a domain controller that handles authentication. The file server and domain controller have not shown signs of compromise yet. Your incident response plan states that containment must begin within 15 minutes of detection. Based on your analysis of the EDR telemetry, the encryption process appears to be spreading via SMB connections from the first infected workstation. Which of the following is the BEST immediate containment action to prevent further spread while preserving evidence?

Accepted Answer

Immediately isolate the three workstations by disconnecting their network cables at the patch panel or disabling their switch ports.. Immediately isolating the three infected workstations at the network level (disconnecting cables or disabling switch ports) stops the SMB-based encryption propagation without destroying volatile forensic data. This containment action preserves the running processes, memory, and disk state for later analysis, which would be lost if the systems were powered off. The 15-minute containment window makes network isolation the fastest and most effective method to halt lateral movement while maintaining evidence integrity.

Answer

Shut down the file server and domain controller to protect critical systems from potential encryption.

Answer

Power off the three infected workstations immediately to contain the encryption process.

Answer

Apply the latest SMB vulnerability patch to the file server and domain controller to block the propagation vector.

Question 4

A security analyst is conducting a vulnerability assessment of a Kubernetes cluster. Which TWO of the following are common misconfigurations that could lead to security risks? (Select TWO.)

Accepted Answer

Running containers in privileged mode. Privileged containers and hostPath mounts are common Kubernetes misconfigurations that can lead to container breakout and host access.

Answer

Setting resource limits on containers

Answer

Configuring network policies to restrict traffic

Answer

Using read-only root filesystems

Question 5

A threat hunter is analyzing network traffic and observes a system making outbound connections to multiple IP addresses on port 53 (DNS) with unusually large payload sizes. The hunter suspects DNS tunneling. Which THREE characteristics are indicative of DNS tunneling?

Accepted Answer

Large DNS payload sizes. DNS tunneling often involves large payloads, high query volume to a single domain, and non-standard record types to encode data.

Answer

DNS responses with NXDOMAIN for most queries

Answer

Use of standard A record queries

Question 6

An analyst is creating a detection rule for lateral movement using SMB. Which two network indicators should be included in the rule? (Choose two.)

Accepted Answer

SMB traffic between workstations. Lateral movement over SMB often involves file writes to admin shares (IPC$) and unusual SMB traffic patterns.

Answer

Repeated failed logins to multiple hosts

Answer

High volume of DNS queries

Answer

Unusual outbound connections on port 443

Question 7

A threat hunter is reviewing endpoint telemetry and sees a process 'svchost.exe' spawning 'cmd.exe', which then executes 'reg.exe add' to create a Run key. The hunter suspects persistence. Which TWO artifacts should the hunter examine to confirm persistence?

Accepted Answer

Registry Run keys. Run keys are stored in the registry, and scheduled tasks can also be created via command line. Examining these confirms persistence.

Answer

Windows Event Logs for service creation

Answer

Browser history

Answer

Network connections

Question 8

A security analyst is reviewing the results of a web application vulnerability scan and needs to identify the vulnerabilities that are part of the OWASP Top 10 (2021) category 'Injection'. Which THREE of the following vulnerabilities fall under this category? (Select THREE.)

Accepted Answer

SQL injection. SQL injection, Cross-Site Scripting (XSS), and OS command injection are all types of injection flaws. XXE is also injection, but it is often listed separately; however, in OWASP Top 10 2021, Injection includes XSS, SQL injection, etc. Broken access control is a separate category.

Answer

Broken Access Control

Answer

Security Misconfiguration

Question 9

A security analyst is creating a Sigma rule to detect use of the LOLBin 'certutil' for downloading payloads. Which THREE command-line arguments should the rule look for to indicate malicious use?

Accepted Answer

-urlcache. Certutil can be abused to download files using the '-urlcache' and '-split' arguments (or '-f' for force). The combination of '-urlcache' with a URL and output file is typical for downloading malicious payloads. '-verify' is legitimate, '-encode' and '-decode' are used for encoding/decoding, but '-urlcache' and '-split' are key for download.

Answer

-encode

Answer

-verify

Question 10

A security analyst is setting up a vulnerability management program and needs to select tools for container image scanning. Which THREE of the following are commonly used container image scanning tools? (Select THREE.)

Accepted Answer

Snyk. Trivy, Clair, and Snyk are well-known container image scanning tools. OpenVAS is a network vulnerability scanner, and Burp Suite is for web application testing.

Answer

OpenVAS

Answer

Burp Suite