CS0-003 Timed Practice Test 1 — 10 Questions

Question 1

After a major security incident, a post-incident review reveals that communication between the SOC and the network operations center (NOC) was slow and unclear. Which document should be updated to improve future incident response?

10 minute time limit — choose an answer to begin.

Accepted Answer

Incident response plan (IRP). The Incident Response Plan (IRP) is the primary document that outlines the phases of incident response, including the communication pathways, escalation procedures, and coordination protocols between internal teams (such as the SOC and NOC) and external stakeholders. When a post-incident review (lessons learned) identifies communication delays and lack of clarity between teams, the IRP must be updated to define clearer communication channels and responsibilities for future incidents.

Answer

Disaster recovery plan (DRP)

Answer

Communication management plan

Answer

Business continuity plan (BCP)

Question 2

Refer to the exhibit. An analyst reviews the output from a netstat command on a server. Which connection is MOST likely indicative of command and control (C2) activity?

Accepted Answer

10.0.0.5:54321 to 198.51.100.20:4444. The connection from a high ephemeral port (54321) on the server to an external IP (198.51.100.20) on port 4444 is a classic indicator of C2 activity. Port 4444 is commonly associated with Metasploit's default reverse shell listener and other malware frameworks, while the use of a non-standard high source port and an external destination suggests outbound beaconing or command reception.

Answer

10.0.0.5:22 to 10.0.0.1:50001

Answer

All connections are normal.

Answer

10.0.0.5:3389 to 192.168.1.10:54321

Question 3

A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?

Accepted Answer

Validate exploitability and rebuild from a patched base image where feasible. The best next step is to validate whether the vulnerable OpenSSL binary is actually reachable or exploitable in the running container, and then rebuild from a patched base image if feasible. This balances security with business priorities by avoiding unnecessary rebuilds for non-exploitable vulnerabilities while ensuring that truly exploitable CVEs are remediated. Simply ignoring or renaming the tag does not address the underlying risk and violates secure CI/CD practices.

Answer

Ignore all base-image vulnerabilities

Answer

Only rename the image tag

Answer

Ship the image and document nothing

Question 4

During a security incident, the SOC analyst determines that the attack is originating from an internal IP address belonging to the finance department. The incident response plan requires escalation to the appropriate team. Which of the following should the analyst contact first?

Accepted Answer

The system administrator for the finance department to isolate the host.. During an active security incident where an attack is originating from an internal host, the immediate priority under incident response frameworks (such as NIST SP 800-61) is containment. The SOC analyst should contact the system administrator responsible for the system to isolate the host and prevent lateral movement or further damage. Contacting a non-technical department manager to ask if an 'attack' is authorized is incorrect and delays critical containment actions.

Answer

The legal department to handle potential compliance issues.

Answer

The finance department manager to confirm if the activity is authorized.

Answer

The human resources department for disciplinary action.

Question 5

A security analyst is evaluating a Kubernetes cluster for misconfigurations. Which TWO of the following are common Kubernetes misconfigurations that increase security risk? (Select the two best answers.)

Accepted Answer

Using hostPath mounts. Option B (Using hostPath mounts) is correct because a hostPath volume mounts a file or directory directly from the node's filesystem into the pod, allowing a compromised container to read or write sensitive node paths such as /etc, /var/run/docker.sock, or kubelet credentials, which can lead to node takeover or cluster compromise. Option C (Using privileged containers) is correct because a privileged container runs with essentially all Linux capabilities and full access to host devices and kernel interfaces (equivalent to --privileged), disabling isolation and enabling container escape and host compromise. Option A is not a misconfiguration but a security best practice, since running as non-root reduces privilege. Option D is not a misconfiguration because enabling RBAC is a recommended access-control hardening measure. Option E is not a misconfiguration because network policies that restrict pod traffic reduce lateral movement and are a security best practice.

Answer

Running containers as non-root user

Answer

Enabling Role-Based Access Control (RBAC)

Answer

Implementing network policies to restrict traffic

Question 6

A company uses Lynis for compliance scanning on Linux servers. During a scan, Lynis reports that the system has world-writable files in critical directories. Which CIS Benchmark recommendation does this finding relate to?

Accepted Answer

Ensure no world-writable files exist. CIS Benchmarks include recommendations to restrict file permissions, such as ensuring no world-writable files exist in system directories.

Answer

Ensure system is configured to forward logs to a central server

Answer

Ensure permissions on /etc/shadow are configured

Answer

Ensure separate partition exists for /tmp

Question 7

Refer to the exhibit. An analyst sees this alert in the SIEM console: Suricata alert: ET MALWARE Ransomware activity detected from 10.0.0.5 to 10.0.0.1 over SMB. What is the best immediate action?

Accepted Answer

Isolate the source host 10.0.0.5 from the network.. The alert indicates active ransomware activity from an internal source host. The best immediate action is containment: isolate source host 10.0.0.5 from the network to prevent the malware from spreading. Updating a signature and running an antivirus scan are not immediate containment actions, and escalation should not delay containment once a high-severity active threat is confirmed.

Answer

Update the Suricata signature to block the traffic.

Answer

Run a full antivirus scan on destination host 10.0.0.1.

Answer

Escalate the alert to the incident response team.

Question 8

During a forensic investigation of a compromised Linux server, the analyst needs to acquire memory for analysis. The system is running and the analyst cannot power it off. Which tool is MOST appropriate for acquiring memory in this scenario?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a tool designed for acquiring memory from Linux systems while they are running, and it can be loaded as a kernel module without shutting down.

Answer

FTK Imager

Answer

WinPmem

Answer

dd

Question 9

During a network traffic analysis, a security analyst notices a high volume of DNS queries to a domain that is algorithmically generated. The domain names follow a random pattern and are not resolved to known IP addresses. Which technique is most likely being used?

Accepted Answer

Domain generation algorithm (DGA). Domain Generation Algorithms (DGAs) are commonly used by malware to generate a large number of potential C2 domain names to evade static blocklists.

Answer

DNS tunneling

Answer

Beaconing

Answer

HTTP smuggling

Question 10

You are a security analyst for a mid-sized financial services company. At 2:30 PM, the endpoint detection and response (EDR) console alerts on three workstations in the accounting department, indicating that files are being encrypted with a '.encrypt' extension and a ransom note named 'READ_ME_NOW.html' has been dropped. The workstations are connected to a file server that hosts shared financial records and a domain controller that handles authentication. The file server and domain controller have not shown signs of compromise yet. Your incident response plan states that containment must begin within 15 minutes of detection. Based on your analysis of the EDR telemetry, the encryption process appears to be spreading via SMB connections from the first infected workstation. Which of the following is the BEST immediate containment action to prevent further spread while preserving evidence?

Accepted Answer

Immediately isolate the three workstations by disconnecting their network cables at the patch panel or disabling their switch ports.. Immediately isolating the three infected workstations at the network level (disconnecting cables or disabling switch ports) stops the SMB-based encryption propagation without destroying volatile forensic data. This containment action preserves the running processes, memory, and disk state for later analysis, which would be lost if the systems were powered off. The 15-minute containment window makes network isolation the fastest and most effective method to halt lateral movement while maintaining evidence integrity.

Answer

Shut down the file server and domain controller to protect critical systems from potential encryption.

Answer

Power off the three infected workstations immediately to contain the encryption process.

Answer

Apply the latest SMB vulnerability patch to the file server and domain controller to block the propagation vector.