CS0-003 Timed Practice Test 2 — 10 Questions

Question 1

A cybersecurity analyst is reviewing the configuration of a Linux server against CIS Benchmarks. The analyst notices that several settings deviate from the recommended baseline. Which TWO of the following are most likely to be considered Level 1 CIS Benchmark recommendations?

10 minute time limit — choose an answer to begin.

Accepted Answer

Set password expiration to 90 days. CIS Level 1 recommendations are basic security settings that do not cause significant operational impact. Setting password expiration and disabling root SSH login are common Level 1 items.

Answer

Remove all unnecessary packages and services

Answer

Enable mandatory access control (SELinux) in enforcing mode

Answer

Configure audit rules for file permission changes

Question 2

An incident response team is conducting post-incident activities after a ransomware attack. The team wants to improve detection and response for future incidents. Which TWO actions are most appropriate for updating detection rules? (Select TWO.)

Accepted Answer

Create YARA rules to identify the ransomware file hashes and patterns.. Updating SIEM correlation rules based on the attack TTPs and creating YARA rules for the ransomware family will enhance detection of similar threats.

Answer

Conduct a tabletop exercise for the incident response team.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with external threat intelligence platforms.

Question 3

A security analyst is configuring a container scanning tool to identify vulnerabilities in Docker images before deployment. Which of the following tools is specifically designed for container image vulnerability scanning?

Accepted Answer

Trivy. Trivy is an open-source vulnerability scanner for container images, filesystems, and Git repositories.

Answer

Burp Suite

Answer

Nessus

Answer

OpenVAS

Question 4

After a ransomware incident, the incident report includes lessons learned. Which of the following is the BEST example of a lesson learned?

Accepted Answer

Implement multi-factor authentication for remote access to reduce risk.. Lessons learned should be actionable recommendations to prevent recurrence.

Answer

The ransomware encrypted 500 files.

Answer

The incident started at 2:00 AM.

Answer

The root cause was a phishing email.

Question 5

A security analyst is communicating a complex security risk about a new zero-day vulnerability to the board of directors. The board members have varying technical backgrounds. Which approach would be MOST effective?

Accepted Answer

Describe the potential financial loss, reputational damage, and regulatory fines. Translating technical risk to business impact (financial, reputational, regulatory) is key for non-technical stakeholders.

Answer

Provide a list of all current vulnerabilities

Answer

Present the CVSS score and affected systems

Answer

Explain the technical details of the exploit chain

Question 6

An organization is preparing for a compliance audit. Which TWO of the following are essential pieces of evidence to demonstrate effective vulnerability management?

Accepted Answer

Vulnerability scan reports. Vulnerability scan reports show identified vulnerabilities, and patch management reports show remediation efforts, together demonstrating the vulnerability management lifecycle.

Answer

Network topology diagrams

Answer

Employee training logs

Answer

Incident response playbooks

Question 7

During a security incident involving a potential data breach, the CISO asks you to prepare a communication for the board of directors. What is the MOST important aspect to emphasize in this communication?

Accepted Answer

The financial impact, reputational risk, and potential regulatory penalties. Board members are non-technical stakeholders who need to understand the business impact. The communication should translate technical details into financial, reputational, and regulatory consequences.

Answer

The specific malware used and its technical attributes

Answer

The names of the IT staff who first detected the incident

Answer

A step-by-step timeline of the incident response actions taken so far

Question 8

A security analyst is investigating a potential insider threat where a user is suspected of exfiltrating sensitive data via USB drives. The analyst needs to gather evidence while preserving the chain of custody. Which THREE actions should the analyst perform? (Choose THREE.)

Accepted Answer

Creating a forensic image of the USB drive using a write blocker. Forensic sound procedures include imaging the drive, hashing to verify integrity, and documenting the chain of custody. Disabling the account is containment, and interviewing is not part of evidence collection.

Answer

Disabling the user's network account immediately

Answer

Interviewing the user about their activities

Question 9

Refer to the exhibit. A security analyst is reviewing SIEM logs and notices repeated entries from the same source IP. Which of the following actions should the analyst take NEXT?

Accepted Answer

Check the baseline behavior of the source IP. The first step in incident response is to validate whether the activity is malicious by comparing it against a known baseline. Repeated entries from the same source IP could indicate a benign automated process (e.g., a legitimate monitoring tool or scheduled scan) rather than an attack. Checking the baseline behavior prevents unnecessary disruption and aligns with the NIST SP 800-61 incident response framework's emphasis on identification and analysis before containment.

Answer

Immediately block the source IP at the firewall

Answer

Update the signature database

Answer

Isolate the affected system for forensic analysis

Question 10

A cybersecurity analyst is presenting risk findings to the board of directors. Which THREE types of impact should be emphasized to effectively communicate business risk? (Select THREE.)

Accepted Answer

Financial impact. Business risk communication should focus on financial impact, reputational impact, and regulatory penalties as these resonate with business leaders. Technical impact is too detailed.

Answer

Operational impact

Answer

Technical impact