CS0-003 Timed Practice Test 2 — 10 Questions

Question 1

A security analyst at a small company notices that several workstations in the finance department are communicating with an external IP address known to be associated with a command-and-control server. The analyst checks the host-based firewall logs and sees that outbound connections to that IP are allowed. Which of the following is the BEST immediate action to take?

10 minute time limit — choose an answer to begin.

Accepted Answer

Disconnect the workstations from the network.. Disconnecting the workstations from the network immediately stops the active command-and-control communication and prevents further data exfiltration or lateral movement, which is the priority during a suspected active compromise. Containment precedes remediation, so isolating the hosts is the correct first action before blocking IPs, updating signatures, or scanning. This preserves the ability to perform forensics while halting the threat.

Answer

Block the IP at the perimeter firewall.

Answer

Update the antivirus definitions.

Answer

Run a full antivirus scan on the affected workstations.

Question 2

During a security incident, which of the following should be the FIRST communication to internal stakeholders?

Accepted Answer

Internal escalation to the incident response team. The first communication during a security incident must be the internal escalation to the incident response team, as this triggers the formal incident response process. The IR team is responsible for assessing the scope, containing the threat, and coordinating all subsequent actions, including any external notifications. Without this initial escalation, no coordinated response can occur, and other communications (legal, PR, risk) would lack the necessary technical context. This aligns with the preparation and identification phases of the incident response lifecycle (e.g., NIST SP 800-61).

Answer

Notification to law enforcement

Answer

Press release to customers

Answer

Update to the risk register

Question 3

An incident responder is collecting evidence from a compromised Linux server. The server is still running. Which order of collection adheres to the order of volatility?

Accepted Answer

Memory → network connections → swap space → disk.. The order of volatility (OOV) dictates that the most volatile data (memory/registers) must be collected first, followed by network connections, then swap space, and finally disk. Memory contains running processes and encryption keys that vanish on power loss; network connections change rapidly; swap space persists longer but is still more volatile than disk. This sequence ensures maximum preservation of ephemeral evidence before it is lost.

Answer

Memory → network connections → disk → swap space.

Answer

Disk → memory → network connections → swap space.

Answer

Network connections → memory → disk → swap space.

Question 4

A threat hunter is analyzing EDR telemetry and discovers that the process svchost.exe spawned a child process powershell.exe. The powershell.exe then established a network connection to an external IP address. Which of the following best describes this behavior in the context of threat hunting?

Accepted Answer

Living off the land binary (LOLBin) usage. The behavior described — svchost.exe spawning powershell.exe, which then makes an outbound network connection — is a classic example of a Living off the Land Binary (LOLBin) attack. LOLBins are legitimate, signed Windows executables (like PowerShell, certutil, mshta, regsvr32) that adversaries abuse to blend malicious activity into normal system noise, evading signature-based detection. Because svchost.exe is a trusted system process, its child processes are often overlooked by naive detection rules, making this pattern a high-fidelity threat-hunting indicator.

Answer

A Windows update process

Answer

Normal administrative activity

Answer

A false positive from EDR

Question 5

A security analyst is triaging an alert from the EDR that shows the process 'powershell.exe' with a parent process of 'winword.exe'. The user recently opened a document from an email. What is the most likely explanation?

Accepted Answer

The document contains a malicious macro that spawned PowerShell to execute commands. When winword.exe (Microsoft Word) is the parent of powershell.exe, it almost always indicates a malicious macro in the document spawned a shell to execute commands. This parent-child relationship is a classic indicator of macro-based malware delivery, especially when the document arrived via email and the user opened it. Legitimate Word documents rarely spawn PowerShell directly.

Answer

The user double-clicked a PowerShell script attached to the email

Answer

A scheduled task started PowerShell that initiated Word

Answer

The user is running a legitimate PowerShell script from within a Word document

Question 6

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF that blocks the attack vector. The system owner states the vulnerability is not exploitable due to the compensating control. Which of the following is the best next step?

Accepted Answer

Document the finding and accept the risk with the compensating control. The best next step is to document the finding and accept the risk with the compensating control because the WAF blocks the attack vector, making the vulnerability not exploitable. This aligns with risk management principles: compensating controls can reduce risk to an acceptable level, and acceptance should be documented.

Answer

Re-run the scan with a non-credentialed profile

Answer

Ignore the vulnerability and close the finding

Answer

Immediately patch the server during business hours

Question 7

A threat intelligence report indicates that a known APT group is using 'regsvr32.exe' to execute malicious code. Which detection rule type would be most effective in identifying this technique across multiple endpoints?

Accepted Answer

Sigma rule. Sigma is a generic, open signature format for log-based detection rules that can be converted to multiple SIEM query languages (Splunk, Elastic, Sentinel, etc.). Because the question asks for a rule type effective across multiple endpoints and the technique involves process execution (regsvr32.exe), a Sigma rule targeting process creation events is the most portable and effective choice. It can be deployed across heterogeneous endpoint detection platforms.

Answer

Snort rule

Answer

YARA rule

Answer

Suricata rule

Question 8

During a threat hunting exercise, a hunter creates a hypothesis that a threat actor is using PowerShell to download payloads from a remote server. Which ATT&CK technique is the hunter most likely investigating?

Accepted Answer

T1105 - Ingress Tool Transfer. T1105 (Ingress Tool Transfer) covers the adversary transferring tools or payloads into the victim environment from an external system, including via PowerShell downloads. The hypothesis — PowerShell downloading payloads from a remote server — maps directly to the transfer of a tool into the environment. T1059.001 describes PowerShell execution itself, but the specific behavior of pulling a payload in is T1105.

Answer

T1047 - Windows Management Instrumentation

Answer

T1071.001 - Web Protocols

Answer

T1059.001 - PowerShell

Question 9

A cloud security analyst reviews AWS CloudTrail logs and notices multiple 'RunInstances' API calls from a single IAM user creating EC2 instances with public IP addresses in an unusual region. What is the most likely concern?

Accepted Answer

The user's credentials may be compromised and used for cryptomining. Multiple RunInstances calls from a single IAM user creating public-IP EC2 instances in an unusual region is a textbook indicator of compromised credentials being used for cryptomining. Attackers favor this pattern because it rapidly provisions compute resources for mining, often in regions the victim doesn't normally use to evade detection and quota monitoring.

Answer

The user is performing legitimate scaling operations

Answer

The user is provisioning resources for a new project

Answer

The user is testing disaster recovery procedures

Question 10

An organization's incident response team is handling a ransomware incident where critical servers have been encrypted. The team has identified the ransomware variant and determined that decryption is not possible. Which of the following is the BEST post-incident activity to prevent recurrence?

Accepted Answer

Conduct a root cause analysis to determine the initial infection vector.. A root cause analysis identifies how the ransomware actually entered — phishing email, exposed RDP, unpatched VPN, supply chain — which is the only way to close the specific gap that allowed the incident. Without knowing the initial infection vector, any remediation is guesswork and the same attack can recur. Post-incident activities in NIST SP 800-61 and CompTIA's IR lifecycle explicitly call for lessons-learned/root-cause work to drive preventive controls.

Answer

Increase the frequency of vulnerability scans.

Answer

Share IOCs with the industry ISAC.

Answer

Reimage all affected servers from backups.