CS0-003 Timed Practice Test 4 — 10 Questions

Question 1

The CISO asks whether incident response is improving quarter over quarter. Which metric is most relevant? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Mean time to detect, mean time to respond, containment time, and recurrence rate. Mean time to detect (MTTD), mean time to respond (MTTR), containment time, and recurrence rate are key performance indicators (KPIs) that directly measure the efficiency and effectiveness of an incident response program. These metrics provide quantitative data on how quickly threats are identified, contained, and remediated, and whether the root cause is fully addressed to prevent repeat incidents. For executive leadership, these high-level, trendable metrics are the most relevant for assessing improvement quarter over quarter, as they tie directly to risk reduction and operational maturity.

Answer

Number of unused dashboards

Answer

Number of desktop wallpapers changed

Answer

Total coffee consumed by analysts

Question 2

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is executive leadership, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option B is correct because it directly addresses the board's question by showing a trend in exploitable critical exposures (measuring vulnerability reduction), remediation SLA performance (tracking timeliness of fixes), and residual risk by business service (quantifying remaining risk). This provides executive leadership with a clear, high-level view of risk reduction over time, aligning with the CS0-003 domain of Reporting and Communication for a non-technical audience.

Answer

A list of tool login names

Answer

A raw CSV of 20,000 findings

Answer

A screenshot of every scanner page

Question 3

In a regulated payment environment, a malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Business impact, privilege level, asset criticality, and spread potential. Option B is correct because severity in incident response must be driven by business impact, privilege level, asset criticality, and spread potential. The domain admin workstation has elevated privileges and access to sensitive systems, making it a higher priority than a non-sensitive kiosk, regardless of alert order. This aligns with NIST SP 800-61 and common IR frameworks that prioritize containment based on risk, not chronology.

Answer

Whether the alert arrived first

Answer

Alphabetical order of hostnames

Answer

The analyst's preferred dashboard theme

Question 4

In a regulated payment environment, a company wants to test whether legal, PR, IT, and executives understand their roles during a ransomware incident without touching production systems. What exercise is best? During post-incident improvement, which decision is most defensible? which action best reduces risk without losing evidence?

Accepted Answer

Tabletop exercise using a realistic ransomware scenario. A tabletop exercise (A) is the correct choice because it allows the company to validate roles, communication paths, and decision-making processes for a ransomware incident without any risk to production systems. This aligns with the need to test understanding across legal, PR, IT, and executives in a regulated environment where touching live systems is prohibited. Full destructive detonation (D) would violate regulatory compliance and cause data loss, while purchasing a new SIEM (B) or an annual password reset (C) does not test incident response roles at all.

Answer

Purchasing a new SIEM without testing procedures

Answer

Annual password reset only

Answer

Full destructive malware detonation in production

Question 5

What should be included in incident scoping for ransomware? (Choose three.)

Accepted Answer

Initial infected host and user context. Option A is correct because identifying the initial infected host and user context is critical for understanding the attack vector, containing the threat, and preventing further spread. In ransomware incidents, the first compromised system often reveals the entry point (e.g., phishing email, RDP brute force) and the user account used, which helps scope the blast radius and prioritize remediation.

Answer

The brand of office chairs near the server room

Question 6

The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest? If the primary audience is business service owner, which content choice is most appropriate?

Accepted Answer

Trend in exploitable critical exposure, remediation SLA performance, and residual risk by business service. Option C is correct because it directly addresses the board's question about whether cyber risk is decreasing by presenting a trend in exploitable critical exposures (showing direction of risk), remediation SLA performance (showing operational effectiveness), and residual risk by business service (showing risk remaining after investment). This aligns with the primary audience of business service owners, who need aggregated, risk-focused metrics rather than raw technical data. The use of residual risk by business service ties vulnerability management outcomes to business impact, which is essential for executive decision-making.

Answer

A screenshot of every scanner page

Answer

A raw CSV of 20,000 findings

Answer

A list of tool login names

Question 7

Which items help make a post-incident report useful for technical teams? (Choose two.)

Accepted Answer

Root cause and exploited control gaps. Option C is correct because a post-incident report must include the root cause and exploited control gaps to enable technical teams to implement targeted remediation. Without identifying the specific vulnerability (e.g., unpatched CVE, misconfigured firewall rule, weak authentication mechanism) and the control failure that allowed the exploit, the report lacks actionable intelligence for hardening defenses.

Answer

Generic motivational slogans

Answer

Unrelated financial forecasts

Question 8

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For control selection, Which control best addresses the stated weakness without hiding risk?

Accepted Answer

Asset criticality, exposure, and business impact. Remediation priority is determined by risk, which is a function of asset criticality, exposure, and business impact. The public payment API has high business impact and external exposure, making it a priority over the isolated lab server, regardless of technical similarities. This aligns with the CVSS environmental metrics and organizational risk management frameworks.

Answer

The number of installed fonts

Answer

Whether the hostname is shorter

Answer

The colour of the scanner dashboard

Question 9

Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For tool configuration, Which scanner or pipeline change most directly improves result quality?

Accepted Answer

Asset criticality, exposure, and business impact. Remediation priority is determined by risk, which combines asset criticality, exposure, and business impact. The public payment API has high exposure (internet-facing) and high business impact (PCI DSS compliance, financial data), while the lab server is isolated and non-production. A vulnerability scanner like Nessus or Qualys uses asset tags and CVSS environmental metrics (e.g., modified impact sub-scores) to calculate a risk-based priority score, not the number of installed fonts or dashboard color.

Answer

The number of installed fonts

Answer

The colour of the scanner dashboard

Answer

Whether the hostname is shorter

Question 10

Which actions belong in eradication after a confirmed web-shell compromise? (Choose two.)

Accepted Answer

Remove the web shell and close the exploited vulnerability. Option A is correct because removing the web shell eliminates the attacker's foothold, and closing the exploited vulnerability (e.g., patching the application, disabling vulnerable functions like `eval()` or `system()`, or updating a CMS plugin) prevents re-exploitation. This aligns with the eradication phase of incident response, which aims to remove all artifacts of the compromise and harden the system against the same attack vector.

Answer

Reconnect the server before checking persistence

Answer

Only block the analyst's IP address