989 questions total · 14pages · All types, answers revealed
Which of the following is the best data source for detecting DNS tunneling activity?
DNS logs provide the full query and response details needed to detect tunneling.
Why this answer
DNS logs contain the queries and responses; analyzing them for unusual domain patterns, large query volumes, or odd record types can reveal tunneling.
Refer to the exhibit. The snippet is from a Windows Security log showing event ID 4688 (Process Creation). Which of the following actions should the analyst take first?
The creator process is running from a non-standard location (Temp folder), indicating compromise.
Why this answer
The analyst should first investigate the creator process (parent process) because the suspicious svchost.exe spawned from rundll32.exe in a temp directory indicates a classic LOLBins (Living Off the Land Binaries) attack. Event ID 4688 logs the parent process PID (0x1234) and the child process; tracing the parent reveals the initial compromise vector, such as a malicious script or document that invoked rundll32.exe to execute the payload.
Exam trap
CompTIA often tests the misconception that the immediate child process (svchost.exe) is the primary threat, but the trap is that the parent process (rundll32.exe) holds the key to understanding the attack chain and should be investigated first.
How to eliminate wrong answers
Option A is wrong because killing the process with PID 0x1234 (the parent rundll32.exe) would remove the immediate threat but destroy forensic evidence needed to trace the attack chain; the analyst must first investigate to understand the full scope. Option C is wrong because quarantining the file C:\Users\admin\AppData\Local\Temp\svchost.exe is premature without confirming it is malicious via hash analysis or sandboxing, and it ignores the parent process that may have additional indicators. Option D is wrong because disabling rundll32.exe system-wide is an extreme, disruptive action that breaks legitimate Windows functionality (e.g., DLL execution for system utilities) and should only be considered after thorough investigation confirms persistent abuse.
A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the containment trade-off phase, Which response balances containment with evidence preservation?
Office-to-script process chains are common initial execution patterns for phishing payloads.
Why this answer
Option D is correct because the scenario describes a classic phishing attack where a malicious macro or embedded script in an Office document (the invoice) executes wscript.exe, a Windows Script Host interpreter, from the user's profile. This detection logic directly correlates the initial vector (Office document) with the suspicious process execution (script interpreter) in the user context, which is a key indicator of malware or unauthorized script activity.
Exam trap
The trap here is that candidates may focus on the process name (wscript.exe) alone and overlook the critical context of the Office document spawning it, leading them to choose a generic detection like high CPU usage or ignore the attack chain entirely.
How to eliminate wrong answers
Option A is wrong because high CPU usage on a print server is unrelated to endpoint script execution from an Office document; it indicates a performance or resource issue, not a security detection logic for script-based attacks. Option B is wrong because a password expiry warning is an administrative notification about credential aging, not a detection logic for malicious script execution or process spawning. Option C is wrong because successful DHCP renewal is a normal network configuration event that does not indicate malicious activity or script execution from an Office document.
Two servers have the same critical vulnerability. One hosts a public payment API; the other is a lab server isolated from production. What changes the remediation priority? For stakeholder management, Which documentation or approval is required to keep the programme defensible?
The same CVE can represent different risk depending on where it exists and what the asset supports.
Why this answer
D is correct because remediation priority is determined by asset criticality, exposure, and business impact, not by superficial attributes. The public payment API has high business impact and exposure, making it a higher priority than the isolated lab server, even though both share the same vulnerability. This aligns with risk-based vulnerability management principles where context (e.g., data sensitivity, network reachability) drives patching order.
Exam trap
The CS0-003 exam often tests the misconception that all vulnerabilities with the same CVE should be treated equally, ignoring the risk-based prioritization that considers asset criticality, exposure, and business impact.
How to eliminate wrong answers
Option A is wrong because the colour of the scanner dashboard is a cosmetic UI element with no bearing on risk assessment or remediation priority. Option B is wrong because the number of installed fonts is irrelevant to vulnerability severity, exploitability, or business context. Option C is wrong because hostname length has no technical relationship to risk; a shorter hostname does not indicate higher exposure or criticality.
A security analyst is tuning a SIEM correlation rule that generates alerts when a single user logs into more than 10 workstations within 5 minutes. The rule is producing excessive false positives due to service accounts performing automated tasks. Which of the following is the best tuning approach to reduce false positives while still detecting potential lateral movement?
Correct. Excluding known service accounts reduces false positives without weakening detection for user accounts.
Why this answer
Excluding known service accounts from the rule reduces false positives while still detecting lateral movement by user accounts.
An analyst is reviewing a memory dump of a compromised system and notices that the memory of a legitimate process (e.g., notepad.exe) contains a PE header and executable code that is not part of the original binary. Which technique is most likely being used?
Process hollowing replaces the process's code with malicious code, leaving the PE header visible.
Why this answer
Process hollowing involves replacing the legitimate code of a running process with malicious code, but the PE header and executable code in memory indicate code injection, specifically hollowing.
An analyst is performing static analysis on a suspicious executable file. Which of the following would be MOST useful to identify potential malicious behavior without executing the file?
The import table reveals API calls that suggest malicious behavior.
Why this answer
Static analysis involves examining the file without executing it. The import table shows which Windows API functions the executable uses, which can indicate capabilities such as network communication, file operations, or registry modifications.
While supporting a hybrid workforce, an incident was contained successfully, but delayed escalation allowed the attacker more dwell time. What should the post-incident review produce? During eradication, which decision is most defensible? which evidence should guide the decision?
Lessons learned should translate findings into trackable process improvements. In eradication, responders need action that reduces risk while preserving the investigation record.
Why this answer
Option D is correct because the post-incident review should produce actionable improvements to the incident response process. Specific playbook updates, escalation triggers, owners, and due dates directly address the delayed escalation and excessive dwell time by formalizing when and how to escalate, ensuring accountability and timely response in future incidents.
Exam trap
CompTIA often tests the distinction between punitive actions (blame) and process improvements (playbook updates); the trap here is that candidates may confuse accountability with blame, choosing a 'blame list' (Option C) instead of recognizing that systemic fixes are the defensible outcome.
How to eliminate wrong answers
Option A is wrong because a generic statement that security is important provides no measurable, actionable steps to fix the process failure; it lacks specificity and does not prevent recurrence. Option B is wrong because deletion of all incident tickets destroys forensic evidence, audit trails, and lessons-learned data, violating standard retention policies and potentially compliance requirements. Option C is wrong because a blame list of individual analysts fosters a punitive culture, discourages reporting, and ignores systemic process flaws; the focus should be on process improvement, not individual fault.
A company has implemented a vulnerability management program. The security team needs to ensure that all critical vulnerabilities are remediated within 30 days. Which of the following metrics would BEST measure the effectiveness of this goal?
This metric directly measures whether the 30-day goal is being met.
Why this answer
The goal is to ensure all critical vulnerabilities are remediated within 30 days. Mean time to remediate (MTTR) directly measures the average time taken to fix critical vulnerabilities, making it the best metric to assess compliance with the 30-day remediation window. Other metrics, such as detection counts or patch levels, do not capture the timeliness of remediation.
Exam trap
The CS0-003 exam often tests the distinction between measuring remediation activity (e.g., number of closures) versus measuring remediation timeliness (e.g., MTTR), leading candidates to pick Option B because they confuse 'closure count' with 'time to closure.'
How to eliminate wrong answers
Option A is wrong because the number of critical vulnerabilities detected per month measures the volume of new findings, not how quickly or effectively they are fixed; a high detection count could coexist with slow remediation. Option B is wrong because the number of rescan results showing vulnerability closure indicates that some fixes have been applied, but it does not measure the time taken to achieve closure, so it cannot verify the 30-day deadline. Option C is wrong because the percentage of systems with up-to-date patches is a broad compliance metric that may include non-critical patches and does not specifically track the remediation timeline for critical vulnerabilities.
An analyst runs the above command on a server. Based on the exhibit, which of the following is the MOST likely scenario?
Port 4444 is often used by malware.
Why this answer
The command output shows a listening service on port 4444, which is not a standard port for any common service. Port 4444 is commonly associated with remote access trojans (RATs) such as Metasploit's Meterpreter or other malware, making a compromise the most likely scenario. The analyst should investigate further to confirm malicious activity.
Exam trap
CompTIA often tests the association of non-standard ports with common malware or trojans, and the trap here is that candidates may assume any open port is legitimate or overlook the significance of port 4444's known malicious use.
How to eliminate wrong answers
Option B is wrong because SSH runs on port 22 by default (per IANA assignment), and while it could be configured on a non-standard port, there is no evidence of SSH protocol behavior or authentication in the output. Option C is wrong because web services typically use ports 80 (HTTP) or 443 (HTTPS), and port 4444 is not a registered alternative for HTTP/HTTPS. Option D is wrong because proxy services for internal clients commonly use ports like 3128 (Squid) or 8080, and port 4444 is not a standard proxy port.
A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the alert triage phase, Which action gives the analyst the clearest next triage step?
Early automation should gather context and evidence while keeping analysts in control of disruptive actions.
Why this answer
Option B is correct because it describes non-destructive, automated enrichment actions that gather evidence (URL reputation, sandbox analysis, mailbox search counts) without altering systems. This aligns with SOAR best practices for the initial triage phase, where the goal is to reduce analyst workload by providing contextual data while avoiding destructive actions until confirmation of a true positive.
Exam trap
The CS0-003 exam often tests the distinction between automated enrichment (safe, reversible) and automated response (potentially destructive), tricking candidates into choosing immediate containment actions like account disablement before confirmation.
How to eliminate wrong answers
Option A is wrong because disabling the reporting user's account is a destructive action that could disrupt legitimate operations and violates the requirement to avoid destructive actions before confirmation. Option C is wrong because closing all similar alerts as duplicates prematurely assumes they are false positives or duplicates without evidence, which risks missing a real threat and bypasses proper triage analysis.
A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the containment trade-off phase, Which response balances containment with evidence preservation?
Control-plane attacks are best investigated through authoritative audit events that record who changed identity and access configuration.
Why this answer
Option D is correct because cloud audit logs (e.g., AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs) capture control-plane API calls such as IAM policy changes, access key creation, and authentication events. These logs provide the strongest evidence of identity and access management (IAM) compromise at the control plane, as they directly record who made what change, from which source IP, and with what outcome. In the containment trade-off phase, preserving these logs while disabling compromised keys or applying a deny-all policy balances stopping the attacker with retaining forensic evidence.
Exam trap
CompTIA often tests the distinction between control-plane and data-plane telemetry, and the trap here is that candidates confuse web server logs or endpoint logs with cloud audit logs, failing to recognize that only cloud audit logs capture identity and policy API calls at the control plane.
How to eliminate wrong answers
Option A is wrong because web server access logs from a public website only record HTTP requests to the application layer (e.g., GET/POST to web pages), not IAM policy changes, access key creation, or failed console logons—these are control-plane operations, not data-plane web traffic. Option B is wrong because packet captures from user laptops only show network-layer traffic (e.g., TCP/UDP flows) and cannot capture cloud API calls made to the cloud provider's control plane endpoints (e.g., `iam.amazonaws.com`), which are encrypted over TLS and not visible at the laptop's network interface. Option C is wrong because endpoint antivirus quarantine reports only log malware detections on local endpoints (e.g., file hashes, process names), not cloud-side identity or policy changes; they provide no visibility into cloud control-plane API calls.
A SOC wants to measure whether alert enrichment is improving operations. Which metrics are useful? (Choose two.)
Faster triage indicates operational value.
Why this answer
Option A is correct because a primary goal of alert enrichment is to reduce the time analysts spend investigating alerts. By automatically populating context such as asset owner, criticality, and vulnerability data, enrichment eliminates manual lookup steps, directly lowering mean time to triage (MTTT). This metric quantifies operational efficiency gains from enrichment.
Exam trap
The CS0-003 exam often tests the distinction between metrics that measure operational improvement (e.g., triage time reduction) versus metrics that measure data completeness (e.g., enrichment field population), and candidates may mistakenly choose a storage-related metric that seems tangentially related to operations but is irrelevant to enrichment effectiveness.
A security analyst is conducting a dynamic application security testing (DAST) scan of a REST API. The scanner reports a potential Server-Side Request Forgery (SSRF) vulnerability. The analyst needs to confirm the finding manually. Which TWO of the following techniques are most appropriate for validating SSRF?
Detects out-of-band interactions confirming SSRF.
Why this answer
SSRF can be confirmed by making requests to internal resources (e.g., localhost) and observing responses, or by using an external collaborator service to detect out-of-band callbacks.
An incident responder is documenting the root cause of a data breach. Which THREE components are essential to include in the root cause analysis section of the incident report? (Select THREE.)
Correct. The specific technical weakness is a key part of the root cause.
Why this answer
Root cause analysis should identify the underlying causes, not just the symptoms. It should include the technical failure, the process failure, and the human or organizational factors that contributed.
An organization uses OpenSCAP for compliance scanning. What is the primary purpose of OpenSCAP?
OpenSCAP validates configurations against security baselines like CIS or STIGs.
Why this answer
OpenSCAP is a tool for automated compliance checking against security policies like SCAP content.
A scan of Windows servers reports few findings, but the scanner used no credentials. The security manager suspects missing patch data. What should be changed? For business prioritization, Which recommendation gives the best risk-based order of work?
Authenticated scanning gives the scanner access to installed software and patch state, improving accuracy.
Why this answer
Without credentials, a vulnerability scanner can only perform unauthenticated checks, which miss many Windows patch vulnerabilities that require registry or file-level access. Running authenticated scans with least-privilege credentials allows the scanner to query the Windows Update Agent API and check installed KBs, providing accurate patch data. This directly addresses the security manager's concern about missing patch data.
Exam trap
The CS0-003 exam often tests the misconception that increasing scan scope (ports or targets) or disabling security controls will improve vulnerability detection, when the real fix is enabling authenticated access to gather patch-level data.
How to eliminate wrong answers
Option A is wrong because permanently disabling host firewalls exposes the server to network-based attacks and violates the principle of least functionality; it does not help the scanner obtain patch data. Option B is wrong because increasing the port range only expands the network surface for unauthenticated scans, which still cannot access the registry or file system to verify installed patches.
A security analyst suspects an insider threat based on unusual data access patterns by an employee. According to best practices, which TWO actions should the analyst take FIRST?
Limiting access reduces risk while investigation continues.
Why this answer
Restricting the employee's access to sensitive data (A) is a correct first action because it immediately reduces the risk of further data exfiltration or damage while preserving the ability to investigate. Collecting additional evidence without alerting the employee (D) is also correct because it allows the analyst to build a forensic case covertly, preventing the insider from destroying evidence or altering behavior. Both actions align with the incident response principle of containment before eradication and the need to avoid tipping off a potential adversary.
Exam trap
CompTIA often tests the distinction between 'immediate containment' and 'overreaction' — the trap here is that candidates confuse 'suspending accounts' (a disruptive, all-or-nothing action) with 'restricting access' (a precise, reversible control), leading them to choose B instead of A.
During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the evidence source phase, Which evidence source best supports or refutes the detection?
Clock drift and timezone parsing commonly distort event order in SIEM timelines.
Why this answer
A five-minute discrepancy between firewall and endpoint logs for the same connection strongly indicates a time synchronization issue. The analyst should first verify NTP configuration and timezone normalization across all log sources to ensure a consistent timeline. Without synchronized clocks, event ordering and correlation are unreliable, which can lead to incorrect conclusions during incident reconstruction.
Exam trap
The CS0-003 exam often tests the misconception that log volume or event priority should dictate which logs to trust, when in fact time synchronization is the foundational prerequisite for any timeline-based analysis.
How to eliminate wrong answers
Option B is wrong because deleting one source from the timeline discards potentially critical evidence and does not resolve the root cause of the time offset; it merely hides the discrepancy. Option C is wrong because prioritizing the source with the highest events per second (EPS) does not address the time offset; EPS is a measure of logging throughput, not clock accuracy, and this approach would ignore the synchronization issue entirely.
A team says a critical vulnerability was patched. What should the vulnerability manager require before closure? For stakeholder management, Which documentation or approval is required to keep the programme defensible?
Closure should be based on validation evidence, not only a remediation claim.
Why this answer
Option C is correct because the vulnerability manager must obtain objective evidence that the vulnerability has been remediated before closing the finding. An email assertion is insufficient; a retest (manual or automated) confirming the vulnerable condition is no longer present provides the verifiable proof required for closure and defensible stakeholder reporting.
Exam trap
The CS0-003 exam often tests the misconception that a verbal or written assertion from the remediation team is sufficient for closure, when in fact the CompTIA framework requires objective evidence (a retest) to maintain an auditable and defensible vulnerability management program.
How to eliminate wrong answers
Option A is wrong because closing a vulnerability based solely on an email from the team bypasses the verification step, leaving the organization exposed if the patch was incomplete or misapplied. Option B is wrong because waiting one year before testing introduces an unacceptable delay, during which the vulnerability could be exploited, and violates the principle of timely remediation verification.
A security analyst is reviewing a suspicious email attachment. Which THREE of the following are safe analysis techniques? (Choose THREE)
Online scanners like VirusTotal allow safe analysis without exposing your environment.
Why this answer
Option B is correct because submitting a suspicious file to a public online scanner (e.g., VirusTotal) allows the analyst to check the file against multiple antivirus engines and threat intelligence feeds without executing it on a live system. This technique is safe as it avoids direct exposure of the production environment to potential malware while leveraging community-sourced detection data.
Exam trap
The CS0-003 exam often tests the distinction between 'safe' and 'unsafe' analysis techniques, where candidates mistakenly think examining source code (Option C) is always safe, but it can still trigger execution if the file is opened in an unsecured environment (e.g., enabling macros in Office documents).
While supporting a hybrid workforce, a web server contains a new file that executes commands through a query parameter. What evidence best confirms web-shell activity? During recovery, which decision is most defensible? which evidence should guide the decision?
A web shell leaves evidence across file, web, process, and network telemetry. In recovery, responders need action that reduces risk while preserving the investigation record.
Why this answer
Option C is correct because web-shell activity on a web server is best confirmed by correlating web access logs showing unusual query parameters with file timestamps indicating the creation of a new executable file, process execution logs revealing the web service account spawning a shell (e.g., cmd.exe or /bin/sh), and outbound connections from that account to an external IP—this multi-source evidence chain directly matches the behavior of a web shell executing commands via HTTP GET/POST parameters. During recovery, the most defensible decision is to isolate the server and preserve these logs as forensic artifacts, guided by the evidence of unauthorized command execution and outbound C2 traffic.
Exam trap
The trap here is that candidates often focus on a single log source (e.g., only web access logs) and ignore the need for corroborating evidence from process execution and network connections, which Cisco tests to ensure you understand that web-shell confirmation requires correlating multiple indicators across different log types.
How to eliminate wrong answers
Option A is wrong because printer logs only record print jobs and device status, which have no relevance to web-server command execution or web-shell activity—they lack HTTP request details, process execution data, or network connections. Option B is wrong because the CEO's mailbox audit events track email access and sending, not web-server file changes, process spawns, or outbound connections from the web service account—they are entirely unrelated to detecting or confirming a web shell.
A host alert shows certutil.exe downloading a file from an external URL, followed by execution from a user-writable directory. What should the analyst focus on? In the evidence source phase, Which evidence source best supports or refutes the detection?
Certutil can be abused to download payloads; file and process context establishes whether execution is malicious.
Why this answer
Option D is correct because certutil.exe is a known living-off-the-land binary (LOLBin) that attackers abuse to download payloads, bypassing application whitelisting. The analyst must focus on the downloaded file's hash (to check reputation), origin URL (to assess maliciousness), and child process (to trace execution), as these provide direct evidence of malicious intent or compromise.
Exam trap
The CS0-003 exam often tests the misconception that a signed Microsoft binary is inherently safe, but the trap here is that attackers leverage trusted tools (LOLBins) to evade detection, so the focus must be on the binary's misuse and the artifacts it produces, not its signature status.
How to eliminate wrong answers
Option A is wrong because antivirus signatures being current does not address the abuse of a trusted Microsoft binary; attackers use LOLBins specifically to evade signature-based detection. Option B is wrong because reinstalling the browser does not remediate the underlying compromise; the execution from a user-writable directory indicates a potential backdoor or persistence mechanism unrelated to browser integrity. Option C is wrong because certutil being signed by Microsoft is exactly why it is dangerous; attackers exploit its trust to bypass security controls, so ignoring it would miss the attack entirely.
During a penetration test, an analyst successfully exploits a privilege escalation vulnerability to gain root access on a Linux server. The server is used for application development. Which of the following remediation actions would be MOST effective in preventing similar attacks?
Least privilege limits what an attacker can gain after initial access, reducing the impact.
Why this answer
The principle of least privilege ensures that users and processes have only the minimum permissions necessary to perform their tasks. By applying this to user accounts, the attack surface for privilege escalation is reduced because even if an account is compromised, the attacker cannot easily escalate to root. This directly addresses the root cause of the vulnerability exploited in the scenario.
Exam trap
CompTIA often tests the distinction between detection (HIDS), system hardening (sysctl), execution control (whitelisting), and access control (least privilege), expecting candidates to recognize that preventing privilege escalation requires limiting permissions rather than just monitoring or restricting specific binaries.
How to eliminate wrong answers
Option A is wrong because a host intrusion detection system (HIDS) can detect suspicious activity after the fact but does not prevent the privilege escalation vulnerability from being exploited. Option B is wrong because hardening the kernel with sysctl parameters (e.g., disabling core dumps or restricting kernel module loading) does not address the underlying misconfiguration or weak permissions that allowed the escalation. Option C is wrong because application whitelisting controls which executables can run, but it does not prevent an attacker from abusing legitimate tools or scripts to escalate privileges once they have a foothold.
A forensic analyst is investigating a suspected data breach involving a compromised workstation. The analyst wants to collect volatile data in accordance with the order of volatility. Which sequence of data collection is correct?
This follows the standard order of volatility.
Why this answer
The order of volatility starts with the most volatile data (CPU registers/cache) and proceeds to the least volatile (archived media).
Order the steps for a typical patch management process.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Patch management includes identification, testing, approval, deployment, and verification.
During a network traffic analysis, a security analyst notices a host communicating with an external IP address over TCP port 443 using a self-signed certificate. The traffic flows are consistent in size and occur every 60 seconds. The external IP is not on any threat intelligence feeds. What does this pattern most likely indicate?
Correct. Periodic, consistent outbound connections are characteristic of C2 beaconing.
Why this answer
Regular, periodic connections of consistent size to an external host over HTTPS suggest beaconing, often used by malware for command and control.
The board asks whether cyber risk is decreasing after a vulnerability-management investment. Which presentation is strongest?
Board reporting should connect investment to measurable risk reduction.
Why this answer
Option B is correct because it directly answers the board's question about whether cyber risk is decreasing by presenting a trend in exploitable critical exposures (showing if the number of high-risk vulnerabilities is going down), remediation SLA performance (proving the team is fixing issues within policy), and residual risk by business service (quantifying the remaining risk to critical assets). This combination provides a clear, measurable, and business-aligned view of risk reduction over time, which is exactly what executive leadership needs to make informed decisions.
Exam trap
The CS0-003 exam often tests the trap that candidates confuse 'data' with 'information' — they think providing more raw data (like a CSV or screenshots) is better, when in fact executives need synthesized, trended, and risk-contextualized metrics that directly answer the business question.
How to eliminate wrong answers
Option A is wrong because a raw CSV of 20,000 findings is unprocessed, overwhelming, and lacks any trend analysis or risk context; it forces the board to perform their own analysis, which is impractical and ineffective for executive communication. Option C is wrong because a list of tool login names is completely irrelevant to demonstrating risk reduction; it provides no vulnerability data, no metrics, and no evidence of program effectiveness. Option D is wrong because a screenshot of every scanner page is a chaotic, non-aggregated dump of raw tool output that obscures trends and fails to translate technical findings into business risk language.
In a regulated payment environment, file shares show rapid encryption and ransom-note creation from one workstation. What is the best immediate containment action? During containment, which decision is most defensible? which action best reduces risk without losing evidence?
Containment should stop encryption spread while preserving evidence for analysis. In containment, responders need action that reduces risk while preserving the investigation record.
Why this answer
Option D is correct because isolating the workstation immediately stops the ransomware from encrypting additional file shares and prevents lateral movement. Disabling active sessions to file servers cuts off the encryption process at the network level, preserving the forensic evidence on the host and shares. This aligns with the NIST SP 800-61 containment strategy of 'stop the bleeding' before any other action.
Exam trap
The CS0-003 exam often tests the misconception that recovery (backups) or broad scanning should come before containment, but the immediate priority is always to stop the attack from spreading, even if it means delaying evidence collection or recovery.
How to eliminate wrong answers
Option A is wrong because running vulnerability scans on every subnet first wastes critical time during an active ransomware outbreak; scanning does not stop encryption and may alert the attacker. Option B is wrong because restoring backups before isolating the host risks re-encrypting the restored data if the ransomware is still active on the network; containment must precede recovery. Option C is wrong because emailing all users the ransom note spreads panic, may trigger further malicious actions, and does nothing to halt the encryption or preserve evidence.
A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the evidence source phase, Which evidence source best supports or refutes the detection?
Early automation should gather context and evidence while keeping analysts in control of disruptive actions.
Why this answer
Option D is correct because it aligns with the SOAR playbook's goal of reducing analyst workload through automated enrichment and triage without taking destructive action. Enriching URLs and detonating attachments in a sandbox provides threat intelligence, while collecting mailbox search counts helps quantify the incident's scope. This non-destructive evidence gathering allows analysts to make informed decisions before any containment or remediation steps.
Exam trap
The CS0-003 exam often tests the distinction between 'investigative' and 'remediative' actions in SOAR playbooks, trapping candidates who confuse automated triage with automated containment or cleanup.
How to eliminate wrong answers
Option A is wrong because closing all similar alerts as duplicates prematurely assumes the detection is a false positive or already handled, which can suppress legitimate threats and bypass proper investigation. Option B is wrong because disabling the reporting user's account immediately is a destructive containment action that should only occur after confirmation of compromise, not in the first automated phase. Option C is wrong because automatically deleting all messages from the sender across all mailboxes is a destructive remediation action that could remove critical forensic evidence and impact legitimate communications if the detection is incorrect.
A scanner flags TLS 1.0 on a server, but the service owner says TLS 1.0 is disabled. What is the BEST validation method? For stakeholder management, Which documentation or approval is required to keep the programme defensible?
Direct protocol validation determines whether TLS 1.0 is actually accepted.
Why this answer
Option B is correct because the scanner may have detected TLS 1.0 due to a false positive from a misconfigured cipher suite or a server-side protocol negotiation artifact. Manually testing with a TLS client (e.g., OpenSSL s_client -tls1) or a scanner profile that explicitly negotiates protocol versions provides definitive evidence of whether TLS 1.0 is actually enabled, resolving the discrepancy between the scanner result and the owner's claim.
Exam trap
The CS0-003 exam often tests the misconception that a scanner's automated result is always authoritative, when in fact manual validation is required to confirm protocol-level findings, especially when the service owner disputes the result.
How to eliminate wrong answers
Option A is wrong because closing a finding solely because the owner disagrees, without independent validation, violates due diligence and could leave an unpatched vulnerability in production. Option C is wrong because changing severity to informational without technical verification bypasses proper risk assessment and may hide a real vulnerability from remediation tracking. Option D is wrong because deleting the server from the scan scope removes visibility entirely, preventing future detection of the issue and undermining the vulnerability management program's defensibility.
A security analyst is triaging an alert from the EDR that shows the process 'powershell.exe' with a parent process of 'winword.exe'. The user recently opened a document from an email. What is the most likely explanation?
Attackers often use macros in Office documents to launch PowerShell for code execution.
Why this answer
This is a classic sign of a macro-based attack where a malicious document spawns PowerShell to execute payloads.
A SOC analyst is reviewing logs from a web server and sees the following request: GET /../../etc/passwd HTTP/1.1. Which type of web attack is this?
The ../ sequence is used to navigate directories.
Why this answer
The request GET /../../etc/passwd HTTP/1.1 uses '../' sequences to traverse directories outside the web root, attempting to read the /etc/passwd file. This is the classic signature of a directory traversal (path traversal) attack, which exploits insufficient input validation to access unauthorized files on the server.
Exam trap
CompTIA often tests the distinction between directory traversal and file inclusion; the trap here is confusing the '../' path manipulation with SQL injection or XSS because the request looks like a simple GET, but the attack vector is purely about file system access, not database or script injection.
How to eliminate wrong answers
Option A is wrong because SQL injection involves injecting SQL commands into input fields to manipulate a database, not path manipulation in HTTP requests. Option B is wrong because CSRF tricks a user's browser into executing unwanted actions on a trusted site, not directly requesting files via path traversal. Option D is wrong because XSS injects client-side scripts into web pages viewed by others, not server-side file access via directory traversal.
A security analyst is using a container image scanner to identify vulnerabilities in a Kubernetes deployment. Which of the following tools is specifically designed for container image scanning?
Trivy is designed for container image scanning.
Why this answer
Trivy is a popular open-source tool for scanning container images for vulnerabilities.
A security analyst reviews a Nessus scan result for a web server. The plugin output indicates a critical vulnerability with CVSS v3.1 base score 9.8. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Which of the following best describes the attack complexity?
AC:L directly translates to Low attack complexity.
Why this answer
In the CVSS vector, AC:L means Attack Complexity is Low, indicating no special conditions are required for exploitation.
While supporting a hybrid workforce, a laptop may contain evidence for a legal investigation. What should the responder document during acquisition? During post-incident improvement, which decision is most defensible? which evidence should guide the decision?
Chain of custody records evidence handling and integrity from collection onward. In post-incident improvement, responders need action that reduces risk while preserving the investigation record.
Why this answer
Option D is correct because forensic acquisition requires a complete chain of custody to ensure evidence admissibility in legal proceedings. Documenting who collected the evidence, when and where it was collected, hash values (e.g., SHA-256) for integrity verification, transfer details (e.g., using a write-blocker and forensic imaging tool like FTK Imager), and the storage location (e.g., secure evidence locker or encrypted NAS) satisfies legal and organizational standards such as NIST SP 800-86.
Exam trap
The CS0-003 exam often tests the distinction between operational data (e.g., ticket priority, job title) and legally required forensic documentation (chain of custody, hash values, transfer details) to trap candidates who confuse incident response triage with evidence acquisition.
How to eliminate wrong answers
Option A is wrong because documenting only the laptop color provides no forensic value and fails to establish chain of custody or evidence integrity. Option B is wrong because the ticket priority is an operational metric unrelated to forensic evidence handling and does not meet legal admissibility requirements. Option C is wrong because the user's job title is irrelevant to the forensic acquisition process and does not help verify that the evidence was collected, transferred, and stored without tampering.
During a post-compromise review, a malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible? which action should be prioritized before closure?
Severity should reflect impact and risk, not only malware family name. In recovery, responders need action that reduces risk while preserving the investigation record.
Why this answer
Option B is correct because severity in incident response is determined by business impact, privilege level, asset criticality, and spread potential — not by the order of detection. The domain admin workstation has elevated privileges and access to critical systems, making the second alert far more severe even if it arrived later. This aligns with NIST SP 800-61 and common IR frameworks that prioritize containment based on risk to the enterprise.
Exam trap
The CS0-003 exam often tests the misconception that the first alert or the most recent alert determines severity, when in fact privilege level and asset criticality (especially domain admin vs. kiosk) are the decisive factors.
How to eliminate wrong answers
Option A is wrong because the order of alert arrival has no bearing on severity; a later alert on a higher-privilege asset is more critical. Option C is wrong because hostname alphabetical order is irrelevant to risk assessment and would ignore privilege and asset value. Option D is wrong because an analyst's dashboard theme is a UI preference and has no impact on incident severity or recovery decisions.
An analyst is reviewing a packet capture and notices a TCP connection with the following sequence: SYN, SYN-ACK, ACK, SYN, ACK. What does this pattern indicate?
Correct. A second SYN on an established connection indicates an attempt to hijack the session.
Why this answer
After the three-way handshake, a second SYN (from the same source) with the same sequence number suggests a man-in-the-middle (MITM) attack using TCP injection or session hijacking.
What is the primary purpose of performing credentialed vulnerability scans?
With credentials, the scanner can access more detailed system information.
Why this answer
Credentialed scans authenticate to the target system, allowing deeper inspection (e.g., registry, installed software) for a more accurate assessment.
During a configuration compliance scan using OpenSCAP, a security analyst finds that several Windows servers have the 'Network access: Do not allow anonymous enumeration of SAM accounts' setting set to 'Disabled'. This finding corresponds to a CIS Benchmark recommendation. Which of the following describes the most appropriate remediation step for this finding?
This policy directly addresses the finding and is the recommended CIS remediation.
Why this answer
The setting should be enabled to prevent anonymous enumeration of SAM accounts. The remediation is to change the policy setting via Group Policy or local security policy.
A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For stakeholder management, Which documentation or approval is required to keep the programme defensible?
Credentialed scans depend on authentication and sufficient read access to inspect packages and configuration.
Why this answer
Option B is correct because SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) often breaks the scanner's ability to authenticate. The best next step is to review the scanner account's permissions, allowed authentication methods (e.g., public key vs. password), and sudo command restrictions to ensure the scanner can still execute the necessary commands for credentialed scanning without compromising security.
Exam trap
The CS0-003 exam often tests the misconception that a failed credentialed scan means the host is secure, when in reality it indicates an authentication or permission issue that must be resolved to maintain scan coverage.
How to eliminate wrong answers
Option A is wrong because assuming hosts have no vulnerabilities after a failed scan is a dangerous security oversight; a failed scan does not prove absence of vulnerabilities, only that the scanner could not authenticate. Option C is wrong because disabling SSH on all servers would break all remote administration and is an extreme, unnecessary measure that does not address the scanner's authentication failure. Option D is wrong because running only unauthenticated scans forever would miss deep vulnerabilities (e.g., missing patches, misconfigurations) that require authenticated access to detect, violating vulnerability management best practices.
An analyst is reviewing cloud audit logs from AWS CloudTrail and notices an API call to create an IAM user with administrative privileges from an IP address outside the corporate network. Which TWO actions should the analyst take first? (Select TWO.)
Correct. Determining the scope is essential.
Why this answer
Disabling the user prevents further actions while preserving the account for investigation. Reviewing CloudTrail logs helps identify the scope and source of the activity.
A security analyst reviews a SIEM alert that fired when a user successfully logged into a server from a remote IP address at 3 AM. The user is a system administrator who often works late. What is the most appropriate initial classification of this alert?
The alert incorrectly flagged a legitimate login as suspicious, making it a false positive.
Why this answer
True positives are alerts that correctly identify malicious activity. In this case, the login is legitimate for the administrator's work pattern, making it a false positive.
A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the alert triage phase, Which action gives the analyst the clearest next triage step?
TLP:AMBER+STRICT restricts sharing to the recipient organisation on a need-to-know basis.
Why this answer
Option D is correct because TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and prohibits any wider redistribution. In the alert triage phase, using the indicators internally ensures the SOC can investigate and respond without violating the information-sharing constraints set by the vendor, which is a mandatory security practice, not optional.
Exam trap
CompTIA often tests the misconception that TLP markings are merely advisory or optional, leading candidates to choose 'ignore' or 'publish' options, when in fact TLP is a mandatory handling framework with strict enforcement requirements.
How to eliminate wrong answers
Option A is wrong because TLP markings are mandatory for handling sensitive threat intelligence; ignoring them would violate security policies and potentially expose the organization to legal or operational risks. Option B is wrong because publishing TLP:AMBER+STRICT indicators on a public GitHub repository directly violates the strict no-redistribution rule and could compromise ongoing investigations or expose the vendor's sources. Option C is wrong because sending the indicators to all customers, even if they are internal, violates the 'need to know' restriction of TLP:AMBER+STRICT, which limits sharing to only those individuals directly involved in the response.
A security analyst is reviewing a vulnerability scan report and notices that a plugin output indicates a potential misconfiguration in a web server that allows directory listing. The analyst wants to verify this finding manually. Which of the following tools would be most appropriate to confirm the vulnerability?
Burp Suite allows manual inspection of web server responses and can confirm directory listing.
Why this answer
Burp Suite is a web application security testing tool that can be used to manually verify web vulnerabilities like directory listing by intercepting and modifying requests.
A security analyst is using a DAST tool to test a web application. Which of the following vulnerabilities would the tool most likely identify?
DAST can detect injection vulnerabilities by testing inputs.
Why this answer
DAST tools interact with the running application and can detect vulnerabilities like SQL injection by sending malicious inputs and observing responses.
A company has a policy to remediate vulnerabilities within 30 days. A critical vulnerability is discovered on a database server. The patch requires a reboot, and the database cannot be taken offline during business hours. Which of the following is the BEST approach?
Compensating controls reduce risk immediately while planning for patching.
Why this answer
Option A is correct because when a critical vulnerability requires a patch that mandates a reboot, but the database cannot be taken offline during business hours, implementing a compensating control (such as network segmentation, strict firewall rules, or an intrusion prevention system (IPS) signature) reduces the risk to an acceptable level until the patch can be applied. This aligns with the 30-day remediation policy by addressing the vulnerability without violating operational constraints.
Exam trap
CompTIA often tests the misconception that 'schedule the patch during the next maintenance window' is always acceptable, but the trap here is that the 30-day remediation deadline is a hard policy requirement, and scheduling alone does not guarantee compliance if the window is beyond 30 days.
How to eliminate wrong answers
Option B is wrong because applying a hotfix without reboot is not feasible for a patch that explicitly requires a reboot to complete installation; a hotfix that does not require a reboot would need to be specifically designed for that purpose, and the scenario does not indicate such a hotfix exists. Option C is wrong because scheduling the patch during the next maintenance window may exceed the 30-day remediation deadline if the window falls outside that timeframe, and the policy requires remediation within 30 days, not merely scheduling. Option D is wrong because extending the remediation deadline violates the company's explicit policy to remediate vulnerabilities within 30 days, and it does not actively reduce risk during the extension period.
A credentialed Linux scan fails on several hosts after SSH hardening. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?
Credentialed scans depend on authentication and sufficient read access to inspect packages and configuration.
Why this answer
Option C is correct because SSH hardening (e.g., disabling password authentication, restricting ciphers, or enforcing key-based login) can break credentialed scans if the scanner's account lacks proper permissions or uses an unsupported authentication method. The best next step is to verify that the scanner's SSH key or password is accepted, that the account has sudo privileges for required commands (e.g., `sudo -n` for non-interactive execution), and that no `sudoers` restrictions block the scanner's commands. This directly addresses the root cause without compromising security.
Exam trap
The CS0-003 exam often tests the misconception that a scan failure after hardening means the hosts are secure, when in reality it signals a configuration mismatch that must be resolved to restore visibility.
How to eliminate wrong answers
Option A is wrong because disabling SSH on all servers would eliminate remote management and scanning entirely, violating security best practices and causing operational disruption; the issue is misconfiguration, not a need to remove SSH. Option B is wrong because assuming hosts have no vulnerabilities after a scan failure is a dangerous security blind spot—credentialed scans provide deeper visibility, and the failure indicates a configuration problem, not an absence of vulnerabilities.
A security analyst is configuring a vulnerability scanner for internal network scanning. The analyst wants to ensure the scanner can identify missing patches and software configurations that require administrative privileges to read. Which scan type should the analyst configure?
Credentialed scans log in to systems and can assess patch levels and configurations.
Why this answer
Credentialed scans use administrative credentials to access systems and retrieve detailed configuration information, including missing patches.
A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?
DGA domains appear random.
Why this answer
DGA domains are often algorithmically generated, resulting in random-looking, long domain names. High NXDOMAIN rates occur because many generated domains are not registered at the time of query.
A legacy system cannot be patched because the vendor no longer supports the application. What should the vulnerability manager request? For tool configuration, Which scanner or pipeline change most directly improves result quality?
Unsupported systems need formal exception handling, mitigation, ownership, and an exit path.
Why this answer
Option B is correct because when a legacy system cannot be patched due to vendor end-of-life, the vulnerability manager must formally accept the risk through documented risk acceptance, implement compensating controls (e.g., network segmentation, host-based firewall rules, or application whitelisting), and create a migration or remediation plan to eventually retire or replace the system. This aligns with the NIST SP 800-53 risk management framework and ensures auditability and accountability for the unpatched vulnerability.
Exam trap
The CS0-003 exam often tests the misconception that removing a system from reports or marking a vulnerability as fixed is an acceptable shortcut, when in reality the correct process requires formal risk acceptance with compensating controls and a documented plan.
How to eliminate wrong answers
Option A is wrong because granting all users local admin rights would increase the attack surface and privilege escalation risk, directly violating the principle of least privilege and making the system even more vulnerable. Option C is wrong because marking the vulnerability as fixed when it is not patched is a false positive suppression that misrepresents the security posture and can lead to compliance failures. Option D is wrong because removing the system from future reports hides the vulnerability from visibility, preventing proper tracking and risk management, which is contrary to vulnerability management best practices.
A security analyst is reviewing a DAST scan report for a web application. The report indicates a vulnerability where the application fails to properly validate user-supplied data before using it in a database query. This is most likely which type of vulnerability?
Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query.
Why this answer
Failure to validate user input before using in a database query is classic SQL injection (injection flaw).
A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For business prioritization, Which recommendation gives the best risk-based order of work?
Container findings should consider reachability, but rebuilding from a patched base reduces inherited risk.
Why this answer
Option C is correct because the best next step is to validate whether the vulnerable OpenSSL binary is actually reachable or exploitable in the running container, and then rebuild from a patched base image if feasible. This balances security with business priorities by avoiding unnecessary rebuilds for non-exploitable vulnerabilities while ensuring that truly exploitable CVEs are remediated. Simply ignoring or renaming the tag does not address the underlying risk and violates secure CI/CD practices.
Exam trap
The CS0-003 exam often tests the misconception that a vulnerability can be safely ignored if the application team claims the binary is unused, but the trap is that without validation (e.g., runtime reachability analysis), the claim may be false due to transitive dependencies or dynamic loading.
How to eliminate wrong answers
Option A is wrong because ignoring all base-image vulnerabilities would leave the organization exposed to known critical CVEs, violating vulnerability management policies and potentially leading to compliance failures. Option B is wrong because renaming the image tag does not remove or patch the vulnerable binary; it only obscures the issue, and the vulnerable layer remains in the image, which could still be exploited if the binary is reachable.
The SOC receives an alert from a network sensor showing an internal host communicating with a known malicious IP over HTTPS. The analyst cannot find any process making outbound connections on the host. What should the analyst do next?
Hidden processes can be detected by tools like rootkit revealers, addressing the anomaly.
Why this answer
Option D is correct because the absence of a visible process suggests the presence of a rootkit or hidden process that requires deep analysis. Other options may be premature or incomplete.
A developer accidentally committed a cloud access key to a public repository. Logs show the key was used from an unfamiliar IP. What should be done first? During eradication, which decision is most defensible?
The exposed credential must be invalidated and its use scoped through audit logs. In eradication, responders need action that reduces risk while preserving the investigation record.
Why this answer
Option B is correct because the immediate priority is to revoke the compromised credential to prevent further unauthorized access. Disabling or rotating the cloud access key stops any ongoing malicious activity, and reviewing the actions performed with it allows the incident response team to assess the scope of the breach, identify affected resources, and determine if any data was exfiltrated or modified. This aligns with the containment and eradication phases of incident response.
Exam trap
The CS0-003 exam often tests the misconception that physical or network-level controls (like blocking a laptop) are sufficient for cloud credential exposure, when the real threat is the attacker using the key remotely, not the developer's device.
How to eliminate wrong answers
Option A is wrong because waiting to see whether charges increase is a passive, reactive approach that allows the attacker continued access, potentially leading to greater data loss, resource abuse, and financial damage; it violates the principle of immediate containment. Option C is wrong because blocking the developer's laptop from Wi-Fi does not address the root cause—the compromised cloud access key—and the attacker is using the key from an unfamiliar IP, not the developer's device; this action is irrelevant to stopping the unauthorized cloud access.
A threat hunter is using osquery to look for persistence mechanisms on a set of Windows endpoints. Which THREE registry keys or scheduled tasks should the hunter check for common persistence?
Services can be set to auto-start for persistence.
Why this answer
Run keys, scheduled tasks, and services are common persistence locations. Startup folder is also common, but osquery can check Run keys directly. AppInit_DLLs is less common.
A SOC analyst is investigating an alert from Azure Sentinel indicating a user account logged in from an unfamiliar location. The analyst wants to determine if this is a true positive. Which TWO additional log sources should the analyst correlate to make an informed decision?
Activity Logs show resource changes and can indicate if the account was used for administrative actions.
Why this answer
Azure AD sign-in logs provide authentication details, and Azure Activity Logs provide management plane activity. Correlating these can reveal if the sign-in was part of administrative actions or other anomalies.
During a patch management process, an organization uses a staging environment to test patches before deployment. Which of the following is the primary purpose of patch testing in a staging environment?
Correct; testing verifies patch effectiveness and no adverse effects.
Why this answer
Patch testing in a staging environment aims to identify potential issues (e.g., compatibility, regression) that could affect production systems, ensuring stability and minimizing disruptions.
A vulnerability scan identifies a plugin output for 'SMB Signing Disabled' on a Windows server. The CVSS v3.1 base score is 5.3 (Medium). The asset is a file server used only internally. The organization has decided not to enable SMB signing due to performance concerns. Which of the following is the BEST compensating control?
Network segmentation limits exposure to only necessary systems.
Why this answer
Since enabling SMB signing is not feasible, implementing network segmentation to restrict access to only authorized hosts reduces the attack surface.
A security analyst is prioritizing vulnerabilities for remediation. Which THREE factors from the CISA Known Exploited Vulnerabilities (KEV) catalog should the analyst consider? (Select THREE.)
The date helps prioritize recent exploitation.
Why this answer
The KEV catalog lists vulnerabilities known to be exploited in the wild, including the date added, vendor name, and a brief description.
A security analyst is analyzing a PCAP file from a network incident and notices a series of TCP connections with unusual flag combinations. Specifically, the SYN flag is set but the ACK flag is not set in the response, and the sequence numbers are not incrementing properly. The analyst suspects a TCP handshake manipulation. Which THREE TCP anomalies should the analyst document?
Improper sequence numbers can indicate injection or hijacking.
Why this answer
SYN-ACK without ACK, inconsistent sequence numbers, and SYN flood patterns are all anomalies that could indicate attacks like SYN flood or TCP hijacking.
During forensic analysis of a compromised server, an analyst needs to preserve evidence in order of volatility. Which of the following actions should the analyst perform FIRST?
Memory is highly volatile and should be captured immediately after securing the system.
Why this answer
According to the order of volatility, CPU registers and cache are the most volatile. However, in practice, capturing memory (RAM) is the first feasible step after powering on the system, as registers are lost on shutdown. The correct order: capture memory first, then try to capture swap, then disk, etc.
An analyst wants to capture all traffic to and from a specific IP address for analysis. Which command-line tool is most appropriate?
Captures all packets to/from that host.
Why this answer
Option D is correct because `tcpdump host 10.0.0.1` captures all packets where the source or destination IP address matches 10.0.0.1, making it the ideal tool for capturing all traffic to and from a specific IP for analysis. It operates at the packet level, using libpcap to intercept raw network frames, and the `host` filter instructs it to match both directions of traffic without additional parsing or state tracking.
Exam trap
The trap here is that candidates confuse tools that probe or display state (nmap, netstat, iptables) with tools that capture raw traffic (tcpdump), leading them to select a tool that does not actually capture packets for analysis.
How to eliminate wrong answers
Option A is wrong because `nmap -sS 10.0.0.1` performs a SYN stealth scan against the target IP, which sends crafted packets to probe open ports, not capture existing traffic. Option B is wrong because `netstat -ant | grep 10.0.0.1` displays current network connections and listening ports from the system's socket table, but it does not capture live packets or traffic content; it only shows connection state at a single point in time. Option C is wrong because `iptables -L -v` lists the current firewall rules and their packet/byte counters, but it does not capture or log individual packets for analysis; it only shows aggregate statistics for rules.
An organization has experienced a data breach involving personally identifiable information (PII). The incident response team has contained the breach and eradicated the threat. During the post-incident activity phase, which activity is MOST critical to prevent future similar incidents?
Root cause analysis identifies why the breach occurred, leading to effective long-term improvements.
Why this answer
Conducting a root cause analysis helps identify the underlying vulnerability or weakness that led to the breach, enabling the organization to implement corrective measures and prevent recurrence.
An analyst is configuring correlation rules in a SIEM. Which TWO data sources are essential for detecting lateral movement using pass-the-hash attacks?
Logon events with NTLM can indicate PtH.
Why this answer
Pass-the-hash involves using NTLM hashes to authenticate. Authentication logs show logon events, and endpoint logs show process creation (e.g., wmic, psexec). Firewall logs may show network connections but are not specific to PtH.
An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)
Why this answer
Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.
Exam trap
CompTIA often tests the distinction between containment actions (immediate isolation) and eradication actions (patching, imaging), so candidates mistakenly select 'creating a forensic image' or 'patching the vulnerability' as containment steps when they actually belong to later phases of the incident response process.
A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the root-cause analysis phase, Which finding would most directly explain the activity?
Repeated unsolicited prompts that lead to approval are characteristic of MFA fatigue attacks.
Why this answer
Option C is correct because the scenario describes MFA fatigue (also called push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This exploits human behavior rather than a technical vulnerability, and is a common initial access vector in credential-stuffing or password-spraying campaigns. The root-cause analysis would directly identify the repeated unsolicited MFA prompts as the mechanism that led to unauthorized approval.
Exam trap
The CS0-003 exam often tests the distinction between a technical attack (like password spraying) and a social-engineering variant (MFA fatigue), trapping candidates who focus only on the credential aspect and ignore the repeated-prompt behavior described in the question.
How to eliminate wrong answers
Option A is wrong because password spraying only involves trying a few common passwords against many accounts; it does not explain the repeated MFA prompts or the user's eventual approval. Option B is wrong because DNS tunnelling is a data exfiltration or command-and-control technique that encodes data in DNS queries, unrelated to MFA prompt bombardment or user approval behavior.
An organization performs quarterly vulnerability scans of its internal network. The scans have a high number of false positives for out-of-date software that is actually up to date. Which of the following would BEST improve the accuracy of the scans?
Credentials allow the scanner to check actual patch levels, reducing false positives.
Why this answer
Credential-based scanning (authenticated scanning) allows the scanner to log into target systems with valid credentials, enabling it to query the local registry or package manager for the exact installed software versions. This eliminates reliance on banner grabbing or service fingerprinting, which often produce false positives when out-of-date software is detected based on network-level heuristics rather than actual installed patches.
Exam trap
The trap here is that candidates assume false positives are caused by scanner quality or frequency, rather than recognizing that unauthenticated scanning inherently lacks the visibility needed to confirm patch levels, making credential-based scanning the only direct solution.
How to eliminate wrong answers
Option A is wrong because disabling verbose output only reduces the amount of log data; it does not change the underlying detection method, so false positives from unauthenticated fingerprinting would persist. Option C is wrong because increasing scan frequency to monthly does not address the root cause of false positives; it merely repeats the same inaccurate detection more often, potentially increasing noise. Option D is wrong because simply using a different vulnerability scanner without enabling credential-based scanning would likely yield similar false positives, as most scanners rely on unauthenticated fingerprinting by default and require credentials to improve accuracy.
An analyst receives a threat intelligence feed containing IOCs in STIX format. Which of the following BEST describes the purpose of STIX?
STIX defines a common language for describing threats.
Why this answer
STIX (Structured Threat Information Expression) is a standardized language for representing and sharing threat intelligence.
A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?
Service accounts often have expected failures (e.g., password changes); excluding them reduces noise.
Why this answer
Aggregating alerts by source IP reduces noise; excluding known service accounts eliminates expected failures.
While supporting a hybrid workforce, a malware alert affects a single kiosk with no sensitive access. A second alert shows the same malware on a domain admin workstation. What should drive severity? During recovery, which decision is most defensible? which evidence should guide the decision?
Severity should reflect impact and risk, not only malware family name. In recovery, responders need action that reduces risk while preserving the investigation record.
Why this answer
Option B is correct because severity in incident response is determined by business impact, privilege level, asset criticality, and spread potential. The domain admin workstation has elevated privileges and access to critical systems, making the same malware far more dangerous than on a kiosk. This aligns with NIST SP 800-61 and common IR frameworks that prioritize containment based on risk, not chronology or naming.
Exam trap
The CS0-003 exam often tests the misconception that the first alert or a simple naming convention should drive severity, when in fact the correct approach is to evaluate the contextual risk factors like privilege and asset criticality.
How to eliminate wrong answers
Option A is wrong because the order of alert arrival does not reflect actual risk; a later alert on a domain admin workstation is far more severe than an earlier one on a kiosk. Option C is wrong because alphabetical order of hostnames has no bearing on security risk or recovery priority; it is a meaningless sorting method that ignores privilege levels and asset criticality.
A threat hunter is reviewing osquery data from endpoints and notices that the Windows Registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' contains an entry for 'C:\Users\Public\svchost.exe'. Which of the following best describes the significance of this finding?
Correct. The Run key is used for persistence, and the unusual path indicates masquerading.
Why this answer
The Run key is a common persistence mechanism. An executable named svchost.exe in a non-system directory is suspicious and likely malicious.
A CI pipeline blocks a container image because the base layer contains a critical OpenSSL CVE. The application team says the vulnerable binary is not used. What is the BEST next step? For control selection, Which control best addresses the stated weakness without hiding risk?
Container findings should consider reachability, but rebuilding from a patched base reduces inherited risk.
Why this answer
Option A is correct because it follows the principle of validating risk before acting. The pipeline blocks the image based on a static scan that flags a CVE, but the application team claims the vulnerable binary is not used. The best next step is to verify exploitability (e.g., by checking if the binary is actually invoked at runtime) and then rebuild from a patched base image if the vulnerability is real.
This approach ensures the weakness is addressed without hiding risk, as the rebuild removes the vulnerable component entirely.
Exam trap
The CS0-003 exam often tests the misconception that a static scan finding must always be acted upon immediately, without validating exploitability or considering that a vulnerable binary may be unused in the container's runtime context.
How to eliminate wrong answers
Option B is wrong because renaming the image tag only obscures the vulnerability from scanning tools but does not remove the vulnerable binary; it hides risk rather than addressing it, violating the principle of transparency. Option C is wrong because shipping the image without documentation ignores the vulnerability entirely, which could lead to exploitation in a different runtime context or fail compliance audits; it is a security bypass that does not validate or mitigate the risk.
A large enterprise uses a vulnerability management platform that integrates with Active Directory and a configuration management database (CMDB). During a quarterly scan, a critical vulnerability (CVE-2021-44228) is detected on a legacy application server running an end-of-life (EOL) version of Java. The server supports a critical business process and cannot be upgraded or patched because the vendor no longer provides updates. The analyst must reduce the risk to an acceptable level. What is the best approach?
Segmentation and access controls reduce the likelihood and impact of exploitation, providing a compensating control when patching is infeasible.
Why this answer
Network segmentation combined with strict access controls limits the attack surface and potential impact, providing a practical risk reduction when patching is not possible. Removing the server would disrupt business, hotfixes are unavailable, and replacement is a long-term project.
After a DDoS attack, the CSIRT wants to share IOCs with other organizations. Which protocol is specifically designed for automated, real-time threat intelligence sharing?
Correct. TAXII enables automated sharing of threat indicators.
Why this answer
TAXII (Trusted Automated Exchange of Indicator Information) is the protocol for exchanging threat intelligence over HTTPS.
Practice CS0-003 by domain
Target a specific domain to shore up weak areas.