CS0-003 Practice Test

CS0-003 Practice Test practice questions, page 13 of 26, with answer review and explanations.

Question 61

A user downloads software that contains malware onto a computer that eventually infects numerous other systems. Which of the following has the user become?

  1. Hacktivist
  2. Advanced persistent threat
  3. Insider threat
  4. Script kiddie

Question 62

An organization has activated the CSIRT. A security analyst believes a single virtual server was compromised and immediately isolated from the network. Which of the following should the CSIRT conduct next?

  1. Take a snapshot of the compromised server and verify its integrity
  2. Restore the affected server to remove any malware
  3. Contact the appropriate government agency to investigate
  4. Research the malware strain to perform attribution

Question 63

During an incident, an analyst needs to acquire evidence for later investigation. Which of the following must be collected first in a computer system, related to its volatility level?

  1. Disk contents
  2. Backup data
  3. Temporary files
  4. Running processes

Question 64

A security analyst is trying to identify possible network addresses from different source networks belonging to the same company and region. Which of the following shell script functions could help achieve the goal?

  1. function w() { a=$(ping -c 1 $1 | awk-F ”/” ’END{print $1}’) && echo “$1 | $a” }
  2. function x() { b=traceroute -m 40 $1 | awk ’END{print $1}’) && echo “$1 | $b” }
  3. function y() { dig $(dig -x $1 | grep PTR | tail -n 1 | awk -F ”.in-addr” ’{print $1}’).origin.asn.cymru.com TXT +short }
  4. function z() { c=$(geoiplookup$1) && echo “$1 | $c” }

Question 65

A security analyst is writing a shell script to identify IP addresses from the same country. Which of the following functions would help the analyst achieve the objective?

  1. function w() { info=$(ping -c 1 $1 | awk -F “/” ‘END{print $1}’) && echo “$1 | $info” }
  2. function x() { info=$(geoiplookup $1) && echo “$1 | $info” }
  3. function y() { info=$(dig -x $1 | grep PTR | tail -n 1 ) && echo “$1 | $info” }
  4. function z() { info=$(traceroute -m 40 $1 | awk ‘END{print $1}’) && echo “$1 | $info” }