CySA+ CS0-003 Practice Test

CS0-003 practice test: what's covered

• Cybersecurity Analyst

Free CS0-003 sample questions

1. At 03:00 a SOC analyst sees svchost.exe spawning powershell.exe with a long base64-encoded -EncodedCommand argument on a finance server. What is the BEST immediate action?

   • A. Reboot the server to clear the suspicious PowerShell process from memory
   • B. Isolate the host from the network, capture a memory image, then decode the base64 command
   • C. Schedule a full antivirus scan to run during the next maintenance window
   • D. Add the server hostname to the SIEM watchlist and continue monitoring passively
   Show answer

   Correct: B. Encoded PowerShell launched from svchost.exe is a classic fileless/living-off-the-land pattern, so containment plus volatile-evidence capture must come first. Rebooting is incorrect because it destroys the memory artifacts that contain the decoded payload and C2 details. A scheduled AV scan is too slow and signature-based AV often misses fileless attacks, while passive monitoring lets the adversary continue acting on objectives.

2. A hospital's file servers are encrypting rapidly and ransom notes appear on shares. The IR team confirms active ransomware spreading via SMB. What should be done FIRST?

   • A. Pay the ransom quickly to obtain the decryption key before more files are lost
   • B. Reformat the affected servers immediately and restore from the newest backups
   • C. Isolate the affected hosts from the network to halt lateral encryption of shares
   • D. Power off every workstation in the building to be completely safe from spread
   Show answer

   Correct: C. Containment is the priority because network isolation stops the malware from reaching additional shares and pivoting to new hosts. Paying the ransom is incorrect as a first step since it funds crime, gives no guarantee, and skips containment. Reformatting immediately destroys forensic evidence needed for scoping, and powering off all workstations is an overreaction that loses volatile evidence and disrupts care unnecessarily.

3. While reviewing proxy logs, an analyst notices one workstation contacting the same external IP every 60 seconds with small, fixed-size payloads, even when the user is away. What does this MOST likely indicate?

   • A. Normal software auto-update polling that checks a vendor server on a timer
   • B. Command-and-control beaconing from an implant calling back to its operator
   • C. A misconfigured NTP client repeatedly synchronizing the system clock
   • D. Routine browser telemetry being sent to an analytics collection endpoint
   Show answer

   Correct: B. Regular, low-volume connections to one external host on a fixed interval are the statistical signature of C2 beaconing, even when jitter is added. Software update polling is incorrect because it is irregular and tied to user/app activity rather than constant timed callbacks. NTP uses UDP 123 to known pools and is not implant behavior, and analytics telemetry is bursty and follows user browsing, not silent fixed-interval traffic while idle.

4. A user forwards a suspicious phishing email containing a link. As the responding analyst, which actions form a sound triage-and-hunt workflow? (Choose THREE)

   • A. Analyze the message headers to verify SPF, DKIM, and the true sending infrastructure
   • B. Detonate the embedded URL in a sandbox to extract indicators of compromise
   • C. Immediately delete the single reported email and consider the matter fully closed
   • D. Search all mailboxes for the same sender, subject, and URL to find other recipients
   • E. Reply to the sender asking them to confirm whether the message is legitimate
   Show answer

   Correct: A and B and D. Header analysis reveals spoofing and the real origin, sandbox detonation yields IOCs for blocking, and org-wide mailbox hunting finds everyone who received the campaign. Deleting only the reported message is incorrect because the campaign almost certainly reached others who did not report it. Replying to the sender is wrong because it confirms a live mailbox to the attacker and provides no defensive value.

5. An analyst suspects an attacker is moving between Windows hosts using stolen credentials, RDP, and remote service creation. Which artifacts BEST confirm lateral movement? (Choose THREE)

   • A. Security event 4624 logon type 3 (network) and type 10 (RemoteInteractive/RDP)
   • B. Security event 4672 showing special privileges assigned at logon
   • C. Event 7045 recording a new service installed on a remote host
   • D. Web server access logs showing HTTP requests and user-agent strings
   • E. Endpoint antivirus quarantine logs listing detected malware signatures
   Show answer

   Correct: A and B and C. Network and RDP logons (4624 types 3 and 10), special-privilege assignments (4672), and remote service installs (7045) are the authentication and execution artifacts that expose pivoting between hosts. Web access logs are incorrect because they only show HTTP activity, not host-to-host authentication. AV quarantine logs report malware files, not the authentication trail that actually proves lateral movement.

Last updated: 2026-10-19

CS0-003 practice test FAQ

Related practice tests

• SY0-701 practice test
• PT0-003 practice test
• CSA-312-39 practice test
• SC-200 practice test
• GCIH practice test
• Splunk Core User practice test