Security Operations

A SOC is onboarding endpoint logs into a SIEM. Which fields are most important for process-chain investigations? (Choose three.)

Question 4hardmulti select

A threat hunter suspects data exfiltration over HTTPS from a database server. Which data sources are most useful? (Choose two.)

Question 5mediummulti select

A SOC wants to reduce alert fatigue without missing confirmed malicious activity. Which actions are appropriate? (Choose two.)

Question 6hardmulti select

Which signals strengthen an alert for Kerberoasting activity? (Choose two.)

Question 7mediummulti select

A detection engineer is writing a Sigma rule for suspicious rundll32 usage. Which fields should be included? (Choose two.)

Question 8hardmulti select

A cloud workload identity begins accessing secrets outside its normal application scope. Which evidence should be reviewed? (Choose two.)

Question 9mediummulti select

A phishing detection rule looks only for known malicious URLs and misses newly registered lookalike domains. Which improvements help? (Choose two.)

Question 10hardmulti select

An analyst suspects DNS tunnelling but wants to avoid over-escalating normal CDN behaviour. Which comparisons help? (Choose two.)

Question 11mediummulti select

A SOAR playbook enriches suspicious IP addresses. Which enrichment sources are useful? (Choose two.)

Question 12hardmulti select

A SOC is tuning a detection for suspected DNS tunnelling. Which evidence points are useful before escalating the alert? (Choose two.)

Question 13hardmulti select

A malware alert shows a signed binary performing suspicious actions. Which facts help decide whether it is living-off-the-land abuse? (Choose two.)

Question 14mediummulti select

Which evidence helps distinguish a true brute-force attack from a misconfigured service account? (Choose two.)

Question 15hardmulti select

A Kubernetes audit alert shows a service account creating privileged pods. Which checks are most relevant? (Choose two.)

Question 16mediummulti select

An IDS signature fires on outbound traffic but analysts suspect a false positive. Which validation steps are appropriate? (Choose two.)

Question 17hardmulti select

A SOC wants to measure whether alert enrichment is improving operations. Which metrics are useful? (Choose two.)

Question 18easymultiple choice

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant?

Question 19hardmultiple choice

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected?

Question 20mediummultiple choice

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as?

Question 21hardmultiple choice

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix?

Question 22mediummultiple choice

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the evidence source phase, Which evidence source best supports or refutes the detection?

Question 23mediummultiple choice

Read the full network assurance explanation →

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Question 24hardmultiple choice

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the containment trade-off phase, Which response balances containment with evidence preservation?

Question 25mediummultiple choice

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the root-cause analysis phase, Which finding would most directly explain the activity?

Question 26mediummultiple choice

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Question 27mediummulti select

An analyst is creating a detection for suspicious PowerShell. Which conditions improve fidelity? (Choose two.)

Question 28hardmultiple choice

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Question 29mediummultiple choice

An analyst has several malware samples from the same campaign and wants to detect related files based on unique strings and byte patterns. Which method is MOST appropriate? In the containment trade-off phase, Which response balances containment with evidence preservation?

Question 30mediummultiple choice

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the root-cause analysis phase, Which finding would most directly explain the activity?

Question 31hardmultiple choice

Full Practice Test →All Objectives

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the alert triage phase, Which action gives the analyst the clearest next triage step?

More Security Operations questions available in the full practice test.

Continue Practising →

All CS0-003 Objectives

Objective 1.0

Security Operations

CS0-003 Practice Questions

What this objective tests

CS0-003 Security Operations — Key Topics

Security Operations questions on this certification test your ability to deploy and manage security operations concepts in scenario-based situations.

Core Security Operations concepts and how they apply in real-world cloud scenarios.
How to deploy security operations correctly and verify the outcome.
Troubleshooting security operations issues by interpreting error output and system state.
Cloud best practices and Security Operations design trade-offs tested by this certification.

Common exam traps

Where candidates lose marks on Security Operations

⚠Selecting the most expensive service when a simpler managed option meets the requirement.
⚠Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
⚠Choosing a global service fix when the issue is region-specific.
⚠Overlooking cost implications of cross-region data transfer in architecture questions.

CS0-003 Security Operations — Practice Questions

30 questions from this objective

Question 2hardmulti select

Read the full VPN explanation →

A SIEM correlation rule for impossible travel is creating noise from VPN users. Which refinements should improve fidelity? (Choose two.)

Question 3mediummulti select

A SOC is onboarding endpoint logs into a SIEM. Which fields are most important for process-chain investigations? (Choose three.)

Question 4hardmulti select

A threat hunter suspects data exfiltration over HTTPS from a database server. Which data sources are most useful? (Choose two.)

Question 5mediummulti select

A SOC wants to reduce alert fatigue without missing confirmed malicious activity. Which actions are appropriate? (Choose two.)

Question 6hardmulti select

Which signals strengthen an alert for Kerberoasting activity? (Choose two.)

Question 7mediummulti select

A detection engineer is writing a Sigma rule for suspicious rundll32 usage. Which fields should be included? (Choose two.)

Question 8hardmulti select

A cloud workload identity begins accessing secrets outside its normal application scope. Which evidence should be reviewed? (Choose two.)

Question 9mediummulti select

A phishing detection rule looks only for known malicious URLs and misses newly registered lookalike domains. Which improvements help? (Choose two.)

Question 10hardmulti select

An analyst suspects DNS tunnelling but wants to avoid over-escalating normal CDN behaviour. Which comparisons help? (Choose two.)

Question 11mediummulti select

A SOAR playbook enriches suspicious IP addresses. Which enrichment sources are useful? (Choose two.)

Question 12hardmulti select

A SOC is tuning a detection for suspected DNS tunnelling. Which evidence points are useful before escalating the alert? (Choose two.)

Question 13hardmulti select

A malware alert shows a signed binary performing suspicious actions. Which facts help decide whether it is living-off-the-land abuse? (Choose two.)

Question 14mediummulti select

Which evidence helps distinguish a true brute-force attack from a misconfigured service account? (Choose two.)

Question 15hardmulti select

A Kubernetes audit alert shows a service account creating privileged pods. Which checks are most relevant? (Choose two.)

Question 16mediummulti select

An IDS signature fires on outbound traffic but analysts suspect a false positive. Which validation steps are appropriate? (Choose two.)

Question 17hardmulti select

A SOC wants to measure whether alert enrichment is improving operations. Which metrics are useful? (Choose two.)

Question 18easymultiple choice

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant?

Question 19hardmultiple choice

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected?

Question 20mediummultiple choice

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as?

Question 21hardmultiple choice

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix?

Question 22mediummultiple choice

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the evidence source phase, Which evidence source best supports or refutes the detection?

Question 23mediummultiple choice

Read the full network assurance explanation →

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Question 24hardmultiple choice

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the containment trade-off phase, Which response balances containment with evidence preservation?

Question 25mediummultiple choice

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the root-cause analysis phase, Which finding would most directly explain the activity?

Question 26mediummultiple choice

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Question 27mediummulti select

An analyst is creating a detection for suspicious PowerShell. Which conditions improve fidelity? (Choose two.)

Question 28hardmultiple choice

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Question 29mediummultiple choice

An analyst has several malware samples from the same campaign and wants to detect related files based on unique strings and byte patterns. Which method is MOST appropriate? In the containment trade-off phase, Which response balances containment with evidence preservation?

Question 30mediummultiple choice

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the root-cause analysis phase, Which finding would most directly explain the activity?

Question 31hardmultiple choice