CS0-003 Security Operations Practice Test 10 — 15 Questions

Question 1

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from a known internal IP address to a file server. The user authenticated successfully on the next attempt. Which classification best describes this alert?

Accepted Answer

False positive. The alert is a false positive because a single failed login followed by success is normal user behavior and not indicative of malicious activity.

Answer

True negative

Answer

True positive

Answer

False negative

Question 2

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The analyst reviews the finding and determines that the vulnerability is mitigated by a Web Application Firewall (WAF) deployed in front of the server. What should the analyst do with this finding?

Accepted Answer

Document the compensating control and track the finding until patched.. The vulnerability is effectively mitigated by the compensating control (WAF), so it should be documented as such and tracked until the patch is applied.

Answer

Mark the finding as a false positive and close it.

Answer

Immediately patch the server to remove the vulnerability.

Answer

Increase the scan frequency to detect if the vulnerability changes.

Question 3

An analyst is reviewing network traffic logs and notices a series of connections from an internal workstation to an external IP address on TCP port 53. The traffic consists of large DNS queries with random-looking subdomains. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling uses the DNS protocol to exfiltrate data by encoding it in DNS queries, often with random-looking subdomains.

Answer

Domain generation algorithm (DGA)

Answer

Beaconing

Answer

HTTP smuggling

Question 4

An EDR alert shows that a process named svchost.exe with parent process cmd.exe executed a PowerShell command to create a scheduled task. The scheduled task runs a script from a remote share. What should the analyst suspect?

Accepted Answer

Persistence mechanism using a LOLBin. The parent-child relationship is abnormal: svchost.exe should not have cmd.exe as its parent. This indicates a living off the land (LOLBin) technique using svchost.exe to execute malicious code.

Answer

Lateral movement via scheduled tasks

Answer

Normal administrative activity

Answer

Memory injection attack

Question 5

A security team is configuring a vulnerability scanner for external scanning of their public-facing web applications. Which scan type will provide the most accurate assessment of vulnerabilities without requiring credentials?

Accepted Answer

External scan. An external scan assesses the attack surface from the internet perspective, typically without credentials. Agent-based and authenticated scans require credentials or internal access.

Answer

Agent-based scan

Answer

Authenticated scan

Answer

Internal scan

Question 6

An analyst is tasked with creating a correlation rule in the SIEM to detect beaconing activity. Which log sources and fields are most relevant to model this behavior?

Accepted Answer

Firewall logs and connection timestamps. Beaconing involves periodic outbound connections, so firewall logs (source IP, destination IP, destination port) and connection timestamps are essential for detecting regularity.

Answer

Authentication logs and user IDs

Answer

Endpoint logs and process creation

Answer

DNS logs and query types

Question 7

During a threat hunting exercise, the hunter creates a hypothesis based on recent threat intelligence about a new ransomware variant that uses scheduled tasks for persistence. Which ATT&CK technique should the hunter focus on?

Accepted Answer

T1053.005 (Scheduled Task). Scheduled tasks are a persistence technique (T1053.005). The hunter should focus on the persistence tactic and the specific technique for scheduled tasks.

Answer

T1566.001 (Spearphishing Attachment)

Answer

T1059.001 (PowerShell)

Answer

T1547.001 (Registry Run Keys)

Question 8

A cloud security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The instance is part of an auto-scaling group. What is the best immediate action?

Accepted Answer

Isolate the instance by modifying its security group to deny all traffic.. Isolating the instance by removing it from the security group or using a quarantine VPC prevents further communication while preserving forensic data.

Answer

Terminate the instance immediately to stop the threat.

Answer

Ignore the alert because auto-scaling groups are ephemeral.

Answer

Update the GuardDuty threat list to ignore that IP.

Question 9

An analyst is reviewing a packet capture and notices a TCP connection with the following sequence: SYN, SYN-ACK, ACK, SYN, ACK. What does this pattern indicate?

Accepted Answer

TCP session hijacking or MITM attempt. After the three-way handshake, a second SYN (from the same source) with the same sequence number suggests a man-in-the-middle (MITM) attack using TCP injection or session hijacking.

Answer

TCP SYN flood attack

Answer

TCP port scan

Answer

Normal TCP retransmission due to packet loss

Question 10

A YARA rule is created to detect a specific malware family. The rule uses the string "MZ" at offset 0 and the string "malware" somewhere in the file. The analyst finds that many legitimate executables trigger the rule. What is the most effective way to reduce false positives?

Accepted Answer

Add a condition to check for a specific file size range.. Adding conditions like file size or entry point constraints narrows the rule to specific malware characteristics, reducing false positives from benign files.

Answer

Increase the rule's priority to avoid scanning all files.

Answer

Use the "pe" module to check for a specific section name.

Answer

Remove the "MZ" condition since all PE files have it.

Question 11

An analyst is investigating a memory dump of a compromised system and finds a process that appears to be running inside another process's memory space, with no associated executable on disk. Which technique best describes this finding?

Accepted Answer

Process hollowing. Process hollowing involves creating a legitimate process in a suspended state, replacing its memory with malicious code, and resuming it. The absence of an on-disk executable is a key indicator.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection

Question 12

A SIEM alert is generated for a user who logged into a workstation at 2:00 AM, which is outside their normal working hours. The user's manager confirms the user was on call and had legitimate reason to log in. How should the analyst classify this alert?

Accepted Answer

False positive. The alert is a false positive because the activity is legitimate despite being outside normal hours.

Answer

False negative

Answer

True positive

Answer

True negative

Question 13

An analyst is tuning a SIEM rule that triggers on failed logins. Which TWO modifications would most effectively reduce false positives without missing actual brute-force attacks? (Select TWO.)

Accepted Answer

Add a condition that the source IP is external to the network.. Limiting to remote logins reduces false positives from local console failures. Adding a threshold (e.g., >5) ensures only excessive failures alert, reducing noise from single failures.

Answer

Remove the rule entirely because failed logins are common.

Answer

Exclude failed logins from known administrative accounts.

Answer

Increase the threshold to require at least 10 failed login attempts within 5 minutes.

Question 14

A security analyst is using osquery to hunt for persistence mechanisms on a Windows endpoint. Which THREE Windows artifacts should the analyst query to identify common persistence locations? (Select THREE.)

Accepted Answer

Scheduled tasks in the Task Scheduler. Registry Run keys (T1547.001), scheduled tasks (T1053.005), and services (T1543.003) are common persistence mechanisms. Startup folders are also common but are not listed as a separate option here; the three listed are correct.

Answer

Windows Event Logs for login events

Answer

Network connections from the endpoint

Question 15

An analyst is reviewing cloud audit logs from AWS CloudTrail and notices an API call to create an IAM user with administrative privileges from an IP address outside the corporate network. Which TWO actions should the analyst take first? (Select TWO.)

Accepted Answer

Review CloudTrail logs for any other suspicious API calls.. Disabling the user prevents further actions while preserving the account for investigation. Reviewing CloudTrail logs helps identify the scope and source of the activity.

Answer

Ignore the alert because CloudTrail logs are not reliable.

Answer

Contact the user's manager to verify if the creation was authorized.

Answer

Delete the newly created IAM user immediately.