CS0-003 Security Operations Practice Test 10 — 15 Questions

Question 1

A security analyst is analyzing a PCAP file from a network incident and notices a series of TCP connections with unusual flag combinations. Specifically, the SYN flag is set but the ACK flag is not set in the response, and the sequence numbers are not incrementing properly. The analyst suspects a TCP handshake manipulation. Which THREE TCP anomalies should the analyst document?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sequence numbers that are out of order. Out-of-order or inconsistent sequence numbers, SYN-ACK packets that arrive without a preceding SYN, and a high volume of SYN packets to multiple ports are all anomalies that may indicate TCP handshake manipulation, such as SYN floods or TCP hijacking.

Answer

FIN packets with no prior data transfer

Answer

RST packets with the ACK flag set

Question 2

An analyst is using AWS GuardDuty and sees a finding that an EC2 instance is communicating with a known command-and-control (C2) IP address. What type of alert is this?

Accepted Answer

Threat intelligence finding. GuardDuty detects threats based on known malicious IPs, so communication with a C2 IP is a security finding indicating a potential compromise.

Answer

CASB alert investigation

Answer

Vulnerability scan result

Answer

Cloud audit log analysis

Question 3

A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?

Accepted Answer

Exclude failed logins from known service accounts. Aggregating alerts by source IP reduces noise; excluding known service accounts eliminates expected failures.

Answer

Disable the rule entirely

Answer

Increase the alert severity to critical for all failed logins

Answer

Add a correlation rule to trigger on successful login after multiple failures

Question 4

During a network traffic analysis, a security analyst observes repeated connections from an internal host to a known malicious IP on port 4444. The payload appears to be encrypted. Which type of activity is most likely indicated?

Accepted Answer

Command and control beaconing. Repeated connections to a known malicious IP on a non-standard port with encrypted payloads strongly suggest command and control (C2) beaconing.

Answer

Port scanning activity

Answer

Data exfiltration via DNS tunnelling

Answer

Lateral movement using SMB

Question 5

A security analyst is configuring a vulnerability scanner for an internal network. Which two settings are most important for reducing false positives during the scan? (Choose two.)

Accepted Answer

Disabling unnecessary plug-ins. Credentialed scans access system details for accurate results, and appropriate plug-in selection reduces irrelevant checks.

Answer

Using a higher scan intensity

Answer

Scanning from multiple IP addresses

Answer

Scanning only during business hours

Question 6

An analyst is creating a detection rule for lateral movement using SMB. Which two network indicators should be included in the rule? (Choose two.)

Accepted Answer

SMB traffic between workstations. Lateral movement over SMB often involves file writes to admin shares (IPC$) and unusual SMB traffic patterns.

Answer

Repeated failed logins to multiple hosts

Answer

High volume of DNS queries

Answer

Unusual outbound connections on port 443

Question 7

A security analyst is investigating a potential data exfiltration using DNS. Which TWO indicators are most consistent with DNS tunneling?

Accepted Answer

DNS responses with unusually large payload sizes. DNS tunneling often uses high query volume and large response sizes to encode data. Unusual TLDs are less common; frequent NXDOMAIN may indicate DGA, not tunneling.

Answer

Frequent NXDOMAIN responses

Answer

Queries for domains with unusual top-level domains (e.g., .tk)

Answer

Multiple queries from different hosts to the same legitimate domain

Question 8

A threat hunter is using osquery to look for persistence mechanisms on a set of Windows endpoints. Which THREE registry keys or scheduled tasks should the hunter check for common persistence?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Run keys, scheduled tasks, and services are common persistence locations. Startup folder is also common, but osquery can check Run keys directly. AppInit_DLLs is less common.

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

User's Startup folder

Question 9

An analyst is configuring correlation rules in a SIEM. Which TWO data sources are essential for detecting lateral movement using pass-the-hash attacks?

Accepted Answer

Authentication logs (e.g., Windows Event ID 4624). Pass-the-hash involves using NTLM hashes to authenticate. Authentication logs show logon events, and endpoint logs show process creation (e.g., wmic, psexec). Firewall logs may show network connections but are not specific to PtH.

Answer

Firewall logs

Answer

DNS logs

Answer

Vulnerability scan results

Question 10

An analyst is creating a YARA rule to detect a specific malware family that uses the string 'evil' in its PE file. Which of the following rule structures is correct?

Accepted Answer

rule detect_malware { strings: $a = "evil" condition: $a }. The standard YARA rule structure includes rule name, meta section, strings section, and condition section. The condition must reference the string.

Answer

rule detect_malware { strings: "evil" condition: $a }

Answer

rule detect_malware { condition: $a = "evil" }

Answer

if "evil" in file then alert

Question 11

Which of the following is a persistence mechanism that involves modifying the Windows Registry to execute a program when a user logs in?

Accepted Answer

Run key. The 'Run' registry key is commonly used to launch programs automatically at user logon, making it a persistence mechanism.

Answer

Scheduled Task

Answer

Service

Answer

Startup folder

Question 12

A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?

Accepted Answer

Frequent DNS queries to domains with random-looking, long subdomains. DGA domains are often algorithmically generated, resulting in random-looking, long domain names. High NXDOMAIN rates occur because many generated domains are not registered at the time of query.

Answer

All DNS queries are to internal DNS servers

Answer

DNS queries to domains with a high Alexa ranking

Answer

Consistent DNS query intervals to a single IP

Question 13

During a threat hunt, an analyst is looking for signs of lateral movement using pass-the-hash. Which three of the following log sources would be most useful for detecting this technique?

Accepted Answer

Sysmon Event ID 3 (network connection). Pass-the-hash involves using NTLM hashes to authenticate. Windows Event ID 4624 (successful logon) can show logon type 3 (network) with unusual source IPs. Sysmon Event ID 3 (network connection) can show outbound connections. Authentication logs on domain controllers show NTLM authentication attempts.

Answer

DNS query logs

Answer

Sysmon Event ID 1 (process creation)

Question 14

An analyst is investigating a potential data exfiltration incident. The analyst observes repeated HTTPS connections to a cloud storage provider from a server that does not normally use that service. Which three additional artifacts would strengthen the case for exfiltration?

Accepted Answer

The data transfer volume is significantly higher than normal for that server. Large outbound data volume, connections outside business hours, and use of non-standard ports (e.g., 443 for https but custom port for tunneling) are classic exfiltration indicators.

Answer

The connections are made to a known malicious IP

Answer

The connections occur during business hours only

Question 15

A threat hunter is analyzing network traffic and observes a system making outbound connections to multiple IP addresses on port 53 (DNS) with unusually large payload sizes. The hunter suspects DNS tunneling. Which THREE characteristics are indicative of DNS tunneling?

Accepted Answer

Large DNS payload sizes. DNS tunneling often involves large payloads, high query volume to a single domain, and non-standard record types to encode data.

Answer

DNS responses with NXDOMAIN for most queries

Answer

Use of standard A record queries