CS0-003 Security Operations Practice Test 11 — 15 Questions

Question 1

A security analyst is reviewing a SIEM alert that triggered on a known malicious IP address communicating with an internal server. The analyst checks the threat intelligence feed and confirms the IP is associated with a command-and-control server. What type of alert is this?

Accepted Answer

True positive. A true positive occurs when an alert correctly identifies malicious activity. The IP is confirmed as a C2 server, so the alert is valid.

Answer

False negative

Answer

False positive

Answer

True negative

Question 2

During a network traffic analysis, a security analyst notices a high volume of DNS queries to a domain that is algorithmically generated. The domain names follow a random pattern and are not resolved to known IP addresses. Which technique is most likely being used?

Accepted Answer

Domain generation algorithm (DGA). Domain Generation Algorithms (DGAs) are commonly used by malware to generate a large number of potential C2 domain names to evade static blocklists.

Answer

DNS tunneling

Answer

Beaconing

Answer

HTTP smuggling

Question 3

A security analyst is investigating an alert from the EDR tool indicating that a process named 'powershell.exe' was launched with a parent process 'winword.exe'. The user's workstation had received a phishing email earlier that day. Which type of attack does this likely indicate?

Accepted Answer

Living off the land binary (LOLBin) abuse. The parent-child relationship of winword.exe spawning powershell.exe is a classic indicator of a malicious macro executing PowerShell code, often used in phishing attacks.

Answer

Process hollowing

Answer

Injection of code into explorer.exe

Answer

Scheduled task creation

Question 4

During a threat hunting engagement, an analyst creates a hypothesis based on a recent threat intelligence report about a new APT group using DLL side-loading for persistence. The analyst decides to search for processes that have loaded a known vulnerable DLL. Which framework is most appropriate to map the TTPs?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the most comprehensive framework for mapping adversary TTPs, including persistence techniques like DLL side-loading (T1574.002).

Answer

Diamond Model

Answer

NIST CSF

Answer

Cyber Kill Chain

Question 5

A security analyst is tuning a SIEM correlation rule that triggers on failed login attempts. The rule is generating a high number of alerts from a specific user who frequently mistypes passwords. The analyst wants to reduce false positives while maintaining detection of brute-force attacks. Which TWO actions should the analyst take?

Accepted Answer

Exclude the specific user account from the rule. Increasing the threshold to require more failed attempts in the time window helps ignore simple mistypes, and excluding the specific user account from the rule prevents alerts for that benign behavior.

Answer

Delete the correlation rule and create a new one from scratch

Answer

Change the rule to alert on every single failed login

Answer

Increase the severity of the rule to trigger an immediate response

Question 6

A security analyst is performing a vulnerability scan on an internal network. The analyst wants to ensure the scanner can identify vulnerabilities in applications that require authentication. Which TWO scan configurations should be used?

Accepted Answer

Agent-based scan. Credentialed scans allow the scanner to authenticate to systems and perform deeper checks, while authenticated scans (agent-based) can also provide access.

Answer

Scan with default credentials

Answer

Non-credentialed scan

Answer

External scan

Question 7

During a cloud security investigation, a security analyst notices unusual API calls from a compromised IAM user in AWS. The analyst wants to determine the scope of the breach and identify affected resources. Which TWO cloud-native services should the analyst use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, and GuardDuty provides threat detection. Both are native services for investigation.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config

Question 8

A threat hunter is reviewing endpoint telemetry and sees a process 'svchost.exe' spawning 'cmd.exe', which then executes 'reg.exe add' to create a Run key. The hunter suspects persistence. Which TWO artifacts should the hunter examine to confirm persistence?

Accepted Answer

Registry Run keys. Run keys are stored in the registry, and scheduled tasks can also be created via command line. Examining these confirms persistence.

Answer

Windows Event Logs for service creation

Answer

Browser history

Answer

Network connections

Question 9

A security analyst is investigating a potential data exfiltration incident. Network traffic analysis shows large outbound data transfers to an external IP address on port 443. The analyst wants to determine if the data was encrypted. Which THREE tools or techniques should the analyst use?

Accepted Answer

Wireshark. Wireshark can capture and analyze packets, NetFlow provides flow-level metadata, and examining TLS handshake can determine encryption.

Answer

OSINT tools

Answer

Vulnerability scanner

Question 10

A SOC analyst is triaging a SIEM alert that indicates a possible DNS tunneling attack. The alert was generated based on a correlation rule that looks for unusually high DNS query volume from a single host. Which TWO additional data sources should the analyst correlate to confirm the attack?

Accepted Answer

DNS server logs. DNS logs can show query patterns and payload sizes. NetFlow can show data transfer volumes. Both help confirm tunneling.

Answer

Firewall logs

Answer

Endpoint registry logs

Answer

Authentication logs

Question 11

A security analyst is creating a YARA rule to detect a specific malware strain that uses a unique string in its code section and has a characteristic import table. The analyst wants to minimize false positives. Which THREE YARA rule elements should the analyst include?

Accepted Answer

File size condition. Including file size limits, a specific string, and the import table condition reduces false positives by narrowing the scope.

Answer

Hash condition

Answer

Module condition (e.g., pe)

Question 12

During a memory forensics investigation, a security analyst identifies a process that appears to have code injected into it. The process is 'explorer.exe' and its memory contains sections that are not part of the original executable. Which TWO memory analysis techniques should the analyst use to confirm code injection?

Accepted Answer

Scan for executable memory pages not backed by a file on disk. Comparing the process's loaded DLL list with the expected list can reveal anomalies. Checking for executable memory pages that are not backed by a known module is another indicator.

Answer

List the process's open handles

Answer

Examine the process's environment variables

Answer

Check the process's parent process

Question 13

A threat hunter is using Velociraptor to search for signs of lateral movement across multiple endpoints. The hunter wants to identify instances where a user logged into multiple systems using the same credentials within a short time frame. Which THREE artifacts should the hunter collect from each endpoint?

Accepted Answer

Network connections (netstat). Security Event Logs (Event ID 4624) show logon sessions, network connections show remote access, and WMI Activity logs can indicate lateral movement via WMI.

Answer

File system for malicious executables

Answer

Registry hives for persistence

Question 14

A security analyst is reviewing an alert from Azure Sentinel that indicates a possible privilege escalation attempt. The alert is based on a correlation rule that detects unusual usage of the 'Add-AzKeyVaultKey' cmdlet by a user who has never used it before. The analyst needs to validate the alert and determine if the activity is malicious. Which THREE actions should the analyst take?

Accepted Answer

Check the user's role assignments and permissions. Checking Azure AD logs for the authentication context, reviewing the user's recent activity history, and examining the Key Vault audit logs for any subsequent access are all relevant steps.

Answer

Run a vulnerability scan on the user's workstation

Answer

Disable the user account immediately

Question 15

A security analyst is analyzing a PCAP file from a network incident and notices a series of TCP connections with unusual flag combinations. Specifically, the SYN flag is set but the ACK flag is not set in the response, and the sequence numbers are not incrementing properly. The analyst suspects a TCP handshake manipulation. Which THREE TCP anomalies should the analyst document?

Accepted Answer

Sequence numbers that are out of order. SYN-ACK without ACK, inconsistent sequence numbers, and SYN flood patterns are all anomalies that could indicate attacks like SYN flood or TCP hijacking.

Answer

FIN packets with no prior data transfer

Answer

RST packets with the ACK flag set