CS0-003 Security Operations Practice Test 11 — 15 Questions

Question 1

A security analyst is tuning a SIEM rule that generates alerts for every failed login attempt. The rule is causing alert fatigue. Which TWO actions would reduce false positives while maintaining security visibility?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Aggregate alerts by source IP and time window. Aggregating alerts by source IP reduces noise from individual attempts. Whitelisting known service accounts performing repeated failed logins (due to misconfigured services) also reduces false positives.

Answer

Disable the rule entirely

Answer

Increase the alert severity threshold

Answer

Increase the log retention period

Question 2

During a threat hunt, an analyst uses Velociraptor to collect forensic artifacts from endpoints. Which THREE of the following artifacts are most useful for detecting persistence mechanisms?

Accepted Answer

Scheduled tasks. Scheduled tasks, registry Run keys, and service configurations are common persistence locations monitored by attackers.

Answer

List of installed updates

Answer

ARP cache

Question 3

A SOC team is evaluating cloud-native security monitoring tools. Which TWO of the following are AWS services specifically designed for threat detection and security monitoring?

Accepted Answer

AWS GuardDuty. AWS GuardDuty is a threat detection service, and Security Hub aggregates security findings. Other services like CloudTrail are for logging, not primarily detection.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS VPC Flow Logs

Question 4

During a threat hunting exercise, an analyst creates a hypothesis that a threat actor may be using scheduled tasks for persistence. Which Windows registry key or log source should the analyst examine to confirm the hypothesis?

Accepted Answer

Review the Windows Security Event Log for event ID 4698 (scheduled task creation). Scheduled tasks are stored in the Windows Task Scheduler and can be viewed via schtasks.exe, but the registry also contains persistence mechanisms. However, scheduled tasks are not primarily stored in the registry; they are in %SystemRoot%\Tasks. Alternatively, the analyst can use the Task Scheduler API. But among the options, examining the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule' is not standard. Actually, the correct answer is to examine the Task Scheduler logs or the tasks folder. However, the question specifies registry key or log source. The best answer is to review the Windows Security Event Log for event ID 4698 (scheduled task creation).

Answer

Check the Run registry keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run)

Answer

Examine the System event log for driver loading events

Answer

Analyze the application event log for error messages

Question 5

A security analyst is reviewing a CASB alert indicating a user is accessing a cloud storage application from an unusual location. The analyst needs to investigate further. Which TWO actions are most appropriate?

Accepted Answer

Review the cloud application's audit logs for file access or sharing events. Checking the user's recent authentication logs can confirm if the access was legitimate. Reviewing the cloud application's audit logs can provide details on the activities performed. The other options are less relevant or too broad.

Answer

Disable the user's account immediately

Answer

Reset the user's password without further analysis

Answer

Block all access to the cloud application from that location

Question 6

A security analyst is creating a Sigma rule to detect use of the LOLBin 'certutil' for downloading payloads. Which THREE command-line arguments should the rule look for to indicate malicious use?

Accepted Answer

-urlcache. Certutil can be abused to download files using the '-urlcache' and '-split' arguments (or '-f' for force). The combination of '-urlcache' with a URL and output file is typical for downloading malicious payloads. '-verify' is legitimate, '-encode' and '-decode' are used for encoding/decoding, but '-urlcache' and '-split' are key for download.

Answer

-encode

Answer

-verify

Question 7

A security analyst is investigating a potential advanced persistent threat (APT) that uses living off the land binaries (LOLBins). The EDR has flagged several processes. Which THREE process behaviors are most indicative of LOLBin abuse? (Choose THREE.)

Accepted Answer

mshta.exe executing JavaScript from a remote URL. LOLBin abuse often involves using native tools in unusual ways: wmic for remote execution, mshta for executing malicious scripts, and certutil for downloading payloads. Bitsadmin is also used, but it's less common.

Answer

explorer.exe opening the Start menu

Answer

notepad.exe opening a .txt file in the user's Documents folder

Question 8

A cloud security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The instance is part of an auto-scaling group. What is the best immediate action?

Accepted Answer

Isolate the instance by modifying its security group to deny all traffic.. Isolating the instance by removing it from the security group or using a quarantine VPC prevents further communication while preserving forensic data.

Answer

Terminate the instance immediately to stop the threat.

Answer

Ignore the alert because auto-scaling groups are ephemeral.

Answer

Update the GuardDuty threat list to ignore that IP.

Question 9

A security analyst is using osquery to hunt for persistence mechanisms on a Windows endpoint. Which THREE Windows artifacts should the analyst query to identify common persistence locations? (Select THREE.)

Accepted Answer

Scheduled tasks in the Task Scheduler. Registry Run keys (T1547.001), scheduled tasks (T1053.005), and services (T1543.003) are common persistence mechanisms. Startup folders are also common but are not listed as a separate option here; the three listed are correct.

Answer

Windows Event Logs for login events

Answer

Network connections from the endpoint

Question 10

During a cloud security investigation, a security analyst notices unusual API calls from a compromised IAM user in AWS. The analyst wants to determine the scope of the breach and identify affected resources. Which TWO cloud-native services should the analyst use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity, and GuardDuty provides threat detection. Both are native services for investigation.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config

Question 11

A threat hunter is reviewing endpoint telemetry and sees a process 'svchost.exe' spawning 'cmd.exe', which then executes 'reg.exe add' to create a Run key. The hunter suspects persistence. Which TWO artifacts should the hunter examine to confirm persistence?

Accepted Answer

Registry Run keys. Run keys are stored in the registry, and scheduled tasks can also be created via command line. Examining these confirms persistence.

Answer

Windows Event Logs for service creation

Answer

Browser history

Answer

Network connections

Question 12

A SOC analyst is triaging a SIEM alert that indicates a possible DNS tunneling attack. The alert was generated based on a correlation rule that looks for unusually high DNS query volume from a single host. Which TWO additional data sources should the analyst correlate to confirm the attack?

Accepted Answer

DNS server logs. DNS logs can show query patterns and payload sizes. NetFlow can show data transfer volumes. Both help confirm tunneling.

Answer

Firewall logs

Answer

Endpoint registry logs

Answer

Authentication logs

Question 13

A security analyst is creating a YARA rule to detect a specific malware strain that uses a unique string in its code section and has a characteristic import table. The analyst wants to minimize false positives. Which THREE YARA rule elements should the analyst include?

Accepted Answer

File size condition. Including file size limits, a specific string, and the import table condition reduces false positives by narrowing the scope.

Answer

Hash condition

Answer

Module condition (e.g., pe)

Question 14

During a memory forensics investigation, a security analyst identifies a process that appears to have code injected into it. The process is 'explorer.exe' and its memory contains sections that are not part of the original executable. Which TWO memory analysis techniques should the analyst use to confirm code injection?

Accepted Answer

Scan for executable memory pages not backed by a file on disk. Comparing the process's loaded DLL list with the expected list can reveal anomalies. Checking for executable memory pages that are not backed by a known module is another indicator.

Answer

List the process's open handles

Answer

Examine the process's environment variables

Answer

Check the process's parent process

Question 15

A threat hunter is using Velociraptor to search for signs of lateral movement across multiple endpoints. The hunter wants to identify instances where a user logged into multiple systems using the same credentials within a short time frame. Which THREE artifacts should the hunter collect from each endpoint?

Accepted Answer

Network connections (netstat). Security Event Logs (Event ID 4624) show logon sessions, network connections show remote access, and WMI Activity logs can indicate lateral movement via WMI.

Answer

File system for malicious executables

Answer

Registry hives for persistence