CS0-003 Security Operations Practice Test 11 — 15 Questions

Question 1

An analyst is reviewing network traffic logs and notices a series of connections from an internal workstation to an external IP address on TCP port 53. The traffic consists of large DNS queries with random-looking subdomains. Which technique is most likely being used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DNS tunneling. DNS tunneling is the technique of encoding non-DNS data (such as command-and-control instructions or exfiltrated data) inside DNS queries and responses, typically using large queries with random-looking subdomains to external authoritative servers controlled by the attacker. The use of TCP port 53 with large, high-entropy subdomains from an internal workstation to an external IP is a classic DNS tunneling signature.

Answer

Domain generation algorithm (DGA)

Answer

Beaconing

Answer

HTTP smuggling

Question 2

A security team is configuring a vulnerability scanner for external scanning of their public-facing web applications. Which scan type will provide the most accurate assessment of vulnerabilities without requiring credentials?

Accepted Answer

External scan. An external scan assesses the attack surface from the internet perspective, typically without credentials. Agent-based and authenticated scans require credentials or internal access.

Answer

Agent-based scan

Answer

Authenticated scan

Answer

Internal scan

Question 3

An analyst is tasked with creating a correlation rule in the SIEM to detect beaconing activity. Which log sources and fields are most relevant to model this behavior?

Accepted Answer

Firewall logs and connection timestamps. Beaconing involves periodic outbound connections, so firewall logs (source IP, destination IP, destination port) and connection timestamps are essential for detecting regularity.

Answer

Authentication logs and user IDs

Answer

Endpoint logs and process creation

Answer

DNS logs and query types

Question 4

During a threat hunting exercise, the hunter creates a hypothesis based on recent threat intelligence about a new ransomware variant that uses scheduled tasks for persistence. Which ATT&CK technique should the hunter focus on?

Accepted Answer

T1053.005 (Scheduled Task). Scheduled tasks are a persistence technique (T1053.005). The hunter should focus on the persistence tactic and the specific technique for scheduled tasks.

Answer

T1566.001 (Spearphishing Attachment)

Answer

T1059.001 (PowerShell)

Answer

T1547.001 (Registry Run Keys)

Question 5

A cloud security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The instance is part of an auto-scaling group. What is the best immediate action?

Accepted Answer

Isolate the instance by modifying its security group to deny all traffic.. Isolating the instance by removing it from the security group or using a quarantine VPC prevents further communication while preserving forensic data.

Answer

Terminate the instance immediately to stop the threat.

Answer

Ignore the alert because auto-scaling groups are ephemeral.

Answer

Update the GuardDuty threat list to ignore that IP.

Question 6

A SIEM alert is generated for a user who logged into a workstation at 2:00 AM, which is outside their normal working hours. The user's manager confirms the user was on call and had legitimate reason to log in. How should the analyst classify this alert?

Accepted Answer

False positive. The alert is a false positive because the activity is legitimate despite being outside normal hours.

Answer

False negative

Answer

True positive

Answer

True negative

Question 7

A security analyst is using osquery to hunt for persistence mechanisms on a Windows endpoint. Which THREE Windows artifacts should the analyst query to identify common persistence locations? (Select THREE.)

Accepted Answer

Scheduled tasks in the Task Scheduler. Option A is correct because scheduled tasks in the Task Scheduler are a classic persistence mechanism, allowing attackers to execute code at defined times or triggers, and osquery can enumerate them via the scheduled_tasks table. Option D is correct because the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run registry key causes programs to launch automatically at user logon, a well-known autostart location queryable through osquery's registry table. Option E is correct because services registered in the Service Control Manager can be configured to start automatically at boot, providing persistent execution, and osquery exposes them via the services table. Option B does not belong because Windows Event Logs for login events are useful for auditing authentication activity, not for identifying persistence locations. Option C does not belong because network connections reflect current or recent communications, not a persistence mechanism stored on the endpoint.

Answer

Windows Event Logs for login events

Answer

Network connections from the endpoint

Question 8

A security analyst is reviewing a SIEM alert that triggered on a known malicious IP address communicating with an internal server. The analyst checks the threat intelligence feed and confirms the IP is associated with a command-and-control server. What type of alert is this?

Accepted Answer

True positive. A true positive means the alert correctly identified a real malicious event. Here the SIEM flagged communication with a known C2 IP, threat intel confirmed the IP is malicious, and the internal server is genuinely talking to it — so the detection is accurate and the incident is real. This is the textbook definition of a true positive in alert triage.

Answer

False negative

Answer

False positive

Answer

True negative

Question 9

During a network traffic analysis, a security analyst notices a high volume of DNS queries to a domain that is algorithmically generated. The domain names follow a random pattern and are not resolved to known IP addresses. Which technique is most likely being used?

Accepted Answer

Domain generation algorithm (DGA). Domain Generation Algorithms (DGAs) are commonly used by malware to generate a large number of potential C2 domain names to evade static blocklists.

Answer

DNS tunneling

Answer

Beaconing

Answer

HTTP smuggling

Question 10

A security analyst is investigating an alert from the EDR tool indicating that a process named 'powershell.exe' was launched with a parent process 'winword.exe'. The user's workstation had received a phishing email earlier that day. Which type of attack does this likely indicate?

Accepted Answer

Living off the land binary (LOLBin) abuse. The parent-child relationship of winword.exe spawning powershell.exe is a classic indicator of a malicious macro executing PowerShell code, often used in phishing attacks.

Answer

Process hollowing

Answer

Injection of code into explorer.exe

Answer

Scheduled task creation

Question 11

During a threat hunting engagement, an analyst creates a hypothesis based on a recent threat intelligence report about a new APT group using DLL side-loading for persistence. The analyst decides to search for processes that have loaded a known vulnerable DLL. Which framework is most appropriate to map the TTPs?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the most comprehensive framework for mapping adversary TTPs, including persistence techniques like DLL side-loading (T1574.002).

Answer

Diamond Model

Answer

NIST CSF

Answer

Cyber Kill Chain

Question 12

A security analyst is tuning a SIEM correlation rule that triggers on failed login attempts. The rule is generating a high number of alerts from a specific user who frequently mistypes passwords. The analyst wants to reduce false positives while maintaining detection of brute-force attacks. Which TWO actions should the analyst take?

Accepted Answer

Exclude the specific user account from the rule. Increasing the threshold to require more failed attempts in the time window helps ignore simple mistypes, and excluding the specific user account from the rule prevents alerts for that benign behavior.

Answer

Delete the correlation rule and create a new one from scratch

Answer

Change the rule to alert on every single failed login

Answer

Increase the severity of the rule to trigger an immediate response

Question 13

A security analyst is performing a vulnerability scan on an internal network. The analyst wants to ensure the scanner can identify vulnerabilities in applications that require authentication. Which TWO scan configurations should be used?

Accepted Answer

Agent-based scan. Credentialed scans allow the scanner to authenticate to systems and perform deeper checks, while authenticated scans (agent-based) can also provide access.

Answer

Scan with default credentials

Answer

Non-credentialed scan

Answer

External scan

Question 14

A SOC analyst is triaging a SIEM alert that indicates a possible DNS tunneling attack. The alert was generated based on a correlation rule that looks for unusually high DNS query volume from a single host. Which TWO additional data sources should the analyst correlate to confirm the attack?

Accepted Answer

DNS server logs. DNS server logs (C) are essential because they capture the actual query names, record types (e.g., TXT, NULL, CNAME), response sizes, and query/response patterns that reveal the encoded exfiltration payloads and high-entropy subdomains typical of DNS tunneling. NetFlow/IPFIX (E) provides flow-level metadata such as packet and byte counts, flow duration, and destination IPs/ports, which helps confirm the sustained, periodic, or oversized DNS traffic volume to an external resolver that the SIEM rule flagged. Together these sources let the analyst validate that the high query volume is anomalous in content (C) and in traffic behavior (E), which is what distinguishes tunneling from benign DNS activity. Firewall logs (A) mainly show allowed/denied connections and port usage rather than DNS query content, so they add limited confirmation value here. Endpoint registry logs (B) are unrelated to DNS query behavior, and authentication logs (D) would only help if credential abuse were suspected, neither of which supports confirming DNS tunneling.

Answer

Firewall logs

Answer

Endpoint registry logs

Answer

Authentication logs

Question 15

During a memory forensics investigation, a security analyst identifies a process that appears to have code injected into it. The process is 'explorer.exe' and its memory contains sections that are not part of the original executable. Which TWO memory analysis techniques should the analyst use to confirm code injection?

Accepted Answer

Scan for executable memory pages not backed by a file on disk. Option D is correct because injected code typically resides in memory regions that are executable but have no corresponding file on disk; tools like Volatility's malfind or PE-sieve flag such RWX/VAD regions as strong indicators of injection. Option E is correct because comparing the loaded module/DLL list against a known-good baseline reveals unexpected or unsigned DLLs loaded into explorer.exe, which is a classic sign of DLL injection or reflective loading. Option A is not specific to code injection, since open handles (files, registry keys, mutexes) are normal for explorer.exe and do not prove injected code. Option B is not relevant, as environment variables are process metadata and are not used to detect injected executable memory. Option C is also not diagnostic, because the parent process (typically userinit.exe or winlogon.exe) only shows process lineage, not memory-resident code injection.

Answer

List the process's open handles

Answer

Examine the process's environment variables

Answer

Check the process's parent process