CS0-003 Security Operations Practice Test 2 — 15 Questions

Question 1

During a network traffic analysis, a security analyst observes repeated connections from an internal host to an external IP address on TCP port 53. The traffic volume is low but consistent. What type of anomaly is most likely indicated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data exfiltration via DNS tunneling. DNS tunneling often uses port 53 to exfiltrate data by encoding it in DNS queries. The consistent low-volume traffic to a single external IP suggests covert communication.

Answer

Lateral movement using SMB

Answer

Port scan activity from an internal host

Answer

Beaconing to a command-and-control server

Question 2

A security analyst is triaging an alert from the EDR that shows the process 'powershell.exe' with a parent process of 'winword.exe'. The user recently opened a document from an email. What is the most likely explanation?

Accepted Answer

The document contains a malicious macro that spawned PowerShell to execute commands. This is a classic sign of a macro-based attack where a malicious document spawns PowerShell to execute payloads.

Answer

The user double-clicked a PowerShell script attached to the email

Answer

A scheduled task started PowerShell that initiated Word

Answer

The user is running a legitimate PowerShell script from within a Word document

Question 3

A vulnerability scan report shows a critical vulnerability with a CVSS score of 10.0. The application team states that the affected service is isolated in a DMZ and has no access to sensitive data. What should the analyst consider?

Accepted Answer

Accept the risk based on compensating controls. Compensating controls like network isolation can reduce the risk even if the vulnerability itself is critical.

Answer

Reclassify the vulnerability as low severity

Answer

Immediately patch the vulnerability

Answer

Ignore the finding as a false positive

Question 4

A threat intelligence report indicates that a known APT group is using 'regsvr32.exe' to execute malicious code. Which detection rule type would be most effective in identifying this technique across multiple endpoints?

Accepted Answer

Sigma rule. Sigma rules are designed for log detection across SIEMs, making them suitable for detecting specific command-line patterns like regsvr32 execution.

Answer

Snort rule

Answer

YARA rule

Answer

Suricata rule

Question 5

An analyst examines a memory dump from a compromised host and finds that 'svchost.exe' is executing code from a memory region that is not backed by any executable file. What technique is most likely being used?

Accepted Answer

Process hollowing. Hollowing involves replacing a legitimate process's memory with malicious code, leaving no corresponding file on disk.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection

Question 6

A cloud security analyst reviews AWS CloudTrail logs and notices multiple 'RunInstances' API calls from a single IAM user creating EC2 instances with public IP addresses in an unusual region. What is the most likely concern?

Accepted Answer

The user's credentials may be compromised and used for cryptomining. Creating instances in unusual regions with public IPs could indicate compromised credentials being used for cryptomining or other malicious activity.

Answer

The user is performing legitimate scaling operations

Answer

The user is provisioning resources for a new project

Answer

The user is testing disaster recovery procedures

Question 7

Which analysis technique involves examining the parent-child relationships of processes to identify potentially malicious activity?

Accepted Answer

Process analysis. Process analysis looks at process trees to find anomalies like a word processor spawning a command shell.

Answer

Network analysis

Answer

Memory analysis

Answer

Registry analysis

Question 8

A security analyst notices that a firewall log shows outbound traffic from an internal server to an external IP address on TCP port 443, but the server is not configured to make any outbound connections. The analyst checks previous logs and finds similar connections every 60 minutes. What type of activity is most likely occurring?

Accepted Answer

Beaconing to a command-and-control server. Regular check-ins to an external IP on a common port like 443 is typical of beaconing to a C2 server.

Answer

Normal software update check

Answer

DNS tunneling

Answer

Data exfiltration via FTP

Question 9

During a threat hunt, an analyst queries osquery to find processes where the 'cmdline' contains ' -e ' and the parent process is not 'explorer.exe'. This query is designed to detect which technique?

Accepted Answer

Malicious PowerShell execution. PowerShell with -e (encoded command) is often used for obfuscation; unusual parent processes suggest malicious execution.

Answer

Lateral movement via PsExec

Answer

DLL injection via rundll32

Answer

Scheduled task creation

Question 10

A security analyst is configuring a SIEM correlation rule to detect potential brute-force attacks. Which log source combination is most appropriate for this rule?

Accepted Answer

Authentication logs and firewall logs. Authentication logs show login attempts, and firewall logs show source IPs; combining them can detect multiple failed logins from an IP.

Answer

Authentication logs and DNS logs

Answer

Firewall logs and IDS logs

Answer

Endpoint logs and cloud audit logs

Question 11

An analyst is investigating a suspected data exfiltration via HTTP. The analyst examines a PCAP file and finds a series of HTTP POST requests to an external site with varying 'Content-Length' values. The payloads appear to be base64-encoded strings. Which tool would be most effective for extracting and decoding the payloads for analysis?

Accepted Answer

Python with scapy. Python with scapy allows custom scripting to extract and decode payloads from PCAP files.

Answer

Wireshark

Answer

tcpdump

Answer

NetFlow

Question 12

A security analyst is hunting for signs of lateral movement in the network. Which THREE indicators are most consistent with lateral movement techniques?

Accepted Answer

An RDP connection from a domain controller to a workstation. Lateral movement often involves remote execution tools (PsExec), remote service creation, and suspicious RDP connections.

Answer

Unusual outbound DNS queries to known malicious domains

Answer

Multiple failed logins from a single workstation to many servers

Question 13

An analyst is reviewing a CASB alert indicating that a user accessed a cloud application from a geolocation that is not typical for the organization. Which THREE additional data sources would be most helpful to determine if the activity is malicious?

Accepted Answer

User activity logs from the cloud application. Authentication logs show if the login was successful and from which IP; threat intel can identify if the IP is malicious; user activity logs show behavior patterns.

Answer

Firewall logs showing outbound connections

Answer

Vulnerability scan results for the user's workstation

Question 14

A security analyst is reviewing a SIEM alert for a single failed login attempt from an internal IP address to a file server. The analyst determines this is a false positive. Which step should the analyst take next?

Accepted Answer

Tune the alert to suppress similar events. After confirming a false positive, the analyst should tune the alert to reduce noise. This may involve adjusting thresholds or whitelisting the source.

Answer

Escalate to a senior analyst

Answer

Disable the SIEM alert permanently

Answer

Create a correlation rule to link with other events

Question 15

A threat hunter notices that a legitimate Windows binary 'rundll32.exe' is executing with network connections to an external IP address. The parent process is 'winword.exe'. Which LOLBin technique is most likely being used?

Accepted Answer

DLL side-loading via rundll32. Rundll32.exe is a known LOLBin that can be used to execute DLLs. When spawned from winword.exe, it often indicates a macro-based attack loading a remote payload.

Answer

Scheduled task creation

Answer

Process hollowing

Answer

WMI persistence