CS0-003 Security Operations Practice Test 3 — 15 Questions

Question 1

A security analyst is reviewing a SIEM alert for a single failed login attempt from an internal IP address to a file server. The analyst determines this is a false positive. Which step should the analyst take next?

Accepted Answer

Tune the alert to suppress similar events. After confirming a false positive, the analyst should tune the alert to reduce noise. This may involve adjusting thresholds or whitelisting the source.

Answer

Escalate to a senior analyst

Answer

Disable the SIEM alert permanently

Answer

Create a correlation rule to link with other events

Question 2

During a network traffic analysis, a security analyst observes repeated connections from an internal host to a known malicious IP on port 4444. The payload appears to be encrypted. Which type of activity is most likely indicated?

Accepted Answer

Command and control beaconing. Repeated connections to a known malicious IP on a non-standard port with encrypted payloads strongly suggest command and control (C2) beaconing.

Answer

Port scanning activity

Answer

Data exfiltration via DNS tunnelling

Answer

Lateral movement using SMB

Question 3

A threat hunter notices that a legitimate Windows binary 'rundll32.exe' is executing with network connections to an external IP address. The parent process is 'winword.exe'. Which LOLBin technique is most likely being used?

Accepted Answer

DLL side-loading via rundll32. Rundll32.exe is a known LOLBin that can be used to execute DLLs. When spawned from winword.exe, it often indicates a macro-based attack loading a remote payload.

Answer

Scheduled task creation

Answer

Process hollowing

Answer

WMI persistence

Question 4

A vulnerability scan report shows a critical finding with a CVSS score of 9.8. The system is a web server behind a WAF that blocks the attack vector. What should the analyst do?

Accepted Answer

Document the WAF as a compensating control and accept the risk. A compensating control (WAF) may mitigate the risk. The analyst should document it and adjust the risk rating accordingly.

Answer

Report the finding as a false positive

Answer

Re-run the scan with credentials

Answer

Patch the server immediately

Question 5

An analyst reviews AWS CloudTrail logs and detects multiple 'CreateNetworkAclEntry' API calls from a user who does not typically perform network administration. What type of activity is this?

Accepted Answer

Privilege escalation or lateral movement. Unusual API calls from a user outside their normal role may indicate privilege abuse or a compromised account.

Answer

Cloud misconfiguration

Answer

Normal administrative activity

Answer

Data exfiltration via NACL

Question 6

A security analyst is creating a Sigma rule to detect suspicious usage of 'schtasks.exe' to create a scheduled task that runs an encoded PowerShell command. Which log source is most appropriate for this rule?

Accepted Answer

Sysmon Event ID 1 (Process creation). Sigma rules are written for log sources. Process creation logs (e.g., Event ID 4688 or Sysmon Event ID 1) capture command-line arguments.

Answer

Windows Security Event Log (Event ID 4624)

Answer

DNS server log

Answer

Windows PowerShell operational log

Question 7

During memory analysis of a compromised host, an analyst finds a process that appears to be 'svchost.exe' but with an unusual parent process (not 'services.exe'). The process also has injected code in its memory. What is the most likely explanation?

Accepted Answer

The svchost.exe is a hollowed process used for malicious purposes. Svchost.exe should always have services.exe as parent. A different parent suggests process hollowing where an attacker replaced the legitimate process memory.

Answer

The process is a legitimate svchost.exe but spawned by a different service

Answer

The process is a DLL injection into svchost.exe

Answer

The svchost.exe process is a false positive due to a known Windows bug

Question 8

An analyst is investigating a potential data exfiltration via DNS. Which tool would best help identify DNS tunnelling by analyzing packet payloads and query patterns?

Accepted Answer

Wireshark. Wireshark can capture and analyze DNS packets in detail, including payload and query patterns, making it suitable for detecting DNS tunnelling.

Answer

tcpdump

Answer

nmap

Answer

NetFlow

Question 9

An organization wants to detect threats in their AWS environment using a cloud-native service that monitors for suspicious API calls and potential credential compromise. Which service should they use?

Accepted Answer

AWS GuardDuty. AWS GuardDuty is a threat detection service that monitors for malicious activity, including suspicious API calls and credential compromise.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Inspector

Question 10

A security analyst is triaging a SIEM alert for 'Multiple failed logins followed by a successful login from a remote IP'. The successful login occurs after 10 failed attempts. What is the most likely classification?

Accepted Answer

True positive for a brute-force attack. The pattern of multiple failures followed by a success strongly indicates a successful brute-force attack, which is a true positive.

Answer

False positive due to a misconfigured application

Answer

False positive due to user error

Answer

True positive for a password spraying attack

Question 11

An analyst detects a process named 'powershell.exe' executing a base64-encoded command. Which type of analysis is most appropriate to decode and understand the command?

Accepted Answer

Process analysis. Base64-encoded commands are common in PowerShell attacks. Decoding and analyzing the script is part of endpoint analysis, specifically process analysis.

Answer

Memory analysis

Answer

Registry analysis

Answer

Network traffic analysis

Question 12

An analyst is investigating a host that communicates with a domain using a DGA-like algorithm. The domain name appears random and resolves to different IPs over time. Which threat-hunting technique would best identify the DGA pattern?

Accepted Answer

DNS log analysis for entropy and frequency. DGA domains can be detected by analyzing DNS query patterns for algorithmic generation, often using frequency analysis or ML models.

Answer

Sigma rule on process creation events

Answer

NetFlow analysis for data volume

Answer

YARA rule matching on process memory

Question 13

A security analyst is configuring a vulnerability scanner for an internal network. Which two settings are most important for reducing false positives during the scan? (Choose two.)

Accepted Answer

Disabling unnecessary plug-ins. Credentialed scans access system details for accurate results, and appropriate plug-in selection reduces irrelevant checks.

Answer

Using a higher scan intensity

Answer

Scanning from multiple IP addresses

Answer

Scanning only during business hours

Question 14

During an incident response, an analyst identifies suspicious registry modifications in the 'Run' key and a scheduled task that executes a script. Which three persistence mechanisms are most likely being used? (Choose three.)

Accepted Answer

Service. Run keys, scheduled tasks, and services are common persistence mechanisms. Startup folders are also common but not listed as a separate option here.

Answer

AppInit_DLLs

Answer

WMI event subscription

Question 15

An analyst is creating a detection rule for lateral movement using SMB. Which two network indicators should be included in the rule? (Choose two.)

Accepted Answer

SMB traffic between workstations. Lateral movement over SMB often involves file writes to admin shares (IPC$) and unusual SMB traffic patterns.

Answer

Repeated failed logins to multiple hosts

Answer

High volume of DNS queries

Answer

Unusual outbound connections on port 443