CS0-003 Security Operations Practice Test 3 — 15 Questions

Question 1

A vulnerability scan report shows a critical finding with a CVSS score of 9.8. The system is a web server behind a WAF that blocks the attack vector. What should the analyst do?

Accepted Answer

Document the WAF as a compensating control and accept the risk. A compensating control (WAF) may mitigate the risk. The analyst should document it and adjust the risk rating accordingly.

Answer

Report the finding as a false positive

Answer

Re-run the scan with credentials

Answer

Patch the server immediately

Question 2

An analyst reviews AWS CloudTrail logs and detects multiple 'CreateNetworkAclEntry' API calls from a user who does not typically perform network administration. What type of activity is this?

Accepted Answer

Privilege escalation or lateral movement. Unusual API calls from a user outside their normal role may indicate privilege abuse or a compromised account.

Answer

Cloud misconfiguration

Answer

Normal administrative activity

Answer

Data exfiltration via NACL

Question 3

A security analyst is creating a Sigma rule to detect suspicious usage of 'schtasks.exe' to create a scheduled task that runs an encoded PowerShell command. Which log source is most appropriate for this rule?

Accepted Answer

Sysmon Event ID 1 (Process creation). Sigma rules are written for log sources. Process creation logs (e.g., Event ID 4688 or Sysmon Event ID 1) capture command-line arguments.

Answer

Windows Security Event Log (Event ID 4624)

Answer

DNS server log

Answer

Windows PowerShell operational log

Question 4

During memory analysis of a compromised host, an analyst finds a process that appears to be 'svchost.exe' but with an unusual parent process (not 'services.exe'). The process also has injected code in its memory. What is the most likely explanation?

Accepted Answer

The svchost.exe is a hollowed process used for malicious purposes. Svchost.exe should always have services.exe as parent. A different parent suggests process hollowing where an attacker replaced the legitimate process memory.

Answer

The process is a legitimate svchost.exe but spawned by a different service

Answer

The process is a DLL injection into svchost.exe

Answer

The svchost.exe process is a false positive due to a known Windows bug

Question 5

An analyst is investigating a potential data exfiltration via DNS. Which tool would best help identify DNS tunnelling by analyzing packet payloads and query patterns?

Accepted Answer

Wireshark. Wireshark can capture and analyze DNS packets in detail, including payload and query patterns, making it suitable for detecting DNS tunnelling.

Answer

tcpdump

Answer

nmap

Answer

NetFlow

Question 6

An organization wants to detect threats in their AWS environment using a cloud-native service that monitors for suspicious API calls and potential credential compromise. Which service should they use?

Accepted Answer

AWS GuardDuty. AWS GuardDuty is a threat detection service that monitors for malicious activity, including suspicious API calls and credential compromise.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Inspector

Question 7

A security analyst is triaging a SIEM alert for 'Multiple failed logins followed by a successful login from a remote IP'. The successful login occurs after 10 failed attempts. What is the most likely classification?

Accepted Answer

True positive for a brute-force attack. The pattern of multiple failures followed by a success strongly indicates a successful brute-force attack, which is a true positive.

Answer

False positive due to a misconfigured application

Answer

False positive due to user error

Answer

True positive for a password spraying attack

Question 8

An analyst detects a process named 'powershell.exe' executing a base64-encoded command. Which type of analysis is most appropriate to decode and understand the command?

Accepted Answer

Process analysis. Base64-encoded commands are common in PowerShell attacks. Decoding and analyzing the script is part of endpoint analysis, specifically process analysis.

Answer

Memory analysis

Answer

Registry analysis

Answer

Network traffic analysis

Question 9

An analyst is investigating a host that communicates with a domain using a DGA-like algorithm. The domain name appears random and resolves to different IPs over time. Which threat-hunting technique would best identify the DGA pattern?

Accepted Answer

DNS log analysis for entropy and frequency. DGA domains can be detected by analyzing DNS query patterns for algorithmic generation, often using frequency analysis or ML models.

Answer

Sigma rule on process creation events

Answer

NetFlow analysis for data volume

Answer

YARA rule matching on process memory

Question 10

During an incident response, an analyst identifies suspicious registry modifications in the 'Run' key and a scheduled task that executes a script. Which three persistence mechanisms are most likely being used? (Choose three.)

Accepted Answer

Scheduled task. The incident mentions a registry Run key modification and a scheduled task. These are two persistence mechanisms. No information suggests a service is involved. Therefore, the correct answer should be C and E. The question as written ('Choose three') is inconsistent with the evidence.

Answer

AppInit_DLLs

Answer

Service

Answer

WMI event subscription

Question 11

A security analyst is reviewing SIEM alerts and notices a high volume of alerts for a specific event ID that has been determined to be benign. Which action should the analyst take to reduce noise?

Accepted Answer

Create a suppression rule for that event ID. True positive alerts are genuine threats; false positives are benign. Tuning the SIEM to suppress known false positives reduces alert fatigue.

Answer

Increase the severity of the alert

Answer

Reclassify the alert as a true positive

Answer

Disable the SIEM correlation engine

Question 12

During a network traffic analysis, a security analyst observes repeated TCP SYN packets sent to a host that responds with SYN-ACK, but the connection never completes. What type of anomaly is this?

Accepted Answer

SYN flood. A half-open TCP handshake (SYN flood) is a common DoS technique where the attacker sends many SYN packets without completing the handshake, exhausting server resources.

Answer

DNS amplification

Answer

ARP spoofing

Answer

Port scan

Question 13

A security analyst is investigating an alert from an endpoint EDR that shows a process with a parent-child relationship where the parent is Microsoft Word and the child process is wscript.exe executing a command to download a PowerShell script. Which MITRE ATT&CK technique does this likely represent?

Accepted Answer

Phishing (T1566). Phishing often delivers malicious documents. Word spawning wscript.exe to download a script is a classic phishing payload delivery, sub-technique T1566.001.

Answer

Lateral Movement (TA0008)

Answer

Credential dumping (T1003)

Answer

Persistence (TA0003)

Question 14

A security team is reviewing cloud audit logs from AWS CloudTrail and notices repeated API calls to create EC2 instances in a region where the organization has no presence. What is the most likely cause?

Accepted Answer

Compromised AWS credentials. Unauthorized API calls to create resources in unusual regions often indicate compromised credentials or an attacker using the account for cryptomining.

Answer

Configuration drift

Answer

Service outage

Answer

Valid administrative activity

Question 15

Which of the following log sources would be most useful for detecting DNS tunneling?

Accepted Answer

DNS logs. DNS tunneling exfiltrates data via DNS queries. Analyzing DNS logs for unusual query patterns or high volume is key.

Answer

Firewall logs

Answer

Authentication logs

Answer

Endpoint EDR logs