CS0-003 Security Operations Practice Test 4 — 15 Questions

Question 1

A vulnerability scan report shows a critical vulnerability on a web server. The server is behind a WAF that blocks the relevant exploit payloads. According to the organization's risk management policy, what should the analyst do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Accept the risk and document the compensating control. Compensating controls like a WAF can justify accepting the risk rather than immediately patching if it would cause downtime.

Answer

Remove the WAF to allow the vulnerability to be exploited

Answer

Immediately patch the server

Answer

Mark the vulnerability as a false positive

Question 2

A threat hunter is creating a Sigma rule to detect a specific TTP where an attacker uses reg.exe to create a Run key for persistence. Which of the following Sigma rule event selectors would best detect this activity?

Accepted Answer

EventID: 13 (Registry Value Set) AND TargetObject: '*\CurrentVersion\Run*'. Registry persistence via Run keys is commonly achieved by modifying HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Sigma rules targeting registry add/modify events with that path will detect it.

Answer

EventID: 4688 (Process Creation) AND ParentImage: '*reg.exe*'

Answer

EventID: 4657 (Registry modification) AND ObjectName: '*\RunOnce*'

Answer

EventID: 1 (Process Creation) AND CommandLine: '*reg.exe*'

Question 3

An analyst is investigating a suspicious email attachment. The sandbox analysis shows that the document drops a binary that connects to an external IP on port 4444. Which network analysis tool is best suited to confirm if any internal hosts are communicating on that port?

Accepted Answer

NetFlow analyzer. NetFlow collects metadata about network flows, including destination IP and port, enabling analysts to query for all traffic on a specific port across the network.

Answer

tcpdump

Answer

nmap

Answer

Wireshark

Question 4

A security analyst is configuring a vulnerability scanner to evaluate the security posture of internal servers. Which type of scan provides the most accurate assessment of missing patches?

Accepted Answer

Credentialed internal scan. Credentialed scans authenticate to the target OS and can query patch levels directly, yielding more accurate results than uncredentialed scans.

Answer

Network-based scan without credentials

Answer

Non-credentialed external scan

Answer

Agent-based scan

Question 5

During a threat hunt, an analyst notices repeated DNS queries for random-looking subdomains under a legitimate domain. The domains have high entropy and never existed before. What technique is most likely being used?

Accepted Answer

Domain Generation Algorithm (DGA). Domain Generation Algorithms (DGAs) generate many random domain names to evade blocklists. C2 malware often uses DGAs.

Answer

Fast flux

Answer

DNS cache poisoning

Answer

DNS tunneling

Question 6

An analyst is reviewing a memory dump from a compromised workstation and finds a process that appears to be a legitimate system process but has a different parent process and is running from a non-standard location. Which analysis technique is most appropriate?

Accepted Answer

Perform a YARA scan on the process memory. Process hollowing is a technique where an attacker creates a legitimate process in a suspended state, replaces its memory with malicious code, and resumes it. The process may appear legitimate but with anomalies in parent and path.

Answer

Compare the process's command line with baseline

Answer

Analyze network connections from the process

Answer

Check the process's digital signature

Question 7

A CASB alert indicates that a user downloaded a file containing sensitive data from a cloud app to an unmanaged device. Which action should the analyst take first?

Accepted Answer

Investigate the alert to confirm the data exfiltration. The first step is to verify the alert is a true positive by checking the user's activity and the file's sensitivity. Prematurely blocking or reporting may be incorrect if the alert is a false positive.

Answer

Report the incident to law enforcement

Answer

Reset the user's password

Answer

Block the user's cloud app access

Question 8

A security analyst notices repeated alerts for 'DNS query to known malicious domain' from multiple internal hosts. Upon investigation, the analyst finds that the domain is legitimate and used by a third-party service. What should the analyst do to reduce false positives?

Accepted Answer

Add the domain to a whitelist in the SIEM. Adding the domain to a whitelist ensures that legitimate traffic is not flagged, reducing false positives without disabling the rule entirely.

Answer

Disable the alert rule for DNS queries

Answer

Increase the severity of the alert

Answer

Block the domain on the firewall

Question 9

During a threat hunt, an analyst uses osquery to query endpoints for processes that have spawned from Microsoft Word but have network connections. Which of the following TTPs does this technique most likely detect?

Accepted Answer

Spearphishing attachment leading to macro execution. Attackers often use macro-enabled documents to execute code, making Word spawn abnormal child processes like PowerShell or cmd.exe, which then connect outbound.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

Data exfiltration over DNS

Question 10

A security analyst is reviewing a NetFlow record that shows a large amount of data being transferred from an internal server to an external IP address on port 443 during non-business hours. Which type of activity should the analyst suspect?

Accepted Answer

Data exfiltration. Large data transfers to an external IP on an encrypted channel (HTTPS) during off-hours is a common indicator of data exfiltration.

Answer

Denial-of-service attack

Answer

Port scanning

Answer

Normal backup operation

Question 11

An analyst receives an alert that a user's workstation contacted a known command-and-control (C2) IP address. The analyst checks the EDR logs and finds that the process 'svchost.exe' initiated the connection. What should the analyst do next to determine if this is a true positive?

Accepted Answer

Check the parent process of svchost.exe. Checking the parent process of svchost.exe helps identify if it was spawned by a malicious process like a service or scheduled task, indicating compromise.

Answer

Verify the IP address with threat intelligence feeds

Answer

Search for other workstations contacting the same IP

Answer

Isolate the workstation from the network immediately

Question 12

A vulnerability scan of an internal web server shows a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF and is only accessible from internal IPs. Which of the following is the best next step?

Accepted Answer

Perform a risk assessment considering compensating controls. CVSS score reflects severity but not exploitability in the specific environment. Considering compensating controls (WAF, network ACLs) may reduce risk, so a risk assessment is needed before patching.

Answer

Apply the patch immediately regardless of impact

Answer

Disable the server until a patch is available

Answer

Ignore the finding because the server is internal

Question 13

Which of the following is a primary benefit of using credentialed vulnerability scans over non-credentialed scans?

Accepted Answer

They provide more accurate results by checking internal configurations. Credentialed scans can access the OS and applications, allowing deeper inspection of installed software, patches, and configuration settings.

Answer

They are less likely to crash services

Answer

They are faster and less intrusive

Answer

They do not require network access

Question 14

A security analyst is investigating a potential DNS tunneling attack. Which of the following patterns in DNS logs would most likely indicate such activity?

Accepted Answer

Unusually long subdomain names with high query frequency to a single domain. DNS tunneling encodes data in subdomains, resulting in long, random-looking domain names with high query volumes to a specific domain.

Answer

A high number of NXDOMAIN responses

Answer

Consistent query intervals to a known legitimate domain

Answer

Queries to domains that are less than 24 hours old

Question 15

During a cloud security investigation, an analyst notices that an AWS IAM user generated multiple 'CreateKeyPair' API calls from an IP address outside the corporate network. Which AWS service is best suited to detect this type of anomalous behavior?

Accepted Answer

AWS GuardDuty. AWS GuardDuty uses machine learning and threat intelligence to detect anomalous API activity, including unauthorized key creation, via CloudTrail logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector