CS0-003 Security Operations Practice Test 5 — 15 Questions

Question 1

An analyst is triaging a SIEM alert that fires when a single host makes more than 100 outbound connections to unique IPs within one minute. The analyst finds that the host is a web server responding to legitimate client requests. What is the best action to reduce false positives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the threshold to 500 connections per minute. Adjusting the threshold to a higher number that accounts for normal web server traffic will reduce false positives while still detecting scanning behavior.

Answer

Change the rule to alert on inbound connections

Answer

Disable the alert rule

Answer

Create an exception for the web server's IP

Question 2

An analyst suspects a process hollowing attack on an endpoint. Which of the following EDR telemetry findings would best support this hypothesis?

Accepted Answer

A legitimate process (e.g., svchost.exe) created in a suspended state and later resumed with changed memory contents. Process hollowing involves creating a legitimate process in a suspended state, then replacing its memory with malicious code. This leaves the original path unchanged but the process may exhibit unusual child process behavior.

Answer

A process with the same name as a Windows system process but running from a temporary directory

Answer

A process injecting code into a legitimate running process

Answer

An unknown process making network connections to multiple internal IPs

Question 3

A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to an IP address in a country where the organization does no business. The alert is based on a rule that triggers when outbound traffic exceeds 1 GB in 5 minutes. Upon investigation, the analyst finds that the workstation is used by a developer who downloaded a large dataset from a cloud storage service. Which action should the analyst take to improve the alert's accuracy without disabling it entirely?

Accepted Answer

Add the destination IP to a whitelist in the SIEM rule.. The alert is a false positive because legitimate activity triggered it. The best approach is to tune the rule to exclude known cloud storage IP addresses or increase the threshold to reduce noise while still detecting true exfiltration.

Answer

Increase the alert threshold to 10 GB in 5 minutes.

Answer

Create a correlation rule that combines this alert with other indicators.

Answer

Disable the alert rule permanently.

Question 4

A security analyst is reviewing logs from multiple sources to investigate a potential intrusion. Which log source would provide the most reliable evidence of successful authentication from an unusual location?

Accepted Answer

Authentication logs. Authentication logs record login events including source IP, timestamp, and success/failure status, making them the best source for identifying successful authentication from unusual locations.

Answer

Endpoint detection and response (EDR) logs

Answer

Firewall logs

Answer

DNS logs

Question 5

During a traffic analysis, a security analyst notices repeated TCP SYN packets sent to an internal server from an external IP, but the server never responds with SYN-ACK. The external IP sends a new SYN packet every 30 seconds. What does this behavior most likely indicate?

Accepted Answer

A TCP port scan. The lack of SYN-ACK responses suggests the server is not reachable or the port is closed. Repeated SYN packets without response are characteristic of a TCP port scan, as the scanner waits for a timeout and retries.

Answer

A SYN flood attack

Answer

A misconfigured firewall dropping SYN-ACK packets

Answer

A half-open connection due to network latency

Question 6

A threat hunter is analyzing EDR telemetry and discovers that the process svchost.exe spawned a child process powershell.exe. The powershell.exe then established a network connection to an external IP address. Which of the following best describes this behavior in the context of threat hunting?

Accepted Answer

Living off the land binary (LOLBin) usage. Svchost.exe is a legitimate Windows process, but it should not spawn PowerShell. This is an unusual parent-child relationship often indicative of lateral movement or code injection, where attackers use svchost to execute malicious code.

Answer

A Windows update process

Answer

Normal administrative activity

Answer

A false positive from EDR

Question 7

A vulnerability scan report shows a critical vulnerability with a CVSS score of 9.8 on a web server. However, the server is only accessible from internal IP addresses and is protected by a Web Application Firewall (WAF) that blocks the attack vector. Which of the following should the analyst recommend?

Accepted Answer

Accept the risk due to compensating controls.. Compensating controls like a WAF that effectively blocks the attack reduce the risk. While patching is ideal, the vulnerability may not be immediately exploitable due to the WAF.

Answer

Disable the WAF to test the vulnerability.

Answer

Immediately patch the server during business hours.

Answer

Run an uncredentialed scan to confirm the vulnerability.

Question 8

An analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address. The analyst checks the VPC Flow Logs and confirms the communication. What is the next best step in the investigation?

Accepted Answer

Isolate the EC2 instance from the network.. Since the EC2 instance is compromised, isolating it (e.g., by modifying security groups or stopping the instance) prevents further malicious activity while preserving evidence.

Answer

Run a vulnerability scan on the instance.

Answer

Ignore the alert because GuardDuty often produces false positives.

Answer

Delete the EC2 instance immediately.

Question 9

A security analyst is reviewing DNS logs and notices that a workstation is making frequent queries to domains with random-looking strings, such as 'a3b9f2d1.example.com'. These domains resolve to different IP addresses each time. Which type of activity is most likely being observed?

Accepted Answer

Domain generation algorithm (DGA) usage. Domain Generation Algorithms (DGAs) produce random-looking domain names that change frequently to evade blocklists. This behavior is typical of malware that uses DGA for command and control.

Answer

Normal DNS caching behavior

Answer

A misconfigured DNS resolver

Answer

DNS tunneling

Question 10

Which tool would best allow a security analyst to capture and analyze packets in real time to investigate a network anomaly?

Accepted Answer

Wireshark. Wireshark is a network protocol analyzer that captures and inspects packets in real time, making it ideal for real-time traffic analysis.

Answer

Metasploit

Answer

Nmap

Answer

Nikto

Question 11

A SOC analyst is triaging a SIEM alert for a registry modification on a workstation. The alert indicates a new Run key was added under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Which of the following is the most likely purpose of this modification?

Accepted Answer

To establish persistence. Run keys are a common persistence mechanism used by malware to ensure execution at user logon.

Answer

To change the desktop wallpaper

Answer

To disable Windows Defender

Answer

To update the system time

Question 12

During a threat hunting exercise, a hunter creates a hypothesis that a threat actor is using PowerShell to download payloads from a remote server. Which ATT&CK technique is the hunter most likely investigating?

Accepted Answer

T1105 - Ingress Tool Transfer. This matches the ATT&CK technique T1059.001 (PowerShell) and T1105 (Ingress Tool Transfer). The hypothesis specifically focuses on downloading payloads, so Ingress Tool Transfer is the primary technique.

Answer

T1047 - Windows Management Instrumentation

Answer

T1071.001 - Web Protocols

Answer

T1059.001 - PowerShell

Question 13

An analyst is reviewing a memory dump of a compromised system and notices that the memory of a legitimate process (e.g., notepad.exe) contains a PE header and executable code that is not part of the original binary. Which technique is most likely being used?

Accepted Answer

Process hollowing. Process hollowing involves replacing the legitimate code of a running process with malicious code, but the PE header and executable code in memory indicate code injection, specifically hollowing.

Answer

A reflective DLL loader

Answer

DLL injection

Answer

API hooking

Question 14

A security analyst is configuring a vulnerability scanner for internal network scanning. The analyst wants to ensure the scanner can identify missing patches and software configurations that require administrative privileges to read. Which scan type should the analyst configure?

Accepted Answer

Credentialed scan. Credentialed scans use administrative credentials to access systems and retrieve detailed configuration information, including missing patches.

Answer

Non-credentialed scan

Answer

External scan

Answer

Passive scan

Question 15

A SOC analyst is investigating an alert from Azure Sentinel indicating a user account logged in from an unfamiliar location. The analyst wants to determine if this is a true positive. Which TWO additional log sources should the analyst correlate to make an informed decision?

Accepted Answer

Azure Activity Logs. Azure AD sign-in logs provide authentication details, and Azure Activity Logs provide management plane activity. Correlating these can reveal if the sign-in was part of administrative actions or other anomalies.

Answer

Azure Security Center alerts

Answer

Azure Network Watcher flow logs

Answer

Azure Key Vault logs