CS0-003 Security Operations Practice Test 5 — 15 Questions

Question 1

A security analyst notices repeated alerts for 'DNS query to known malicious domain' from multiple internal hosts. Upon investigation, the analyst finds that the domain is legitimate and used by a third-party service. What should the analyst do to reduce false positives?

Accepted Answer

Add the domain to a whitelist in the SIEM. Adding the domain to a whitelist ensures that legitimate traffic is not flagged, reducing false positives without disabling the rule entirely.

Answer

Disable the alert rule for DNS queries

Answer

Increase the severity of the alert

Answer

Block the domain on the firewall

Question 2

During a threat hunt, an analyst uses osquery to query endpoints for processes that have spawned from Microsoft Word but have network connections. Which of the following TTPs does this technique most likely detect?

Accepted Answer

Spearphishing attachment leading to macro execution. Attackers often use macro-enabled documents to execute code, making Word spawn abnormal child processes like PowerShell or cmd.exe, which then connect outbound.

Answer

Pass-the-hash attack

Answer

Kerberoasting

Answer

Data exfiltration over DNS

Question 3

A security analyst is reviewing a NetFlow record that shows a large amount of data being transferred from an internal server to an external IP address on port 443 during non-business hours. Which type of activity should the analyst suspect?

Accepted Answer

Data exfiltration. Large data transfers to an external IP on an encrypted channel (HTTPS) during off-hours is a common indicator of data exfiltration.

Answer

Denial-of-service attack

Answer

Port scanning

Answer

Normal backup operation

Question 4

An analyst receives an alert that a user's workstation contacted a known command-and-control (C2) IP address. The analyst checks the EDR logs and finds that the process 'svchost.exe' initiated the connection. What should the analyst do next to determine if this is a true positive?

Accepted Answer

Check the parent process of svchost.exe. Checking the parent process of svchost.exe helps identify if it was spawned by a malicious process like a service or scheduled task, indicating compromise.

Answer

Verify the IP address with threat intelligence feeds

Answer

Search for other workstations contacting the same IP

Answer

Isolate the workstation from the network immediately

Question 5

A vulnerability scan of an internal web server shows a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF and is only accessible from internal IPs. Which of the following is the best next step?

Accepted Answer

Perform a risk assessment considering compensating controls. CVSS score reflects severity but not exploitability in the specific environment. Considering compensating controls (WAF, network ACLs) may reduce risk, so a risk assessment is needed before patching.

Answer

Apply the patch immediately regardless of impact

Answer

Disable the server until a patch is available

Answer

Ignore the finding because the server is internal

Question 6

Which of the following is a primary benefit of using credentialed vulnerability scans over non-credentialed scans?

Accepted Answer

They provide more accurate results by checking internal configurations. Credentialed scans can access the OS and applications, allowing deeper inspection of installed software, patches, and configuration settings.

Answer

They are less likely to crash services

Answer

They are faster and less intrusive

Answer

They do not require network access

Question 7

A security analyst is investigating a potential DNS tunneling attack. Which of the following patterns in DNS logs would most likely indicate such activity?

Accepted Answer

Unusually long subdomain names with high query frequency to a single domain. DNS tunneling encodes data in subdomains, resulting in long, random-looking domain names with high query volumes to a specific domain.

Answer

A high number of NXDOMAIN responses

Answer

Consistent query intervals to a known legitimate domain

Answer

Queries to domains that are less than 24 hours old

Question 8

An analyst is creating a YARA rule to detect a specific malware family that uses the string 'evil' in its PE file. Which of the following rule structures is correct?

Accepted Answer

rule detect_malware { strings: $a = "evil" condition: $a }. The standard YARA rule structure includes rule name, meta section, strings section, and condition section. The condition must reference the string.

Answer

rule detect_malware { strings: "evil" condition: $a }

Answer

rule detect_malware { condition: $a = "evil" }

Answer

if "evil" in file then alert

Question 9

During a cloud security investigation, an analyst notices that an AWS IAM user generated multiple 'CreateKeyPair' API calls from an IP address outside the corporate network. Which AWS service is best suited to detect this type of anomalous behavior?

Accepted Answer

AWS GuardDuty. AWS GuardDuty uses machine learning and threat intelligence to detect anomalous API activity, including unauthorized key creation, via CloudTrail logs.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Inspector

Question 10

An analyst is triaging a SIEM alert that fires when a single host makes more than 100 outbound connections to unique IPs within one minute. The analyst finds that the host is a web server responding to legitimate client requests. What is the best action to reduce false positives?

Accepted Answer

Increase the threshold to 500 connections per minute. Adjusting the threshold to a higher number that accounts for normal web server traffic will reduce false positives while still detecting scanning behavior.

Answer

Change the rule to alert on inbound connections

Answer

Disable the alert rule

Answer

Create an exception for the web server's IP

Question 11

Which of the following is a persistence mechanism that involves modifying the Windows Registry to execute a program when a user logs in?

Accepted Answer

Run key. The 'Run' registry key is commonly used to launch programs automatically at user logon, making it a persistence mechanism.

Answer

Scheduled Task

Answer

Service

Answer

Startup folder

Question 12

An analyst suspects a process hollowing attack on an endpoint. Which of the following EDR telemetry findings would best support this hypothesis?

Accepted Answer

A legitimate process (e.g., svchost.exe) created in a suspended state and later resumed with changed memory contents. Process hollowing involves creating a legitimate process in a suspended state, then replacing its memory with malicious code. This leaves the original path unchanged but the process may exhibit unusual child process behavior.

Answer

A process with the same name as a Windows system process but running from a temporary directory

Answer

A process injecting code into a legitimate running process

Answer

An unknown process making network connections to multiple internal IPs

Question 13

A security analyst is reviewing network traffic and suspects a host is infected with malware that uses a domain generation algorithm (DGA) for C2 communication. Which two of the following indicators are most consistent with DGA activity?

Accepted Answer

Frequent DNS queries to domains with random-looking, long subdomains. DGA domains are often algorithmically generated, resulting in random-looking, long domain names. High NXDOMAIN rates occur because many generated domains are not registered at the time of query.

Answer

All DNS queries are to internal DNS servers

Answer

DNS queries to domains with a high Alexa ranking

Answer

Consistent DNS query intervals to a single IP

Question 14

During a threat hunt, an analyst is looking for signs of lateral movement using pass-the-hash. Which three of the following log sources would be most useful for detecting this technique?

Accepted Answer

Sysmon Event ID 3 (network connection). Pass-the-hash involves using NTLM hashes to authenticate. Windows Event ID 4624 (successful logon) can show logon type 3 (network) with unusual source IPs. Sysmon Event ID 3 (network connection) can show outbound connections. Authentication logs on domain controllers show NTLM authentication attempts.

Answer

DNS query logs

Answer

Sysmon Event ID 1 (process creation)

Question 15

An analyst is investigating a potential data exfiltration incident. The analyst observes repeated HTTPS connections to a cloud storage provider from a server that does not normally use that service. Which three additional artifacts would strengthen the case for exfiltration?

Accepted Answer

The data transfer volume is significantly higher than normal for that server. Large outbound data volume, connections outside business hours, and use of non-standard ports (e.g., 443 for https but custom port for tunneling) are classic exfiltration indicators.

Answer

The connections are made to a known malicious IP

Answer

The connections occur during business hours only