CS0-003 Security Operations Practice Test 6 — 15 Questions

Question 1

An analyst is creating a Sigma rule to detect suspicious use of rundll32.exe to execute DLL files from temporary directories. Which TWO fields should the analyst include in the rule to minimize false positives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Process Name: rundll32.exe. To avoid false positives, the rule should specify the process name (rundll32.exe) and the command-line argument containing a path to a temp directory, as legitimate uses rarely involve DLLs from temp folders.

Answer

File Size: > 1 MB

Answer

Parent Process: explorer.exe

Answer

Image Path: C:\Windows\System32\rundll32.exe

Question 2

A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to an external IP address on port 22. Upon investigation, the analyst finds the workstation is used by a developer who frequently transfers large files to a remote server via SCP. What is the most appropriate classification for this alert?

Accepted Answer

False positive. The alert is triggered by legitimate administrative activity (SCP file transfer), so it is a false positive. The analyst should tune the SIEM to reduce similar alerts.

Answer

True positive

Answer

True negative

Answer

False negative

Question 3

During a threat hunting exercise, an analyst uses osquery to query process events on endpoints. They discover a process named 'svchost.exe' running under a user account with parent process 'cmd.exe'. Which of the following describes this observation?

Accepted Answer

Potential LOLBin abuse with anomalous parent-child relationship. svchost.exe should normally run under SYSTEM or NETWORK SERVICE with 'services.exe' as parent. A user-level svchost.exe with cmd.exe parent indicates a potential LOLBin misuse.

Answer

Normal behavior for Windows services

Answer

Evidence of a DLL injection attack

Answer

Indicative of a process hollowing attack

Question 4

A security analyst is reviewing NetFlow data and notices a significant amount of traffic from an internal host to a known malicious IP address on port 443. What tool would be most effective for further analyzing the payload of this traffic?

Accepted Answer

Wireshark. Wireshark captures and analyzes packet payloads, which is necessary for examining the content of encrypted or unencrypted traffic.

Answer

Nikto

Answer

Nmap

Answer

tcpdump

Question 5

A security engineer is configuring a new SIEM correlation rule to detect lateral movement. Which of the following log sources would provide the most relevant data for detecting pass-the-hash attacks?

Accepted Answer

Authentication logs. Authentication logs (e.g., Windows Security Event ID 4624) contain details about logon types (e.g., Network logon) and account names, which are crucial for detecting pass-the-hash.

Answer

Cloud audit logs

Answer

DNS logs

Answer

Firewall logs

Question 6

During a vulnerability scan of internal hosts, a security analyst finds a critical vulnerability with a CVSS score of 9.8. The affected system is a legacy application that cannot be patched immediately. What should the analyst do next?

Accepted Answer

Apply compensating controls and document the risk. The analyst should document the finding and apply compensating controls, such as network segmentation or firewall rules, to mitigate risk until a patch can be applied.

Answer

Increase scan frequency to monitor the vulnerability

Answer

Mark the vulnerability as a false positive

Answer

Immediately shut down the system

Question 7

A SOC analyst is investigating an alert from AWS GuardDuty that indicates 'UnauthorizedAccess:EC2/SSHBruteForce'. The analyst reviews CloudTrail logs and sees multiple failed SSH login attempts from a single IP address. What initial triage action should the analyst take?

Accepted Answer

Block the source IP address in the security group. The best initial action is to block the source IP address at the security group or network ACL to stop the brute force attack, then investigate further.

Answer

Enable multi-factor authentication for all users

Answer

Remove the instance from the auto-scaling group

Answer

Disable the SSH service on the instance

Question 8

Which of the following is the best data source for detecting DNS tunneling activity?

Accepted Answer

DNS logs. DNS logs contain the queries and responses; analyzing them for unusual domain patterns, large query volumes, or odd record types can reveal tunneling.

Answer

Firewall logs

Answer

EDR telemetry

Answer

NetFlow data

Question 9

A threat hunter is creating a hypothesis based on recent threat intelligence about a new ransomware variant that uses scheduled tasks for persistence. Which of the following MITRE ATT&CK techniques should the hunter focus on?

Accepted Answer

T1053.005 - Scheduled Task. Scheduled tasks are a persistence technique (T1053.005) in the MITRE ATT&CK framework. The hunter should look for unusual scheduled tasks.

Answer

T1547.001 - Registry Run Keys / Startup Folder

Answer

T1071.001 - Web Protocols

Answer

T1059.001 - PowerShell

Question 10

An analyst is reviewing a YARA rule that triggers on a specific string pattern in memory. The rule has a high false positive rate. Which of the following actions would best reduce false positives while maintaining detection capability?

Accepted Answer

Add a condition that requires the string to appear with another indicator. Adding conditions to refine the rule, such as requiring the string to be in a specific memory section or alongside other indicators, can reduce false positives.

Answer

Convert the rule to a Sigma rule

Answer

Remove the rule from active use

Answer

Increase the string length in the rule

Question 11

What is the primary purpose of performing credentialed vulnerability scans?

Accepted Answer

Provide deeper insight into the system configuration. Credentialed scans authenticate to the target system, allowing deeper inspection (e.g., registry, installed software) for a more accurate assessment.

Answer

Eliminate the need for patch management

Answer

Reduce network bandwidth usage

Answer

Avoid detection by the target system

Question 12

A security analyst is investigating a potential data exfiltration incident. They notice a host sending large amounts of data to an external IP address using DNS queries. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data in DNS queries and responses, allowing exfiltration over port 53, which is often allowed through firewalls.

Answer

DGA

Answer

HTTP smuggling

Answer

Beaconing

Question 13

During a memory analysis of a potentially compromised host, a security analyst finds a process with an executable image that is not present on disk. Which technique is most likely being observed?

Accepted Answer

Process hollowing. Process hollowing involves creating a legitimate process in a suspended state, then replacing its memory with malicious code, so the executable in memory may not correspond to a file on disk.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection

Question 14

A security analyst is reviewing a SIEM alert indicating a high number of failed authentication attempts from a single IP address against multiple user accounts. The analyst checks the logs and finds the IP belongs to a known vulnerability scanner used by the internal security team. How should the analyst classify this alert?

Accepted Answer

False positive - authorized activity. The alert is triggered by authorized activity from a known internal scanner, so it is a false positive. The SIEM rule should be tuned to exclude this scanner or reduce its severity.

Answer

True positive - unauthorized access attempt

Answer

True positive - lateral movement

Answer

False negative - missed detection

Question 15

During a network traffic review, an analyst notices encrypted traffic to an unusual external IP address on TCP port 53. What is the most likely anomaly this indicates?

Accepted Answer

Data exfiltration via DNS tunnelling. Port 53 is used for DNS, which typically uses UDP. Encrypted traffic on TCP/53 suggests DNS tunnelling, where data is exfiltrated inside DNS queries and responses.

Answer

Normal DNS resolution

Answer

Beaconing to command and control

Answer

HTTP smuggling attack