CS0-003 Security Operations Practice Test 7 — 15 Questions

Question 1

A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to an external IP address on port 22. Upon investigation, the analyst finds the workstation is used by a developer who frequently transfers large files to a remote server via SCP. What is the most appropriate classification for this alert?

Accepted Answer

False positive. The alert is triggered by legitimate administrative activity (SCP file transfer), so it is a false positive. The analyst should tune the SIEM to reduce similar alerts.

Answer

True positive

Answer

True negative

Answer

False negative

Question 2

During a threat hunting exercise, an analyst uses osquery to query process events on endpoints. They discover a process named 'svchost.exe' running under a user account with parent process 'cmd.exe'. Which of the following describes this observation?

Accepted Answer

Potential LOLBin abuse with anomalous parent-child relationship. svchost.exe should normally run under SYSTEM or NETWORK SERVICE with 'services.exe' as parent. A user-level svchost.exe with cmd.exe parent indicates a potential LOLBin misuse.

Answer

Normal behavior for Windows services

Answer

Evidence of a DLL injection attack

Answer

Indicative of a process hollowing attack

Question 3

A security analyst is reviewing NetFlow data and notices a significant amount of traffic from an internal host to a known malicious IP address on port 443. What tool would be most effective for further analyzing the payload of this traffic?

Accepted Answer

Wireshark. Wireshark captures and analyzes packet payloads, which is necessary for examining the content of encrypted or unencrypted traffic.

Answer

Nikto

Answer

Nmap

Answer

tcpdump

Question 4

A security engineer is configuring a new SIEM correlation rule to detect lateral movement. Which of the following log sources would provide the most relevant data for detecting pass-the-hash attacks?

Accepted Answer

Authentication logs. Authentication logs (e.g., Windows Security Event ID 4624) contain details about logon types (e.g., Network logon) and account names, which are crucial for detecting pass-the-hash.

Answer

Cloud audit logs

Answer

DNS logs

Answer

Firewall logs

Question 5

During a vulnerability scan of internal hosts, a security analyst finds a critical vulnerability with a CVSS score of 9.8. The affected system is a legacy application that cannot be patched immediately. What should the analyst do next?

Accepted Answer

Apply compensating controls and document the risk. The analyst should document the finding and apply compensating controls, such as network segmentation or firewall rules, to mitigate risk until a patch can be applied.

Answer

Increase scan frequency to monitor the vulnerability

Answer

Mark the vulnerability as a false positive

Answer

Immediately shut down the system

Question 6

A SOC analyst is investigating an alert from AWS GuardDuty that indicates 'UnauthorizedAccess:EC2/SSHBruteForce'. The analyst reviews CloudTrail logs and sees multiple failed SSH login attempts from a single IP address. What initial triage action should the analyst take?

Accepted Answer

Block the source IP address in the security group. The best initial action is to block the source IP address at the security group or network ACL to stop the brute force attack, then investigate further.

Answer

Enable multi-factor authentication for all users

Answer

Remove the instance from the auto-scaling group

Answer

Disable the SSH service on the instance

Question 7

Which of the following is the best data source for detecting DNS tunneling activity?

Accepted Answer

DNS logs. DNS logs contain the queries and responses; analyzing them for unusual domain patterns, large query volumes, or odd record types can reveal tunneling.

Answer

Firewall logs

Answer

EDR telemetry

Answer

NetFlow data

Question 8

A threat hunter is creating a hypothesis based on recent threat intelligence about a new ransomware variant that uses scheduled tasks for persistence. Which of the following MITRE ATT&CK techniques should the hunter focus on?

Accepted Answer

T1053.005 - Scheduled Task. Scheduled tasks are a persistence technique (T1053.005) in the MITRE ATT&CK framework. The hunter should look for unusual scheduled tasks.

Answer

T1547.001 - Registry Run Keys / Startup Folder

Answer

T1071.001 - Web Protocols

Answer

T1059.001 - PowerShell

Question 9

An analyst is reviewing a YARA rule that triggers on a specific string pattern in memory. The rule has a high false positive rate. Which of the following actions would best reduce false positives while maintaining detection capability?

Accepted Answer

Add a condition that requires the string to appear with another indicator. Adding conditions to refine the rule, such as requiring the string to be in a specific memory section or alongside other indicators, can reduce false positives.

Answer

Convert the rule to a Sigma rule

Answer

Remove the rule from active use

Answer

Increase the string length in the rule

Question 10

What is the primary purpose of performing credentialed vulnerability scans?

Accepted Answer

Provide deeper insight into the system configuration. Credentialed scans authenticate to the target system, allowing deeper inspection (e.g., registry, installed software) for a more accurate assessment.

Answer

Eliminate the need for patch management

Answer

Reduce network bandwidth usage

Answer

Avoid detection by the target system

Question 11

A security analyst is investigating a potential data exfiltration incident. They notice a host sending large amounts of data to an external IP address using DNS queries. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data in DNS queries and responses, allowing exfiltration over port 53, which is often allowed through firewalls.

Answer

DGA

Answer

HTTP smuggling

Answer

Beaconing

Question 12

During a memory analysis of a potentially compromised host, a security analyst finds a process with an executable image that is not present on disk. Which technique is most likely being observed?

Accepted Answer

Process hollowing. Process hollowing involves creating a legitimate process in a suspended state, then replacing its memory with malicious code, so the executable in memory may not correspond to a file on disk.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection

Question 13

A security analyst is tuning a SIEM rule that generates alerts for every failed login attempt. The rule is causing alert fatigue. Which TWO actions would reduce false positives while maintaining security visibility?

Accepted Answer

Aggregate alerts by source IP and time window. Aggregating alerts by source IP reduces noise from individual attempts. Whitelisting known service accounts performing repeated failed logins (due to misconfigured services) also reduces false positives.

Answer

Disable the rule entirely

Answer

Increase the alert severity threshold

Answer

Increase the log retention period

Question 14

During a threat hunt, an analyst uses Velociraptor to collect forensic artifacts from endpoints. Which THREE of the following artifacts are most useful for detecting persistence mechanisms?

Accepted Answer

Scheduled tasks. Scheduled tasks, registry Run keys, and service configurations are common persistence locations monitored by attackers.

Answer

List of installed updates

Answer

ARP cache

Question 15

A SOC team is evaluating cloud-native security monitoring tools. Which TWO of the following are AWS services specifically designed for threat detection and security monitoring?

Accepted Answer

AWS GuardDuty. AWS GuardDuty is a threat detection service, and Security Hub aggregates security findings. Other services like CloudTrail are for logging, not primarily detection.

Answer

AWS Lambda

Answer

AWS CloudTrail

Answer

AWS VPC Flow Logs