CS0-003 Security Operations Practice Test 8 — 15 Questions

Question 1

A security analyst is reviewing a SIEM alert indicating a high number of failed authentication attempts from a single IP address against multiple user accounts. The analyst checks the logs and finds the IP belongs to a known vulnerability scanner used by the internal security team. How should the analyst classify this alert?

Accepted Answer

False positive - authorized activity. The alert is triggered by authorized activity from a known internal scanner, so it is a false positive. The SIEM rule should be tuned to exclude this scanner or reduce its severity.

Answer

True positive - unauthorized access attempt

Answer

True positive - lateral movement

Answer

False negative - missed detection

Question 2

During a network traffic review, an analyst notices encrypted traffic to an unusual external IP address on TCP port 53. What is the most likely anomaly this indicates?

Accepted Answer

Data exfiltration via DNS tunnelling. Port 53 is used for DNS, which typically uses UDP. Encrypted traffic on TCP/53 suggests DNS tunnelling, where data is exfiltrated inside DNS queries and responses.

Answer

Normal DNS resolution

Answer

Beaconing to command and control

Answer

HTTP smuggling attack

Question 3

An analyst is investigating a potential compromise on a Windows endpoint. EDR telemetry shows that 'powershell.exe' was launched by 'svchost.exe', which in turn was spawned by 'services.exe'. The analyst observes that 'powershell.exe' then executed a script that downloaded an executable. What should the analyst be most concerned about?

Accepted Answer

This indicates a potential LOLBin attack using svchost.exe to launch powershell.exe. Svchost.exe hosting a child process like powershell.exe is unusual. This parent-child relationship suggests a LOLBin (living off the land) attack, where an attacker abuses legitimate Windows binaries to execute malicious code. The script download further indicates compromise.

Answer

Services.exe spawning svchost.exe is a sign of malware infection

Answer

Powershell.exe downloading an executable is a false positive from Windows Update

Answer

Svchost.exe spawning powershell.exe is a normal Windows operation

Question 4

A security analyst is configuring a vulnerability scanner to assess internal servers. The goal is to identify missing patches and misconfigurations without impacting system performance. Which scan configuration is most appropriate?

Accepted Answer

Credentialed internal scan. A credentialed scan uses authenticated credentials to access the target, allowing deeper checks for missing patches and misconfigurations without intrusive techniques. This provides accurate results with less impact than non-credentialed scans that might cause crashes.

Answer

Non-credentialed external scan

Answer

Full port scan with vulnerability detection

Answer

Agent-based scan with performance throttling

Question 5

A security analyst is investigating a series of alerts from AWS GuardDuty indicating 'UnauthorizedAccess:EC2/SSHBruteForce'. The affected EC2 instance has a high CPU load. The analyst checks the security group rules and finds that SSH (port 22) is open to 0.0.0.0/0. What is the best immediate remediation action?

Accepted Answer

Create a new security group allowing SSH only from known IPs and attach it to the instance. The instance is exposed to the internet on SSH. Restricting SSH access to known IP addresses reduces the attack surface. Creating a new security group with a narrow source range and applying it stops brute force attempts.

Answer

Terminate the EC2 instance immediately

Answer

Disable the GuardDuty alert to reduce noise

Answer

Install a host-based firewall on the instance to block SSH

Question 6

Which of the following is the primary purpose of log normalisation in a SIEM?

Accepted Answer

Convert logs into a standardised format for correlation and analysis. Log normalisation converts logs from different sources into a common, structured format so that the SIEM can correlate and analyse them uniformly.

Answer

Encrypt logs to protect confidentiality

Answer

Reduce storage space by compressing log data

Answer

Remove false positives from log entries

Question 7

An analyst is reviewing a packet capture and observes a series of TCP SYN packets sent to a server, each followed by a SYN-ACK from the server, but no ACK from the client. The source IP is spoofed. What type of attack is most likely occurring?

Accepted Answer

TCP SYN flood attack. A SYN flood attack involves sending many SYN packets with spoofed IPs, causing the server to allocate resources for half-open connections. The lack of final ACK indicates the client never completes the handshake, exhausting server resources.

Answer

Man-in-the-middle attack

Answer

DNS amplification attack

Answer

TCP reset attack

Question 8

During a threat hunting exercise, an analyst creates a hypothesis that a threat actor may be using scheduled tasks for persistence. Which Windows registry key or log source should the analyst examine to confirm the hypothesis?

Accepted Answer

Review the Windows Security Event Log for event ID 4698 (scheduled task creation). Scheduled tasks are stored in the Windows Task Scheduler and can be viewed via schtasks.exe, but the registry also contains persistence mechanisms. However, scheduled tasks are not primarily stored in the registry; they are in %SystemRoot%\Tasks. Alternatively, the analyst can use the Task Scheduler API. But among the options, examining the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule' is not standard. Actually, the correct answer is to examine the Task Scheduler logs or the tasks folder. However, the question specifies registry key or log source. The best answer is to review the Windows Security Event Log for event ID 4698 (scheduled task creation).

Answer

Check the Run registry keys (HKLM\Software\Microsoft\Windows\CurrentVersion\Run)

Answer

Examine the System event log for driver loading events

Answer

Analyze the application event log for error messages

Question 9

An analyst needs to capture network traffic on a Linux server to investigate a potential data exfiltration. Which command-line tool is best suited for real-time packet capture and analysis?

Accepted Answer

tcpdump. tcpdump is a powerful command-line packet analyzer for Linux, capable of capturing network traffic in real time and saving it for later analysis.

Answer

netstat

Answer

iperf

Answer

nmap

Question 10

A security analyst is tuning a SIEM rule that triggers on any process creation event involving 'rundll32.exe'. The rule generates many false positives from legitimate software updates. Which tuning action would most effectively reduce false positives while maintaining detection of malicious use?

Accepted Answer

Add an exclusion list for known good command-line arguments or parent processes. Creating an exception list for known legitimate processes or command lines that use rundll32.exe reduces false positives. However, the best approach is to modify the rule to include specific conditions such as parent process or command-line arguments that indicate malicious activity.

Answer

Change the rule to trigger only on network connections from rundll32.exe

Answer

Disable the rule entirely

Answer

Increase the severity threshold of the rule

Question 11

An analyst is investigating a potential memory injection attack on a Windows system. Which of the following memory analysis artifacts is most indicative of code injection?

Accepted Answer

A process with a memory region that is both writable and executable (RWX). A process that is executing in a region of memory that is both writable and executable (RWX) is a strong indicator of injected code, as legitimate processes typically have separate write and execute permissions.

Answer

A process that is running from a temp directory

Answer

A process that has an unusually high handle count

Answer

A process with multiple threads in a suspended state

Question 12

Which log source would best help detect an attacker using a domain generation algorithm (DGA) to communicate with a command and control server?

Accepted Answer

DNS query logs. DGA generates many random domain names, which are often visible in DNS query logs. Analysing DNS logs for high volumes of NXDOMAIN responses or unusual domain patterns can indicate DGA activity.

Answer

Firewall logs

Answer

Cloud audit logs

Answer

Authentication logs

Question 13

A security analyst is reviewing a CASB alert indicating a user is accessing a cloud storage application from an unusual location. The analyst needs to investigate further. Which TWO actions are most appropriate?

Accepted Answer

Review the cloud application's audit logs for file access or sharing events. Checking the user's recent authentication logs can confirm if the access was legitimate. Reviewing the cloud application's audit logs can provide details on the activities performed. The other options are less relevant or too broad.

Answer

Disable the user's account immediately

Answer

Reset the user's password without further analysis

Answer

Block all access to the cloud application from that location

Question 14

During a threat hunt, an analyst identifies a suspicious process that is making outbound connections to multiple IP addresses on port 443 using TLS. The analyst suspects data exfiltration. Which THREE techniques would best help confirm this hypothesis?

Accepted Answer

Review EDR telemetry for file reads on sensitive documents prior to the connections. Analysing NetFlow/IPFIX data can reveal volume patterns indicative of exfiltration. Inspecting the TLS certificate or handshake can identify if it's a legitimate service. Checking EDR for file access events can show if sensitive files were read before the connections. The other options are less direct.

Answer

Inspect the TLS certificate presented by the remote server

Answer

Perform a memory dump of the process and look for encryption keys

Question 15

A security analyst is creating a Sigma rule to detect use of the LOLBin 'certutil' for downloading payloads. Which THREE command-line arguments should the rule look for to indicate malicious use?

Accepted Answer

-urlcache. Certutil can be abused to download files using the '-urlcache' and '-split' arguments (or '-f' for force). The combination of '-urlcache' with a URL and output file is typical for downloading malicious payloads. '-verify' is legitimate, '-encode' and '-decode' are used for encoding/decoding, but '-urlcache' and '-split' are key for download.

Answer

-encode

Answer

-verify