CS0-003 Security Operations Practice Test 8 — 15 Questions

Question 1

A security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address on port 4444. The analyst checks the VPC Flow Logs and confirms the traffic. Which of the following is the most appropriate immediate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply a restrictive security group to isolate the instance. Isolating the EC2 instance by applying a restrictive security group stops the malicious communication and allows further investigation.

Answer

Create a new IAM role for the instance

Answer

Terminate the EC2 instance immediately

Answer

Update the route table to blackhole the traffic

Question 2

A threat hunter is reviewing osquery data from endpoints and notices that the Windows Registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' contains an entry for 'C:\Users\Public\svchost.exe'. Which of the following best describes the significance of this finding?

Accepted Answer

Suggests persistence via a malicious binary masquerading as svchost.exe. The Run key is a common persistence mechanism. An executable named svchost.exe in a non-system directory is suspicious and likely malicious.

Answer

Confirms a false positive because svchost.exe is always legitimate

Answer

Indicates a scheduled task has been created

Answer

Indicates a legitimate application installed for all users

Question 3

A security analyst uses Wireshark to capture traffic and notices an unusually high number of DNS queries for random-looking subdomains under a single domain, such as 'a1b2c3.malicious.com'. The TTL values are very low. The analyst suspects DNS tunneling. Which of the following additional indicators would most strongly support this hypothesis?

Accepted Answer

DNS queries with unusually large TXT record response sizes. DNS tunneling often uses TXT records to encode data, and the packet sizes can be larger than normal DNS queries.

Answer

Large number of NXDOMAIN responses

Answer

High number of A record queries

Answer

Queries originating from a DNS server

Question 4

An organization wants to perform vulnerability scanning on internal servers that contain sensitive data. The scanning team is concerned about causing service disruptions. Which type of scan should be recommended to minimize risk?

Accepted Answer

Non-credentialed scan. Non-credentialed scans are less intrusive and less likely to cause service disruptions because they do not log into the target systems.

Answer

Agent-based scan

Answer

Credentialed scan with safe checks enabled

Answer

External scan from the internet

Question 5

A security analyst is reviewing an alert from a CASB that shows a user downloading a large volume of sensitive data from a cloud storage application to a personal device outside of business hours. The user's behavior is atypical. Which of the following is the most likely interpretation?

Accepted Answer

Indicates a compromised account being used for data exfiltration. Atypical data download from a cloud service to a personal device outside business hours is a strong indicator of data exfiltration.

Answer

True positive - but only if the user has been phished

Answer

False positive - the user is working overtime

Answer

Indicates a misconfigured CASB policy

Question 6

During a threat hunting engagement, a hunter creates a hypothesis that adversaries may be using PowerShell to perform reconnaissance via Active Directory cmdlets. The hunter decides to look for events where PowerShell loaded the ActiveDirectory module. Which of the following detection techniques is most appropriate?

Accepted Answer

Create a SIEM correlation rule that triggers on Event ID 4104 (PowerShell Script Block Logging). Event ID 4104 (PowerShell Script Block Logging) captures the script block content when PowerShell executes, including module loading commands. A SIEM correlation rule can trigger on this event ID to detect when the ActiveDirectory module is loaded, which aligns with the hunter's hypothesis about adversaries using PowerShell for AD reconnaissance.

Answer

Perform a packet capture to analyze PowerShell network traffic

Answer

Deploy a YARA rule on endpoints to scan for malicious PowerShell scripts

Answer

Use osquery to query running PowerShell processes

Question 7

A threat hunter analyzes NetFlow data and observes a host communicating with multiple external IP addresses on high-numbered ports (e.g., 49300-49500) during off-hours. The communications are short-lived and occur in burst patterns. The hunter suspects data exfiltration. Which of the following analysis techniques would best confirm or refute this suspicion?

Accepted Answer

Perform a full packet capture on the host's traffic. Full packet capture allows deep inspection of payloads to identify if data is being exfiltrated, as NetFlow only provides metadata.

Answer

Correlate with authentication logs to see if the user is logged in

Answer

Check the host's registry for persistence mechanisms

Answer

Review DNS logs for domain generation algorithm patterns

Question 8

A security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address on port 4444. The analyst checks the VPC Flow Logs and confirms the traffic. Which of the following is the most appropriate immediate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPN logs to see if the user connected via a VPN. To determine if a geographically improbable login is a true positive, the analyst should examine: (1) authentication logs to verify the source IP and timestamp, and (2) VPN logs to see if the user connected via a VPN, which would explain the unusual location. Threat intelligence feeds are useful for assessing IP reputation but do not directly explain the user's behavior. Device compliance and cloud audit logs are less relevant.

Answer

Cloud audit logs for the user's recent activity

Answer

Threat intelligence feeds for the source IP reputation

Answer

Device compliance status of the user's endpoint

Question 9

A security analyst is creating a SIEM correlation rule to detect lateral movement using pass-the-hash attacks. The rule should trigger when multiple successful logins occur from a single source to multiple destinations using NTLM authentication. Which THREE log sources are essential for this rule? (Choose THREE.)

Accepted Answer

Windows Event ID 4776 (NTLM authentication) logs from domain controllers. Windows Event IDs 4624 (successful logon) and 4776 (NTLM authentication) are key. Authentication logs on domain controllers also capture NTLM events.

Answer

DNS logs from the internal DNS server

Answer

Firewall logs showing outbound connections

Question 10

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from a known internal IP address to a file server. The user authenticated successfully on the next attempt. Which classification best describes this alert?

Accepted Answer

False positive. The alert is a false positive because a single failed login followed by success is normal user behavior and not indicative of malicious activity.

Answer

True negative

Answer

True positive

Answer

False negative

Question 11

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The analyst reviews the finding and determines that the vulnerability is mitigated by a Web Application Firewall (WAF) deployed in front of the server. What should the analyst do with this finding?

Accepted Answer

Document the compensating control and track the finding until patched.. The vulnerability is effectively mitigated by the compensating control (WAF), so it should be documented as such and tracked until the patch is applied.

Answer

Mark the finding as a false positive and close it.

Answer

Immediately patch the server to remove the vulnerability.

Answer

Increase the scan frequency to detect if the vulnerability changes.

Question 12

An analyst is reviewing network traffic logs and notices a series of connections from an internal workstation to an external IP address on TCP port 53. The traffic consists of large DNS queries with random-looking subdomains. Which technique is most likely being used?

Accepted Answer

DNS tunneling. DNS tunneling uses the DNS protocol to exfiltrate data by encoding it in DNS queries, often with random-looking subdomains.

Answer

Domain generation algorithm (DGA)

Answer

Beaconing

Answer

HTTP smuggling

Question 13

An EDR alert shows that a process named svchost.exe with parent process cmd.exe executed a PowerShell command to create a scheduled task. The scheduled task runs a script from a remote share. What should the analyst suspect?

Accepted Answer

Persistence mechanism using a LOLBin. The parent-child relationship is abnormal: svchost.exe should not have cmd.exe as its parent. This indicates a living off the land (LOLBin) technique using svchost.exe to execute malicious code.

Answer

Lateral movement via scheduled tasks

Answer

Normal administrative activity

Answer

Memory injection attack

Question 14

A security team is configuring a vulnerability scanner for external scanning of their public-facing web applications. Which scan type will provide the most accurate assessment of vulnerabilities without requiring credentials?

Accepted Answer

External scan. An external scan assesses the attack surface from the internet perspective, typically without credentials. Agent-based and authenticated scans require credentials or internal access.

Answer

Agent-based scan

Answer

Authenticated scan

Answer

Internal scan

Question 15

An analyst is tasked with creating a correlation rule in the SIEM to detect beaconing activity. Which log sources and fields are most relevant to model this behavior?

Accepted Answer

Firewall logs and connection timestamps. Beaconing involves periodic outbound connections, so firewall logs (source IP, destination IP, destination port) and connection timestamps are essential for detecting regularity.

Answer

Authentication logs and user IDs

Answer

Endpoint logs and process creation

Answer

DNS logs and query types