CS0-003 Security Operations Practice Test 9 — 15 Questions

Question 1

During a threat hunting exercise, the hunter creates a hypothesis based on recent threat intelligence about a new ransomware variant that uses scheduled tasks for persistence. Which ATT&CK technique should the hunter focus on?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

T1053.005 (Scheduled Task). Scheduled tasks are a persistence technique (T1053.005). The hunter should focus on the persistence tactic and the specific technique for scheduled tasks.

Answer

T1566.001 (Spearphishing Attachment)

Answer

T1059.001 (PowerShell)

Answer

T1547.001 (Registry Run Keys)

Question 2

An analyst is reviewing a packet capture and notices a TCP connection with the following sequence: SYN, SYN-ACK, ACK, SYN, ACK. What does this pattern indicate?

Accepted Answer

TCP session hijacking or MITM attempt. After the three-way handshake, a second SYN (from the same source) with the same sequence number suggests a man-in-the-middle (MITM) attack using TCP injection or session hijacking.

Answer

TCP SYN flood attack

Answer

TCP port scan

Answer

Normal TCP retransmission due to packet loss

Question 3

A YARA rule is created to detect a specific malware family. The rule uses the string "MZ" at offset 0 and the string "malware" somewhere in the file. The analyst finds that many legitimate executables trigger the rule. What is the most effective way to reduce false positives?

Accepted Answer

Add a condition to check for a specific file size range.. Adding conditions like file size or entry point constraints narrows the rule to specific malware characteristics, reducing false positives from benign files.

Answer

Increase the rule's priority to avoid scanning all files.

Answer

Use the "pe" module to check for a specific section name.

Answer

Remove the "MZ" condition since all PE files have it.

Question 4

An analyst is investigating a memory dump of a compromised system and finds a process that appears to be running inside another process's memory space, with no associated executable on disk. Which technique best describes this finding?

Accepted Answer

Process hollowing. Process hollowing involves creating a legitimate process in a suspended state, replacing its memory with malicious code, and resuming it. The absence of an on-disk executable is a key indicator.

Answer

Reflective DLL injection

Answer

API hooking

Answer

DLL injection

Question 5

A SIEM alert is generated for a user who logged into a workstation at 2:00 AM, which is outside their normal working hours. The user's manager confirms the user was on call and had legitimate reason to log in. How should the analyst classify this alert?

Accepted Answer

False positive. The alert is a false positive because the activity is legitimate despite being outside normal hours.

Answer

False negative

Answer

True positive

Answer

True negative

Question 6

An analyst is tuning a SIEM rule that triggers on failed logins. Which TWO modifications would most effectively reduce false positives without missing actual brute-force attacks? (Select TWO.)

Accepted Answer

Add a condition that the source IP is external to the network.. Limiting to remote logins reduces false positives from local console failures. Adding a threshold (e.g., >5) ensures only excessive failures alert, reducing noise from single failures.

Answer

Remove the rule entirely because failed logins are common.

Answer

Exclude failed logins from known administrative accounts.

Answer

Increase the threshold to require at least 10 failed login attempts within 5 minutes.

Question 7

An analyst is reviewing cloud audit logs from AWS CloudTrail and notices an API call to create an IAM user with administrative privileges from an IP address outside the corporate network. Which TWO actions should the analyst take first? (Select TWO.)

Accepted Answer

Review CloudTrail logs for any other suspicious API calls.. Disabling the user prevents further actions while preserving the account for investigation. Reviewing CloudTrail logs helps identify the scope and source of the activity. Resetting the root user credentials is also critical because the suspicious API call may indicate root account compromise, and rotating root credentials prevents the attacker from maintaining administrative access.

Answer

Ignore the alert because CloudTrail logs are not reliable.

Answer

Contact the user's manager to verify if the creation was authorized.

Answer

Delete the newly created IAM user immediately.

Question 8

A security analyst is reviewing a SIEM alert that triggered on a known malicious IP address communicating with an internal server. The analyst checks the threat intelligence feed and confirms the IP is associated with a command-and-control server. What type of alert is this?

Accepted Answer

True positive. A true positive occurs when an alert correctly identifies malicious activity. The IP is confirmed as a C2 server, so the alert is valid.

Answer

False negative

Answer

False positive

Answer

True negative

Question 9

During a network traffic analysis, a security analyst notices a high volume of DNS queries to a domain that is algorithmically generated. The domain names follow a random pattern and are not resolved to known IP addresses. Which technique is most likely being used?

Accepted Answer

Domain generation algorithm (DGA). Domain Generation Algorithms (DGAs) are commonly used by malware to generate a large number of potential C2 domain names to evade static blocklists.

Answer

DNS tunneling

Answer

Beaconing

Answer

HTTP smuggling

Question 10

A security analyst is investigating an alert from the EDR tool indicating that a process named 'powershell.exe' was launched with a parent process 'winword.exe'. The user's workstation had received a phishing email earlier that day. Which type of attack does this likely indicate?

Accepted Answer

Living off the land binary (LOLBin) abuse. The parent-child relationship of winword.exe spawning powershell.exe is a classic indicator of a malicious macro executing PowerShell code, often used in phishing attacks.

Answer

Process hollowing

Answer

Injection of code into explorer.exe

Answer

Scheduled task creation

Question 11

During a threat hunting engagement, an analyst creates a hypothesis based on a recent threat intelligence report about a new APT group using DLL side-loading for persistence. The analyst decides to search for processes that have loaded a known vulnerable DLL. Which framework is most appropriate to map the TTPs?

Accepted Answer

MITRE ATT&CK. MITRE ATT&CK is the most comprehensive framework for mapping adversary TTPs, including persistence techniques like DLL side-loading (T1574.002).

Answer

Diamond Model

Answer

NIST CSF

Answer

Cyber Kill Chain

Question 12

A security analyst is tuning a SIEM correlation rule that triggers on failed login attempts. The rule is generating a high number of alerts from a specific user who frequently mistypes passwords. The analyst wants to reduce false positives while maintaining detection of brute-force attacks. Which TWO actions should the analyst take?

Accepted Answer

Exclude the specific user account from the rule. Increasing the threshold to require more failed attempts in the time window helps ignore simple mistypes, and excluding the specific user account from the rule prevents alerts for that benign behavior.

Answer

Delete the correlation rule and create a new one from scratch

Answer

Change the rule to alert on every single failed login

Answer

Increase the severity of the rule to trigger an immediate response

Question 13

A security analyst is performing a vulnerability scan on an internal network. The analyst wants to ensure the scanner can identify vulnerabilities in applications that require authentication. Which TWO scan configurations should be used?

Accepted Answer

Agent-based scan. Credentialed scans allow the scanner to authenticate to systems and perform deeper checks, while authenticated scans (agent-based) can also provide access.

Answer

Scan with default credentials

Answer

Non-credentialed scan

Answer

External scan

Question 14

A security analyst is investigating a potential data exfiltration incident. Network traffic analysis shows large outbound data transfers to an external IP address on port 443. The analyst wants to determine if the data was encrypted. Which THREE tools or techniques should the analyst use?

Accepted Answer

Wireshark. Wireshark and tcpdump can capture and inspect packets to analyze the TLS handshake and determine if the data is encrypted. NetFlow/IPFIX provides only flow-level metadata and cannot determine whether the payload is encrypted. Therefore, the correct tools are B and D.

Answer

OSINT tools

Answer

NetFlow/IPFIX

Answer

Vulnerability scanner

Question 15

A security analyst is reviewing an alert from Azure Sentinel that indicates a possible privilege escalation attempt. The alert is based on a correlation rule that detects unusual usage of the 'Add-AzKeyVaultKey' cmdlet by a user who has never used it before. The analyst needs to validate the alert and determine if the activity is malicious. Which THREE actions should the analyst take?

Accepted Answer

Check the user's role assignments and permissions. Checking Azure AD logs for the authentication context, reviewing the user's recent activity history, and examining the Key Vault audit logs for any subsequent access are all relevant steps.

Answer

Run a vulnerability scan on the user's workstation

Answer

Disable the user account immediately