CS0-003 Security Operations — Timed 30 Questions

Question 1

During a memory analysis of a compromised host, an analyst finds that 'svchost.exe' is running from 'C:\Users\Public\svchost.exe' instead of 'C:\Windows\System32\svchost.exe'. The process has injected code into a legitimate 'explorer.exe' process. What technique is being observed?

30 minute time limit — choose an answer to begin.

Accepted Answer

DLL injection. The observation shows a legitimate process (explorer.exe) carrying injected malicious code from a non-standard svchost.exe path. DLL injection is the technique where an attacker forces a legitimate process to load a malicious DLL, often by writing the DLL path into the target process's memory and invoking LoadLibrary. Here, the injected code into explorer.exe is the hallmark of DLL injection, not process hollowing or side-loading.

Answer

WMI persistence

Answer

Process hollowing

Answer

DLL side-loading

Question 2

An analyst is reviewing logs from multiple sources and sees that a user logged into a workstation at 8:00 AM, then the same user logged into a server in a different building at 8:01 AM. The authentication logs show the same source IP for both logins. What should the analyst suspect?

Accepted Answer

A pass-the-hash attack. It's physically impossible to travel between buildings in one minute. The same source IP suggests a possible pass-the-hash or credential relay attack from the workstation to the server.

Answer

Normal behavior for an administrator

Answer

A user with superhuman speed

Answer

A false positive due to time synchronization issues

Question 3

During a network traffic analysis, a security analyst observes repeated connections from an internal host to an external IP address on TCP port 53. The traffic volume is low but consistent. What type of anomaly is most likely indicated?

Accepted Answer

Data exfiltration via DNS tunneling. DNS tunneling often uses port 53 to exfiltrate data by encoding it in DNS queries. The consistent low-volume traffic to a single external IP suggests covert communication.

Answer

Lateral movement using SMB

Answer

Port scan activity from an internal host

Answer

Beaconing to a command-and-control server

Question 4

A security analyst is tuning a SIEM rule that generates alerts for any failed login attempt. The rule produces too many alerts, overwhelming the team. Which TWO actions would most effectively reduce false positives while maintaining detection of actual brute-force attacks?

Accepted Answer

Exclude failed logins from known service accounts. Option E is correct because replacing a per-event alert with a threshold-based correlation (5 failures from the same source IP within a 10-minute window) is the standard way to suppress isolated, benign failed logins while still firing on the repeated-failure pattern that characterizes brute-force attacks. Option A is correct because known service accounts (e.g., scheduled tasks, backup jobs, monitoring agents) frequently generate failed logins due to stale cached credentials or misconfigured services, so excluding them removes a large, predictable source of false positives without hiding attacker activity against interactive user accounts. Option B is wrong because disabling the rule eliminates detection of real brute-force attacks entirely, which violates the requirement to maintain detection. Option C is wrong because raising severity to critical for every failed login does nothing to reduce alert volume and actually increases the operational burden. Option D is wrong because a correlation rule on success-after-multiple-failures detects successful compromise rather than the brute-force attempt itself, so it would not preserve detection of ongoing brute-force attacks.

Answer

Disable the rule entirely

Answer

Increase the alert severity to critical for all failed logins

Answer

Add a correlation rule to trigger on successful login after multiple failures

Question 5

A threat hunter notices that a legitimate Windows binary 'rundll32.exe' is executing with network connections to an external IP address. The parent process is 'winword.exe'. Which LOLBin technique is most likely being used?

Accepted Answer

DLL side-loading via rundll32. Rundll32.exe is a known LOLBin that can be used to execute DLLs. When spawned from winword.exe, it often indicates a macro-based attack loading a remote payload.

Answer

Scheduled task creation

Answer

Process hollowing

Answer

WMI persistence

Question 6

A vulnerability scan report shows a critical finding with a CVSS score of 9.8. The system is a web server behind a WAF that blocks the attack vector. What should the analyst do?

Accepted Answer

Document the WAF as a compensating control and accept the risk. When a vulnerability is mitigated by a compensating control such as a WAF blocking the attack vector, the analyst should document the compensating control and formally accept the residual risk rather than treating the finding as a false positive or patching unnecessarily. This preserves an accurate risk record.

Answer

Report the finding as a false positive

Answer

Re-run the scan with credentials

Answer

Patch the server immediately

Question 7

During an incident response, an analyst identifies suspicious registry modifications in the 'Run' key and a scheduled task that executes a script. Which three persistence mechanisms are most likely being used? (Choose three.)

Accepted Answer

Scheduled task. The incident mentions a registry Run key modification and a scheduled task. These are two persistence mechanisms. No information suggests a service is involved. Therefore, the correct answer should be C and E. The question as written ('Choose three') is inconsistent with the evidence.

Answer

AppInit_DLLs

Answer

Service

Answer

WMI event subscription

Question 8

An analyst is creating a detection rule for lateral movement using SMB. Which two network indicators should be included in the rule? (Choose two.)

Accepted Answer

SMB traffic between workstations. Option C is correct because SMB (TCP 445/139) is normally client-to-server traffic, so workstation-to-workstation SMB sessions are a strong lateral-movement indicator, as seen with tools like PsExec or WannaCry-style propagation. Option D is correct because access to administrative shares such as IPC$, ADMIN$, or C$ is a hallmark of remote execution and credential abuse during lateral movement. Option A is not a network indicator and reflects authentication events rather than SMB traffic. Option B is unrelated to SMB lateral movement and typically indicates tunneling or C2 over DNS. Option E describes HTTPS traffic on port 443, which is not an SMB indicator.

Answer

Repeated failed logins to multiple hosts

Answer

High volume of DNS queries

Answer

Unusual outbound connections on port 443

Question 9

A security analyst is investigating an alert from an endpoint EDR that shows a process with a parent-child relationship where the parent is Microsoft Word and the child process is wscript.exe executing a command to download a PowerShell script. Which MITRE ATT&CK technique does this likely represent?

Accepted Answer

Phishing (T1566). The scenario describes a classic phishing attack chain: Microsoft Word (the parent) spawning wscript.exe to download a PowerShell script. This is a hallmark of malicious documents delivered via phishing emails (T1566), where the user opens a weaponized attachment that executes a script to fetch additional payloads. The parent-child relationship and the use of wscript.exe to download PowerShell are direct indicators of initial access via phishing, making T1566 the correct MITRE ATT&CK technique.

Answer

Lateral Movement (TA0008)

Answer

Credential dumping (T1003)

Answer

Persistence (TA0003)

Question 10

A security analyst is configuring a vulnerability scanner to evaluate the security posture of internal servers. Which type of scan provides the most accurate assessment of missing patches?

Accepted Answer

Credentialed internal scan. Credentialed scans authenticate to the target OS and can query patch levels directly, yielding more accurate results than uncredentialed scans.

Answer

Network-based scan without credentials

Answer

Non-credentialed external scan

Answer

Agent-based scan

Question 11

During a threat hunt, an analyst notices repeated DNS queries for random-looking subdomains under a legitimate domain. The domains have high entropy and never existed before. What technique is most likely being used?

Accepted Answer

Domain Generation Algorithm (DGA). Domain Generation Algorithms (DGAs) generate many random domain names to evade blocklists. C2 malware often uses DGAs.

Answer

Fast flux

Answer

DNS cache poisoning

Answer

DNS tunneling

Question 12

An analyst is reviewing a memory dump from a compromised workstation and finds a process that appears to be a legitimate system process but has a different parent process and is running from a non-standard location. Which analysis technique is most appropriate?

Accepted Answer

Perform a YARA scan on the process memory. Process hollowing is a technique where an attacker creates a legitimate process in a suspended state, replaces its memory with malicious code, and resumes it. The process may appear legitimate but with anomalies in parent and path.

Answer

Compare the process's command line with baseline

Answer

Analyze network connections from the process

Answer

Check the process's digital signature

Question 13

A security analyst is investigating a potential data exfiltration using DNS. Which TWO indicators are most consistent with DNS tunneling?

Accepted Answer

DNS responses with unusually large payload sizes. Option B is correct because DNS tunneling encodes stolen data into DNS responses (or queries), producing unusually large payload sizes that exceed the typical ~512-byte UDP DNS limit or contain long TXT records, which is a hallmark of tunneling tools like iodine or dnscat2. Option C is correct because tunneling generates a high volume of queries to a single domain as the attacker's authoritative server relays chunks of exfiltrated data, creating a sustained query pattern to one domain rather than normal distributed DNS traffic. Option A is not specific to tunneling, since frequent NXDOMAIN responses more often indicate DGA malware or misconfiguration. Option D is weak because unusual TLDs like .tk can appear in legitimate or malicious domains but do not by themselves indicate tunneling. Option E is normal DNS behavior and not indicative of exfiltration.

Answer

Frequent NXDOMAIN responses

Answer

Queries for domains with unusual top-level domains (e.g., .tk)

Answer

Multiple queries from different hosts to the same legitimate domain

Question 14

A threat hunter is using osquery to look for persistence mechanisms on a set of Windows endpoints. Which THREE registry keys or scheduled tasks should the hunter check for common persistence?

Accepted Answer

HKLM\SYSTEM\CurrentControlSet\Services. Option C is correct because the HKLM\SYSTEM\CurrentControlSet\Services registry hive stores Windows service configurations, and attackers commonly install malicious services here to achieve persistence that starts at boot under SYSTEM privileges. Option D is correct because HKCU\Software\Microsoft\Windows\CurrentVersion\Run is a per-user autostart key that executes programs at logon, a classic and frequently abused persistence location. Option E is correct because scheduled tasks in Task Scheduler can be created to run malicious code at specified triggers (logon, boot, time-based), making them a well-known persistence mechanism. Option A is not marked correct because AppInit_DLLs, while historically abused, is a DLL injection/loading mechanism rather than a scheduled task or the standard Run/Services persistence keys the question targets, and it is largely disabled by default on modern Windows with Secure Boot. Option B is not marked correct because the user's Startup folder is a file system location, not a registry key or scheduled task, so it falls outside the scope of what the question asks the hunter to check.

Answer

HKLM\Software\Microsoft\Windows\CurrentVersion\AppInit_DLLs

Answer

User's Startup folder

Question 15

An analyst is triaging a SIEM alert that fires when a single host makes more than 100 outbound connections to unique IPs within one minute. The analyst finds that the host is a web server responding to legitimate client requests. What is the best action to reduce false positives?

Accepted Answer

Increase the threshold to 500 connections per minute. Adjusting the threshold to a higher number that accounts for normal web server traffic will reduce false positives while still detecting scanning behavior.

Answer

Change the rule to alert on inbound connections

Answer

Disable the alert rule

Answer

Create an exception for the web server's IP

Question 16

During a threat hunt, an analyst is looking for signs of lateral movement using pass-the-hash. Which three of the following log sources would be most useful for detecting this technique?

Accepted Answer

Sysmon Event ID 3 (network connection). Sysmon Event ID 3 (network connection) is correct because pass-the-hash lateral movement generates outbound SMB/RPC/WinRM connections (e.g., TCP 445, 135, 5985) from the compromised host to remote targets, and Event ID 3 records the source/destination IPs, ports, and the initiating process image, which is essential for spotting anomalous internal connections. Domain controller authentication logs are correct because pass-the-hash produces NTLM authentications (Event ID 4624 with Logon Type 3 and Authentication Package NTLM) on the target/DC, and correlating these with the originating workstation reveals the credential-reuse pattern typical of PtH. Windows Security Event Log Event ID 4624 is correct because it records successful logons with fields such as Logon Type (3 for network), Authentication Package (NTLM), and the account name, allowing the analyst to detect NTLM network logons that should normally use Kerberos. DNS query logs (A) are not directly useful because pass-the-hash uses IP addresses and SMB/RPC rather than DNS resolution for the authentication itself, and Sysmon Event ID 1 (D) shows process creation but not the network authentication traffic that distinguishes PtH from other credential use.

Answer

DNS query logs

Answer

Sysmon Event ID 1 (process creation)

Question 17

An analyst is investigating a potential data exfiltration incident. The analyst observes repeated HTTPS connections to a cloud storage provider from a server that does not normally use that service. Which three additional artifacts would strengthen the case for exfiltration?

Accepted Answer

The data transfer volume is significantly higher than normal for that server. Option A is correct because a significantly higher-than-normal data transfer volume from a server to an external cloud storage provider is a strong indicator of data exfiltration, as large outbound transfers are consistent with stolen data being uploaded. Option B is correct because connections occurring during non-business hours suggest activity outside the server's normal operational baseline, which is a common hallmark of attacker-controlled exfiltration to avoid detection. Option E is correct because using a non-standard port for HTTPS (e.g., 8080 instead of 443) can indicate an attempt to bypass egress filtering or blend malicious traffic into allowed ports, strengthening the exfiltration case. Option C is not marked correct because, while a known malicious IP would be suspicious, the scenario already involves a legitimate cloud storage provider, so this artifact is not one of the three that best strengthen the exfiltration hypothesis here. Option D is not correct because connections occurring only during business hours would actually be less suspicious and would weaken rather than strengthen the case for exfiltration.

Answer

The connections are made to a known malicious IP

Answer

The connections occur during business hours only

Question 18

A SOC analyst receives an alert from the SIEM indicating a high volume of outbound traffic from a single workstation to an IP address in a country where the organization does no business. The alert is based on a rule that triggers when outbound traffic exceeds 1 GB in 5 minutes. Upon investigation, the analyst finds that the workstation is used by a developer who downloaded a large dataset from a cloud storage service. Which action should the analyst take to improve the alert's accuracy without disabling it entirely?

Accepted Answer

Add the destination IP to a whitelist in the SIEM rule.. The alert is a false positive because legitimate activity triggered it. The best approach is to tune the rule to exclude known cloud storage IP addresses or increase the threshold to reduce noise while still detecting true exfiltration.

Answer

Increase the alert threshold to 10 GB in 5 minutes.

Answer

Create a correlation rule that combines this alert with other indicators.

Answer

Disable the alert rule permanently.

Question 19

During a traffic analysis, a security analyst notices repeated TCP SYN packets sent to an internal server from an external IP, but the server never responds with SYN-ACK. The external IP sends a new SYN packet every 30 seconds. What does this behavior most likely indicate?

Accepted Answer

A TCP port scan. A single SYN packet sent every 30 seconds from the same external IP to an internal server, with no completed handshake, is characteristic of a slow or stealthy TCP port scan (e.g., a SYN scan using tools like nmap with timing templates). The scanner is probing which ports are open without completing the three-way handshake, and the 30-second interval is designed to evade threshold-based IDS detection.

Answer

A SYN flood attack

Answer

A misconfigured firewall dropping SYN-ACK packets

Answer

A half-open connection due to network latency

Question 20

A security analyst is reviewing DNS logs and notices that a workstation is making frequent queries to domains with random-looking strings, such as 'a3b9f2d1.example.com'. These domains resolve to different IP addresses each time. Which type of activity is most likely being observed?

Accepted Answer

DNS tunneling. The random-looking subdomains of a fixed domain (example.com) and frequent queries are characteristic of DNS tunneling, where data is encoded in DNS queries to a domain controlled by the attacker. DGA typically generates many distinct second-level domains across different TLDs, not subdomains of the same domain.

Answer

Normal DNS caching behavior

Answer

A misconfigured DNS resolver

Answer

Domain generation algorithm (DGA) usage