CS0-003 Security Operations Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. The JSON firewall rule is applied to a network segment. A security analyst needs to ensure that traffic from a new subnet 10.0.1.0/24 to the same destination is also allowed. Which of the following modifications should the analyst make?

Accepted Answer

Change source_ip to "10.0.0.0/23". Option C is correct because changing the source_ip to '10.0.0.0/23' expands the allowed source range to include both the original subnet (likely 10.0.0.0/24) and the new subnet 10.0.1.0/24, as a /23 prefix covers addresses from 10.0.0.0 to 10.0.1.255. This is the most efficient modification, requiring only a single rule change without adding complexity or reducing security posture.

Answer

Change destination_port to 80

Answer

Add a second rule with source_ip "10.0.1.0/24"

Answer

Change source_ip to "any"

Question 2

Refer to the exhibit. The snippet is from a Windows Security log showing event ID 4688 (Process Creation). Which of the following actions should the analyst take first?

Accepted Answer

Investigate the creator process. The analyst should first investigate the creator process (parent process) because the suspicious svchost.exe spawned from rundll32.exe in a temp directory indicates a classic LOLBins (Living Off the Land Binaries) attack. Event ID 4688 logs the parent process PID (0x1234) and the child process; tracing the parent reveals the initial compromise vector, such as a malicious script or document that invoked rundll32.exe to execute the payload.

Answer

Kill the process with PID 0x1234

Answer

Quarantine the file C:\Users\admin\AppData\Local\Temp\svchost.exe

Answer

Disable rundll32.exe on the system

Question 3

A security analyst notices that an IDS is generating a high number of false positives for legitimate encrypted traffic. Which tuning method should the analyst use to reduce false positives without reducing detection capability?

Accepted Answer

Whitelist the source IP addresses of known, trusted servers.. Whitelisting the source IP addresses of known, trusted servers reduces false positives by instructing the IDS to ignore alerts for encrypted traffic from those specific hosts. This approach preserves detection capability because the IDS continues to apply all signatures to traffic from other, potentially malicious sources. It is a targeted tuning method that does not disable detection mechanisms or alter sensitivity thresholds, which could otherwise miss real threats.

Answer

Disable the signatures that trigger for encrypted traffic.

Answer

Increase the sensitivity threshold for the encrypted traffic signatures.

Answer

Enable full packet capture and analyze the encrypted traffic manually.

Question 4

During an incident response, the team identifies that a workstation was compromised via a phishing email. Which of the following should be performed immediately after containment?

Accepted Answer

Eradicate the malware from the workstation.. Option D is correct because, immediately after containment, the priority is to eradicate the malware from the workstation to prevent reinfection or lateral movement. Containment isolates the system, but eradication removes the malicious artifacts (e.g., registry keys, scheduled tasks, or malicious binaries) to ensure the system is clean before recovery. This step aligns with the NIST SP 800-61 incident response lifecycle, where eradication follows containment to eliminate the threat's foothold.

Answer

Notify law enforcement about the phishing campaign.

Answer

Collect forensic evidence from the workstation.

Answer

Conduct a root cause analysis of the phishing email.

Question 5

A security analyst is reviewing SIEM alerts and sees multiple failed logon events from a single external IP address across several user accounts within two minutes. The source IP is from a known malicious geolocation. What type of attack is most likely occurring?

Accepted Answer

Brute-force attack. The scenario describes multiple failed logon attempts from a single external IP against several user accounts within a short time window. This pattern is characteristic of a brute-force attack, where an attacker systematically tries common or guessed passwords across multiple accounts to gain unauthorized access. The single source IP and rapid sequence of failures distinguish it from a password spraying attack, which spreads attempts across many accounts slowly to avoid lockout thresholds.

Answer

Password spraying attack

Answer

Distributed denial-of-service (DDoS) attack

Answer

Pass-the-hash attack

Question 6

A company wants to ensure that all servers are patched within 30 days of a critical patch release. The security team must verify compliance without causing downtime. Which of the following is the best approach?

Accepted Answer

Conduct automated vulnerability scanning of the server IP ranges.. Automated vulnerability scanning provides a non-intrusive method to check patch levels without affecting system availability. Manual checks are inefficient; agent-based solutions are effective but may introduce overhead; network segmentation does not verify patch compliance.

Answer

Perform manual patch verification on a rotating schedule.

Answer

Deploy an agent-based patch management solution to all servers.

Answer

Implement network segmentation to isolate unpatched servers.

Question 7

An organization's incident response playbook specifies that after a confirmed malware infection, the infected system should be isolated from the network. Which action best achieves isolation?

Accepted Answer

Disable the network interface card (NIC) via software.. Disabling the network interface card (NIC) via software immediately stops all network traffic to and from the infected system, effectively isolating it from the network while preserving the system's state for forensic analysis. This action aligns with the incident response playbook's requirement for network isolation without destroying volatile data or evidence.

Answer

Uninstall the operating system and reimage.

Answer

Pull the power cord from the infected system.

Answer

Delete the infected user's account.

Question 8

A forensic analyst is called to acquire data from a live server that is critical to business operations. The server cannot be powered down. Which acquisition method should the analyst use to minimize alteration of volatile data?

Accepted Answer

Use a forensic bootable USB to perform a live acquisition.. Option C is correct because using a forensic bootable USB allows the analyst to boot the server into a controlled forensic environment without relying on the compromised or running operating system. This method minimizes alteration of volatile data by loading a trusted kernel that captures RAM contents before any write operations occur, preserving the integrity of the evidence.

Answer

Perform a full disk image while the system is running.

Answer

Dump the system RAM and then shut down for disk imaging.

Answer

Acquire data over the network using a remote forensic tool.

Question 9

A SOC analyst is reviewing logs from a web server and sees the following request: GET /../../etc/passwd HTTP/1.1. Which type of web attack is this?

Accepted Answer

Directory traversal. The request GET /../../etc/passwd HTTP/1.1 uses '../' sequences to traverse directories outside the web root, attempting to read the /etc/passwd file. This is the classic signature of a directory traversal (path traversal) attack, which exploits insufficient input validation to access unauthorized files on the server.

Answer

SQL injection

Answer

Cross-site request forgery (CSRF)

Answer

Cross-site scripting (XSS)

Question 10

A security engineer needs to implement a baseline configuration for all new Linux servers. Which of the following should be included in the baseline to reduce the attack surface?

Accepted Answer

Disable all unnecessary services and daemons.. Disabling all unnecessary services and daemons directly reduces the attack surface by eliminating potential entry points for exploitation. Each running service represents a vector for attacks, such as buffer overflows or misconfigurations, and removing them minimizes the number of listening ports and active processes. This aligns with the principle of least functionality, a core security baseline for Linux servers.

Answer

Enable strong password policies for all users.

Answer

Enable comprehensive audit logging.

Answer

Configure disk encryption for all data volumes.

Question 11

During a threat hunting exercise, an analyst formulates a hypothesis that an attacker may be using DNS tunneling to exfiltrate data. Which data source would provide the best evidence to confirm or deny this hypothesis?

Accepted Answer

Deep packet inspection (DPI) of DNS traffic. Deep packet inspection (DPI) of DNS traffic is the best evidence because DNS tunneling works by encoding data within DNS queries and responses, often using non-standard record types (e.g., TXT, NULL) or unusually long domain names. DPI can decode the payload within DNS packets to reveal hidden data, whereas other methods only see metadata or connection summaries. This allows the analyst to directly inspect the content of DNS messages for signs of exfiltration, such as base64-encoded data or anomalous query patterns.

Answer

Firewall logs showing allowed outbound connections

Answer

NetFlow records from the border router

Answer

EndPoint detection and response (EDR) logs showing DNS client activity

Question 12

Which TWO of the following are common indicators of compromise (IOCs) that can be identified through log analysis?

Accepted Answer

Unexpected changes to file hashes. Unexpected changes to file hashes (A) are a key indicator of compromise because they suggest that a file has been modified, potentially by malware or an attacker. Log analysis can detect these changes by comparing current file hashes against a known-good baseline, revealing unauthorized alterations that may indicate a security breach.

Answer

Expired SSL certificates

Answer

Scheduled backup completion logs

Answer

Use of strong passwords

Question 13

Which THREE of the following are essential tools and technologies used in a Security Operations Center (SOC) for monitoring and detection?

Accepted Answer

Endpoint Detection and Response (EDR). Endpoint Detection and Response (EDR) is essential in a SOC because it provides continuous monitoring and analysis of endpoint activities, enabling detection of advanced threats such as fileless malware and ransomware. EDR tools collect telemetry data from endpoints, correlate it with threat intelligence, and allow for automated response actions, which are critical for real-time incident detection and investigation.

Answer

Firewall

Answer

Vulnerability scanner

Question 14

An organization has identified a ransomware outbreak on several workstations. Which TWO actions should the incident response team take immediately?

Accepted Answer

Disconnect all network shares to prevent encryption.. Isolating affected systems prevents further spread, and disconnecting network shares stops lateral movement. Contacting law enforcement can be done later; paying ransom is not recommended; reimaging may destroy evidence before investigation.

Answer

Pay the ransom to recover data quickly.

Answer

Contact law enforcement for guidance.

Answer

Reimage all affected systems immediately.

Question 15

Based on the exhibit, which type of issue is most likely affecting the server's network performance?

Accepted Answer

Faulty network cable or interface. The exhibit shows excessive CRC errors and runts on the server's network interface, which are classic symptoms of a faulty physical layer component such as a damaged cable or failing NIC. These errors indicate that frames are being corrupted during transmission, and the interface is discarding them, leading to retransmissions and degraded performance. A faulty cable or interface directly causes these physical-layer issues, unlike configuration or driver problems.

Answer

Duplex mismatch between the server and switch

Answer

Incorrect TCP/IP configuration

Answer

Outdated network driver

CS0-003 Security Operations Practice Test 10 — 15 Questions

Exhibit

CS0-003 Security Operations Practice Test 10 — 15 Questions

Exhibit