CS0-003 Security Operations Practice Test 3 — 15 Questions

Question 1

A host alert shows certutil.exe downloading a file from an external URL, followed by execution from a user-writable directory. What should the analyst focus on? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Living-off-the-land binary misuse and the downloaded file's hash, origin, and child process. Option D is correct because certutil.exe is a known living-off-the-land binary (LOLBin) that attackers abuse to download payloads, bypassing application whitelisting. The analyst must focus on the downloaded file's hash (to check reputation), origin URL (to assess maliciousness), and child process (to trace execution), as these provide direct evidence of malicious intent or compromise.

Answer

Only check whether antivirus signatures are current

Answer

Reinstall the browser used by the user

Answer

Ignore it because certutil is signed by Microsoft

Question 2

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Network-isolating the endpoint via EDR (e.g., using a built-in quarantine feature) stops the beaconing to the malicious IP and halts credential dumping while preserving disk and memory evidence for forensic analysis. This is the best containment action because it balances incident response needs (stopping active compromise) with evidence preservation, which is critical for legal or regulatory follow-up. Powering off or deleting files would destroy volatile memory evidence and potentially violate chain-of-custody requirements.

Answer

Run disk cleanup to remove temporary files

Answer

Power off the machine immediately in every case

Answer

Allow the host to run until the next maintenance window

Question 3

During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Time synchronization and timezone normalization across log sources. Time discrepancies between log sources are a classic symptom of clock drift or misconfigured time zones. Before assuming data tampering or prioritizing one source, the analyst must verify that all systems use synchronized time (e.g., NTP) and consistent timezone settings. This ensures the timeline is accurate for proper incident reconstruction.

Answer

Prioritize only the source with the highest EPS

Answer

Delete one source from the timeline

Answer

Assume the firewall logs are falsified

Question 4

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Use them internally with only people who need to know and avoid wider redistribution. TLP:AMBER+STRICT restricts sharing to recipients within the organization who need to know, prohibiting further redistribution outside the organization. The SOC must use these indicators internally only with personnel who require them for detection and response, avoiding any external sharing. This ensures compliance with the Traffic Light Protocol (TLP) standard defined by FIRST.org.

Answer

Publish the indicators on a public GitHub repository

Answer

Send the indicators to all customers

Answer

Ignore the indicators because TLP markings are optional

Question 5

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. A deception credential that no legitimate user should know being used to authenticate to a server is a classic indicator of credential theft and lateral movement. In the alert triage phase, this finding warrants high-priority investigation because it suggests an attacker has successfully extracted the credential from the file share and is using it to move laterally within the network, which is a critical security incident.

Answer

The SIEM parser is always broken

Answer

A scheduled password rotation completed successfully

Answer

The file share requires more storage capacity

Question 6

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Container runtime events (e.g., from containerd or CRI-O) capture process spawns like an unexpected shell, Kubernetes audit logs record API calls that could indicate a compromised pod mounting the host filesystem, and network flow logs from the pod (e.g., via eBPF or Calico) reveal outbound connections to an unknown IP. Together, these three telemetry sources provide direct, real-time evidence of the three suspicious behaviors described, making them the most useful for detection and investigation.

Answer

Only monthly vulnerability scan summaries

Answer

Only user password age reports

Answer

Only physical datacenter access logs

Question 7

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Office document spawning a script interpreter from a user context. The correct detection logic is 'Office document spawning a script interpreter from a user context' because the scenario describes a classic malware execution chain: a user opens an invoice document (likely a malicious Office file with embedded macros or exploits), which then launches wscript.exe (a Windows Script Host interpreter) from the user's profile. This behavior is a strong indicator of a script-based attack, such as a macro virus or a downloader, and is directly relevant to detection engineering for endpoint security.

Answer

Successful DHCP renewal

Answer

High CPU usage on the print server

Answer

A password expiry warning

Question 8

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. The SIEM alert describes a workstation requesting a high number of Kerberos service tickets (TGS-REQ) for many different Service Principal Names (SPNs) without subsequent service access. This is classic Kerberoasting reconnaissance: an attacker with valid domain credentials (e.g., after initial compromise) requests TGS tickets for accounts with SPNs, then extracts and cracks the NTLM hash embedded in the ticket offline. The lack of service access confirms the tickets were harvested for offline cracking, not for legitimate use.

Answer

ARP spoofing

Answer

Pass-the-hash using NTLM only

Answer

DNS cache poisoning

Question 9

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

MFA fatigue or push-bombing attack. Option C is correct because the scenario describes MFA fatigue (also called push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This exploits human behavior rather than a technical vulnerability, and is a common initial access vector in credential-stuffing or password-spraying campaigns. The root-cause analysis would directly identify the repeated unsolicited MFA prompts as the mechanism that led to unauthorized approval.

Answer

Password spraying only

Answer

DNS tunnelling

Answer

SSL certificate expiry

Question 10

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Log normalization and field mapping in the parser. Option D is correct because inconsistent field mapping (source IP, user, action) prevents the SIEM from correlating and analyzing log data. The engineer must fix the log parser to normalize these fields into a consistent schema, ensuring that enrichment lookups and analytics function correctly. This aligns with the Security Operations domain focus on data ingestion and parsing.

Answer

Disable all enrichment lookups

Answer

Increase the dashboard refresh interval

Answer

Move logs to cold storage immediately

Question 11

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Option D is correct because correlating DNS query logs with endpoint process and network connection telemetry provides direct evidence of command-and-control (C2) beaconing. The algorithmically generated domains (DGA) and NXDOMAIN responses are strong indicators of an infected host attempting to contact a C2 server that is currently offline or unreachable. By linking the DNS queries to the specific process generating them and the subsequent network connections, the analyst can confirm malicious activity rather than benign misconfiguration.

Answer

Delete the host from the SIEM asset inventory

Answer

Search only for successful HTTP 200 responses

Answer

Block all DNS traffic from the subnet

Question 12

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Decode the command and inspect the process tree, parent document, and network destination. Option C is correct because the encoded PowerShell command is the most direct artifact of the attacker's intent; decoding it reveals the executed payload, while inspecting the process tree confirms the parent-child relationship (winword.exe spawning powershell.exe), the parent document identifies the phishing vector, and the network destination pinpoints the C2 server. This triage provides the evidence needed for containment without destroying forensic data.

Answer

Close the alert because HTTPS is expected traffic

Answer

Disable the SIEM parser for PowerShell events

Answer

Reimage every workstation in the department

Question 13

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Cloud audit logs for identity, policy, and key-management API calls. Option C is correct because cloud audit logs (e.g., AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs) capture control-plane API calls such as IAM policy changes, access key creation, and failed console logons. These logs directly record identity and access management operations, providing the strongest evidence of control-plane compromise by showing who made the changes, from which source IP, and at what time.

Answer

Web server access logs from the public website

Answer

Endpoint antivirus quarantine reports only

Answer

Packet captures from user laptops only

Question 14

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Correlate flow volume with database audit logs and the destination reputation. Option D is correct because correlating the flow volume with database audit logs allows the analyst to verify if the outbound transfers correspond to legitimate database queries or exports, while checking the destination reputation helps determine if the autonomous system is known for malicious activity. This combination provides the clearest triage value by directly linking the network anomaly to potential data exfiltration or a compromised database server, without prematurely disrupting operations or ignoring the encryption indicator.

Answer

Assume encryption means the transfer is safe

Answer

Delete historical flow records to reduce SIEM cost

Answer

Disable all outbound internet access for the organisation

Question 15

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. Option B is correct because the detection of a user authenticating from geographically distant locations within 12 minutes strongly suggests credential theft or token replay, and the subsequent mailbox forwarding rule creation indicates a data exfiltration attempt. The analyst must first correlate sign-in logs (to verify the source IPs and timestamps), MFA results (to check if MFA was satisfied or bypassed), device details (to identify if a known or managed device was used), and mailbox audit events (to confirm who created the forwarding rule and when). This combination directly validates or refutes the UEBA alert by providing the evidence needed to distinguish between a legitimate user with a VPN or a compromised account.

Answer

Only the user's browser cache

Answer

Only DHCP logs from the London office

Answer

The organisation's public DNS zone file