CS0-003 Security Operations Practice Test 4 — 15 Questions

Question 1

A WAF generates repeated SQL injection alerts against a login endpoint. The application team says the requests returned HTTP 200. What should the analyst do before declaring compromise? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Review application logs for query errors, authentication events, and abnormal database access. Option C is correct because a WAF alert indicates a potential SQL injection attempt, but an HTTP 200 response does not confirm exploitation—it could mean the WAF blocked the payload or the application handled the input safely. Reviewing application logs for query errors, authentication events, and abnormal database access provides direct evidence of whether the injection succeeded, such as seeing SQL error messages in the logs or unauthorized data retrieval. This approach separates true positives (actual compromise) from false positives (blocked or harmless attempts), enabling precise tuning without losing detection of real attacks.

Answer

Treat every HTTP 200 as proof of exploitation

Answer

Ask users to change passwords without checking logs

Answer

Disable the WAF rule because it may be noisy

Question 2

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Sigma rule. Sigma rules are platform-agnostic, portable detection signatures written in YAML that can be automatically converted into queries for multiple SIEM platforms (Splunk, QRadar, Elastic, etc.). This makes them the ideal choice for a threat hunter who needs a single detection artifact for suspicious rundll32 execution that can be deployed across different SIEM environments without manual rewriting.

Answer

CVSS vector string

Answer

YARA rule

Answer

OpenIOC package only

Question 3

An analyst has several malware samples from the same campaign and wants to detect related files based on unique strings and byte patterns. Which method is MOST appropriate? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Create and test a YARA rule against known-good and known-bad samples. YARA rules are specifically designed to identify and classify malware samples based on textual or binary patterns, including unique strings and byte sequences. By creating and testing a YARA rule against known-good and known-bad samples, the analyst can reliably detect related files from the same campaign, as YARA allows for pattern matching across multiple files. This method is the most appropriate for the given task of detecting related files based on unique strings and byte patterns.

Answer

Use only a firewall deny rule for port 443

Answer

Create a CVE entry

Answer

Tune DHCP lease duration

Question 4

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Suricata or Snort in IDS mode on a monitored network tap or SPAN port. Suricata or Snort in IDS mode on a monitored network tap or SPAN port is correct because it passively inspects packet payloads against signatures without affecting traffic flow, meeting the requirement to detect exploit traffic and generate alerts without blocking. IDS mode ensures no inline packet drops, while a tap or SPAN port provides full packet visibility for signature matching.

Answer

A vulnerability scanner run once per quarter

Answer

Host-based file integrity monitoring only

Answer

Inline IPS mode with drop rules for all signatures

Question 5

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts. Option D is correct because it aligns with the SOAR playbook's goal of reducing analyst workload through automated enrichment and triage without taking destructive action. Enriching URLs and detonating attachments in a sandbox provides threat intelligence, while collecting mailbox search counts helps quantify the incident's scope. This non-destructive evidence gathering allows analysts to make informed decisions before any containment or remediation steps.

Answer

Close all similar alerts as duplicates

Answer

Disable the reporting user's account immediately

Answer

Automatically delete all messages from the sender across all mailboxes

Question 6

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Option C is correct because network-isolating the endpoint via EDR (e.g., using a firewall rule or agent-based isolation) stops the beaconing to the malicious IP and prevents further credential dumping, while preserving the disk and memory evidence needed for forensic analysis. This balances containment with evidence preservation by keeping the system powered on so volatile data (e.g., running processes, network connections) is not lost, unlike a hard shutdown.

Answer

Allow the host to run until the next maintenance window

Answer

Run disk cleanup to remove temporary files

Answer

Power off the machine immediately in every case

Question 7

During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Time synchronization and timezone normalization across log sources. The five-minute discrepancy between firewall and endpoint events for the same connection is a classic symptom of clock drift or misconfigured time synchronization. The analyst should first check NTP (Network Time Protocol) settings and timezone normalization across all log sources to ensure timestamps are aligned. Without synchronized time, correlation of events during incident reconstruction is unreliable, making this the foundational step in root-cause analysis.

Answer

Delete one source from the timeline

Answer

Assume the firewall logs are falsified

Answer

Prioritize only the source with the highest EPS

Question 8

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Use them internally with only people who need to know and avoid wider redistribution. Option D is correct because TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and prohibits any wider redistribution. In the alert triage phase, using the indicators internally ensures the SOC can investigate and respond without violating the information-sharing constraints set by the vendor, which is a mandatory security practice, not optional.

Answer

Ignore the indicators because TLP markings are optional

Answer

Publish the indicators on a public GitHub repository

Answer

Send the indicators to all customers

Question 9

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. The deception credential is a honeytoken—a fake credential placed in a file share to detect unauthorized use. Since no legitimate user should know it, any authentication attempt using it indicates an attacker has accessed the file share (credential access) and is attempting to move laterally (lateral movement). This warrants high-priority investigation because it directly signals a breach in progress.

Answer

The SIEM parser is always broken

Answer

A scheduled password rotation completed successfully

Answer

The file share requires more storage capacity

Question 10

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Container runtime events (e.g., from containerd or CRI-O) capture process spawns like a shell inside the container, Kubernetes audit logs record API calls that mount host paths (e.g., `hostPath` volumes), and network flow logs (e.g., from CNI plugins or eBPF) show outbound connections to unknown IPs. Together, these three telemetry sources provide the full kill chain—execution, privilege escalation, and exfiltration—making option C the most useful for detection engineering.

Answer

Only physical datacenter access logs

Answer

Only user password age reports

Answer

Only monthly vulnerability scan summaries

Question 11

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Office document spawning a script interpreter from a user context. Option D is correct because the scenario describes a classic phishing attack where a malicious macro or embedded script in an Office document (the invoice) executes wscript.exe, a Windows Script Host interpreter, from the user's profile. This detection logic directly correlates the initial vector (Office document) with the suspicious process execution (script interpreter) in the user context, which is a key indicator of malware or unauthorized script activity.

Answer

High CPU usage on the print server

Answer

A password expiry warning

Answer

Successful DHCP renewal

Question 12

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. The alert describes a workstation requesting a high number of Kerberos service tickets for many SPNs without subsequent service access. This is characteristic of Kerberoasting reconnaissance, where an attacker with domain credentials (e.g., a compromised user account) requests TGS tickets for service accounts to extract their NTLM hashes offline for cracking. The lack of actual service access confirms the tickets are being harvested, not used for legitimate authentication.

Answer

ARP spoofing

Answer

Pass-the-hash using NTLM only

Answer

DNS cache poisoning

Question 13

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

MFA fatigue or push-bombing attack. Option C is correct because the scenario describes MFA fatigue (also called push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This exploits the human tendency to accept prompts to stop interruptions, bypassing MFA security. The clearest next triage step is to investigate the source IPs and authentication logs for anomalous patterns and immediately revoke the approved session.

Answer

DNS tunnelling

Answer

Password spraying only

Answer

SSL certificate expiry

Question 14

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Log normalization and field mapping in the parser. Option C is correct because inconsistent field mapping (source IP, user, action) prevents the SIEM from correlating events correctly. Log normalization via a parser ensures that fields from the new cloud log source are transformed into a consistent schema (e.g., ECS or CIM), enabling analytics to function. Without fixing the parser, the data remains unusable regardless of other configuration changes.

Answer

Increase the dashboard refresh interval

Answer

Move logs to cold storage immediately

Answer

Disable all enrichment lookups

Question 15

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Option A is correct because correlating DNS query logs with endpoint process and network connection telemetry directly validates command-and-control (C2) beaconing. The algorithmically generated domains (AGDs) and NXDOMAIN responses are classic indicators of a domain generation algorithm (DGA) attempting to resolve a C2 server that may be offline or blocked. By linking the DNS queries to specific processes and network connections on the endpoint, the analyst can confirm whether the workstation is executing malicious code that generates these queries, rather than benign software or a false positive.

Answer

Search only for successful HTTP 200 responses

Answer

Block all DNS traffic from the subnet

Answer

Delete the host from the SIEM asset inventory