CS0-003 Security Operations Practice Test 5 — 15 Questions

Question 1

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Decode the command and inspect the process tree, parent document, and network destination. Option D is correct because the encoded PowerShell command is the primary indicator of malicious intent; decoding it reveals the attacker's instructions. Inspecting the process tree (winword.exe spawning powershell.exe) confirms the infection vector (phishing attachment), and analyzing the parent document and network destination identifies the payload and C2 server. This sequence directly addresses root-cause analysis by tracing the attack from initial access to execution.

Answer

Disable the SIEM parser for PowerShell events

Answer

Reimage every workstation in the department

Answer

Close the alert because HTTPS is expected traffic

Question 2

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Cloud audit logs for identity, policy, and key-management API calls. Option C is correct because cloud audit logs (e.g., AWS CloudTrail, Azure Activity Log) capture control-plane API calls such as IAM policy changes, key creation, and authentication failures. These logs directly record the identity and resource management actions that indicate a compromise of the cloud management plane, whereas endpoint or network telemetry only reflects data-plane activity and cannot see API-level administrative actions.

Answer

Endpoint antivirus quarantine reports only

Answer

Packet captures from user laptops only

Answer

Web server access logs from the public website

Question 3

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Correlate flow volume with database audit logs and the destination reputation. Option C is correct because correlating the outbound flow volume with database audit logs allows you to verify whether the encrypted transfers correspond to legitimate database activity (e.g., scheduled backups or replication) or unauthorized data exfiltration. Checking the destination autonomous system's reputation against threat intelligence feeds (e.g., known C2 infrastructure or bulletproof hosting) provides immediate context on whether the traffic is malicious. This dual-correlation approach gives the highest triage value by confirming or refuting the detection without disrupting operations.

Answer

Disable all outbound internet access for the organisation

Answer

Delete historical flow records to reduce SIEM cost

Answer

Assume encryption means the transfer is safe

Question 4

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. Option D is correct because the scenario describes a potential account takeover or lateral movement, where an impossible travel event (logins from London and Singapore within 12 minutes) is followed by a suspicious mailbox forwarding rule. The analyst must first verify the sign-in logs for authentication details, MFA results to check if the MFA was bypassed or prompted, device details to identify if a known or managed device was used, and mailbox audit events to confirm the forwarding rule creation and its origin. These combined data sources provide the most direct evidence to determine if the activity is malicious or a false positive.

Answer

Only DHCP logs from the London office

Answer

The organisation's public DNS zone file

Answer

Only the user's browser cache

Question 5

A WAF generates repeated SQL injection alerts against a login endpoint. The application team says the requests returned HTTP 200. What should the analyst do before declaring compromise? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Review application logs for query errors, authentication events, and abnormal database access. Option A is correct because HTTP 200 responses from a WAF-protected endpoint do not rule out successful SQL injection; the application may have processed the malicious input without triggering an HTTP error. Reviewing application logs for query errors, authentication anomalies, and abnormal database access provides direct evidence of whether the injection actually succeeded, which is essential before declaring compromise. This approach balances containment by not disrupting legitimate traffic while preserving forensic evidence for analysis.

Answer

Disable the WAF rule because it may be noisy

Answer

Treat every HTTP 200 as proof of exploitation

Answer

Ask users to change passwords without checking logs

Question 6

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Sigma rule. Sigma rules are the correct choice because they are designed as a portable, generic detection format that can be converted into queries for multiple SIEM platforms (e.g., Splunk, QRadar, Elastic) without vendor lock-in. This aligns directly with the threat hunter's requirement for a portable detection that can be easily translated across different environments. In contrast, the other options are either scoring systems, forensic artifacts, or file-specific signatures that lack this cross-platform conversion capability.

Answer

CVSS vector string

Answer

OpenIOC package only

Answer

YARA rule

Question 7

An analyst has several malware samples from the same campaign and wants to detect related files based on unique strings and byte patterns. Which method is MOST appropriate? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Create and test a YARA rule against known-good and known-bad samples. YARA rules are specifically designed to identify and classify malware samples based on textual or binary patterns, including unique strings and byte sequences. By testing a YARA rule against known-good and known-bad samples, the analyst can validate its accuracy and ensure it reliably detects related files from the same campaign while minimizing false positives.

Answer

Tune DHCP lease duration

Answer

Use only a firewall deny rule for port 443

Answer

Create a CVE entry

Question 8

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Suricata or Snort in IDS mode on a monitored network tap or SPAN port. Option C is correct because the requirement is to detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Suricata or Snort in IDS (Intrusion Detection System) mode, deployed on a network tap or SPAN port, passively analyzes packet payloads against signatures and generates alerts without any inline blocking action. This matches the 'detect only, no block' requirement exactly.

Answer

Inline IPS mode with drop rules for all signatures

Answer

A vulnerability scanner run once per quarter

Answer

Host-based file integrity monitoring only

Question 9

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts. Option D is correct because enrichment (URL reputation, sandbox detonation) and mailbox search counts are non-destructive, automated actions that gather threat intelligence without altering systems. This aligns with the SOC's requirement to reduce analyst workload while avoiding destructive actions before confirmation. In the detection engineering phase, tuning to reduce noise without losing signal involves adjusting thresholds or whitelisting benign indicators based on enrichment results.

Answer

Close all similar alerts as duplicates

Answer

Disable the reporting user's account immediately

Answer

Automatically delete all messages from the sender across all mailboxes

Question 10

A host alert shows certutil.exe downloading a file from an external URL, followed by execution from a user-writable directory. What should the analyst focus on? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Living-off-the-land binary misuse and the downloaded file's hash, origin, and child process. Option C is correct because certutil.exe is a known living-off-the-land binary (LOLB) that attackers abuse to download payloads, bypassing application whitelisting. The analyst must focus on the downloaded file's hash (for threat intelligence), its origin URL (to assess the C2 infrastructure), and any child processes spawned (to trace the execution chain). In the containment trade-off phase, preserving these artifacts is critical for forensic analysis while isolating the host.

Answer

Ignore it because certutil is signed by Microsoft

Answer

Reinstall the browser used by the user

Answer

Only check whether antivirus signatures are current

Question 11

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Network-isolating the endpoint through EDR (option B) is the best containment action because it immediately stops the beaconing to the malicious IP and prevents further credential dumping while preserving both disk and memory evidence for forensic analysis. This aligns with incident response best practices where containment must not destroy volatile data (e.g., memory artifacts of running credential-dumping processes) or persistent evidence on disk. EDR isolation typically uses a host-based firewall rule to block all inbound/outbound traffic except to the EDR management channel, ensuring the host is quarantined without powering it off or altering the file system.

Answer

Allow the host to run until the next maintenance window

Answer

Run disk cleanup to remove temporary files

Answer

Power off the machine immediately in every case

Question 12

During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Time synchronization and timezone normalization across log sources. Time synchronization and timezone normalization across log sources is the correct first check because a consistent five-minute offset between firewall and endpoint events for the same connection strongly indicates a clock drift or timezone misconfiguration rather than a security anomaly. In incident reconstruction, analysts must ensure all timestamps are aligned to a common reference (e.g., UTC) and that NTP is properly configured on all devices; otherwise, the timeline is unreliable. This step directly addresses the root cause before any triage or prioritization can occur.

Answer

Prioritize only the source with the highest EPS

Answer

Assume the firewall logs are falsified

Answer

Delete one source from the timeline

Question 13

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Use them internally with only people who need to know and avoid wider redistribution. Option D is correct because TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and explicitly prohibits redistribution beyond that group. The SOC must honor this marking to protect the confidentiality of the indicators and avoid violating the trust model established by the Traffic Light Protocol (TLP), as defined by FIRST.

Answer

Publish the indicators on a public GitHub repository

Answer

Send the indicators to all customers

Answer

Ignore the indicators because TLP markings are optional

Question 14

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. A deception credential is a deliberately planted fake credential (e.g., a honey token) that no legitimate user should ever use. When it is used to authenticate to a server, it indicates that an attacker has discovered the credential and is attempting to use it for lateral movement or credential access. This is a high-fidelity alert that warrants immediate investigation because it directly signals unauthorized activity.

Answer

The file share requires more storage capacity

Answer

A scheduled password rotation completed successfully

Answer

The SIEM parser is always broken

Question 15

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Option B is correct because container runtime events (e.g., Docker/containerd exec logs) capture the unexpected shell launch, Kubernetes audit logs record the pod creation and mount operations, and network flow logs (e.g., NetFlow, eBPF-based tools) reveal the outbound connection to the unknown IP. Together, these provide the granular, real-time telemetry needed to detect and investigate the compromise, unlike static or coarse-grained logs.

Answer

Only physical datacenter access logs

Answer

Only monthly vulnerability scan summaries

Answer

Only user password age reports