CS0-003 Security Operations Practice Test 6 — 15 Questions

Question 1

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Office document spawning a script interpreter from a user context. Option A is correct because the scenario describes a classic phishing attack where a malicious macro or embedded script in an Office document (the invoice) executes wscript.exe from the user's profile. This behavior matches the detection logic of 'Office document spawning a script interpreter from a user context,' which is a key indicator of script-based malware execution. The root-cause analysis would identify the malicious document as the initial vector, directly explaining the subsequent process execution.

Answer

High CPU usage on the print server

Answer

A password expiry warning

Answer

Successful DHCP renewal

Question 2

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. Option D is correct because the SIEM alert describes a workstation requesting a high number of Kerberos service tickets for many Service Principal Names (SPNs) without subsequent service access. This is classic Kerberoasting reconnaissance: the attacker uses a valid domain account to request TGS tickets for services, then extracts and cracks the service account passwords offline. The lack of corresponding service access confirms the tickets were not used for legitimate authentication.

Answer

DNS cache poisoning

Answer

ARP spoofing

Answer

Pass-the-hash using NTLM only

Question 3

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

MFA fatigue or push-bombing attack. B is correct because the scenario describes MFA fatigue (also known as push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This is a social engineering technique that exploits human behavior rather than a technical vulnerability in the MFA system itself. The analyst should classify this as an MFA fatigue attack because the user eventually approved a request they did not initiate, which is the hallmark of this attack vector.

Answer

DNS tunnelling

Answer

Password spraying only

Answer

SSL certificate expiry

Question 4

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Log normalization and field mapping in the parser. The correct answer is C because inconsistent mapping of source IP, user, and action fields indicates a parsing or normalization issue. In detection engineering, log normalization and field mapping in the parser ensure that all logs conform to a consistent schema, allowing analytics to correctly correlate and alert on the data. This directly addresses the root cause without discarding or altering the underlying signal.

Answer

Move logs to cold storage immediately

Answer

Disable all enrichment lookups

Answer

Increase the dashboard refresh interval

Question 5

A SOC analyst reviews DNS telemetry and sees a workstation resolving hundreds of algorithmically generated domains at fixed intervals, with most responses returning NXDOMAIN. What evidence should the analyst prioritize to validate command-and-control beaconing? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Correlate DNS query logs with endpoint process and network connection telemetry. Option C is correct because correlating DNS query logs with endpoint process and network connection telemetry provides direct evidence of command-and-control (C2) beaconing. The algorithmically generated domains (DGA) and NXDOMAIN responses are characteristic of malware that generates many domains to evade static blocklists, but only a few are actually registered by the attacker. By mapping the DNS queries to the specific process that initiated them (via endpoint telemetry) and the subsequent network connections (e.g., to the resolved IP of a successful DGA domain), the analyst can confirm C2 activity rather than just anomalous DNS traffic.

Answer

Block all DNS traffic from the subnet

Answer

Search only for successful HTTP 200 responses

Answer

Delete the host from the SIEM asset inventory

Question 6

An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Decode the command and inspect the process tree, parent document, and network destination. Option B is correct because decoding the encoded PowerShell command reveals the attacker's intent, inspecting the process tree shows the execution chain from winword.exe to powershell.exe, examining the parent document identifies the malicious attachment, and analyzing the network destination uncovers the C2 server. This systematic approach provides the clearest next triage step by correlating the initial infection vector with the subsequent malicious activity, enabling the analyst to contain the threat effectively.

Answer

Disable the SIEM parser for PowerShell events

Answer

Reimage every workstation in the department

Answer

Close the alert because HTTPS is expected traffic

Question 7

A cloud tenant shows an unusual spike in IAM policy changes, access key creation, and failed console logons from a new country. Which telemetry set gives the strongest evidence for control-plane compromise? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Cloud audit logs for identity, policy, and key-management API calls. Control-plane operations in cloud environments are managed through APIs for identity (IAM), policy, and key management. Cloud audit logs (e.g., AWS CloudTrail, Azure Activity Log) capture every API call to these services, including who made the call, from which IP address, and what changes were made. The spike in IAM policy changes, access key creation, and failed console logons from a new country is directly recorded in these logs, making them the strongest evidence for a control-plane compromise.

Answer

Packet captures from user laptops only

Answer

Web server access logs from the public website

Answer

Endpoint antivirus quarantine reports only

Question 8

Network flow records show one database server sending large encrypted outbound transfers to an unfamiliar autonomous system during off-hours. Which next step gives the BEST triage value? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Correlate flow volume with database audit logs and the destination reputation. Option D is correct because correlating flow volume with database audit logs and destination reputation provides direct evidence of whether the encrypted outbound transfer is legitimate database replication or exfiltration. This approach leverages existing security controls (flow records, audit logs, threat intelligence) to validate the activity without assuming encryption implies safety or disrupting operations.

Answer

Assume encryption means the transfer is safe

Answer

Disable all outbound internet access for the organisation

Answer

Delete historical flow records to reduce SIEM cost

Question 9

A UEBA rule flags a user authenticating from London and Singapore within 12 minutes, followed by a mailbox forwarding rule creation. What should the analyst investigate first? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Sign-in logs, MFA result, device details, and mailbox audit events. Option A is correct because the UEBA rule indicates a possible account compromise (impossible travel followed by mailbox rule creation). The analyst must first verify the sign-in logs for authentication source IPs, MFA result to check if the attacker bypassed MFA, device details to identify if a known device was used, and mailbox audit events to confirm the forwarding rule. These four data sources provide the minimum evidence needed to assess the scope of compromise before containment.

Answer

The organisation's public DNS zone file

Answer

Only the user's browser cache

Answer

Only DHCP logs from the London office

Question 10

A WAF generates repeated SQL injection alerts against a login endpoint. The application team says the requests returned HTTP 200. What should the analyst do before declaring compromise? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Review application logs for query errors, authentication events, and abnormal database access. Option A is correct because the WAF alerts indicate potential SQL injection attempts, but HTTP 200 responses do not rule out successful exploitation. The analyst must review application logs for actual query errors, authentication anomalies, or unauthorized database access to confirm whether the injection succeeded. Without log correlation, the analyst cannot determine if the WAF blocked the attack or if the payload bypassed it and executed on the backend.

Answer

Disable the WAF rule because it may be noisy

Answer

Ask users to change passwords without checking logs

Answer

Treat every HTTP 200 as proof of exploitation

Question 11

A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Sigma rule. Sigma rules are the correct choice because they are designed as a generic, open-source signature format for log events, making them portable across multiple SIEM platforms (e.g., Splunk, Elastic, QRadar) without vendor lock-in. For suspicious rundll32 execution, a Sigma rule can describe the specific event log patterns (e.g., Event ID 4688 with CommandLine containing 'rundll32.exe') that can be converted into each SIEM's native query language. This portability directly meets the threat hunter's goal of creating a detection that can be reused across different environments.

Answer

CVSS vector string

Answer

YARA rule

Answer

OpenIOC package only

Question 12

An analyst has several malware samples from the same campaign and wants to detect related files based on unique strings and byte patterns. Which method is MOST appropriate? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Create and test a YARA rule against known-good and known-bad samples. YARA rules are specifically designed for malware identification and classification by matching patterns (strings, byte sequences, and regular expressions) in files or processes. Creating and testing a YARA rule against known-good and known-bad samples allows the analyst to detect related files from the same campaign with high precision and low false positives, directly addressing the need to find files sharing unique strings and byte patterns.

Answer

Use only a firewall deny rule for port 443

Answer

Create a CVE entry

Answer

Tune DHCP lease duration

Question 13

A network sensor must detect exploit traffic using packet payload signatures and generate alerts without blocking traffic. Which deployment is BEST? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Suricata or Snort in IDS mode on a monitored network tap or SPAN port. Option C is correct because Suricata or Snort configured in IDS (Intrusion Detection System) mode on a monitored network tap or SPAN port passively inspects packet payloads against signatures and generates alerts without blocking traffic. This matches the requirement to detect exploit traffic and alert, not block. IDS mode uses a copy of the traffic, so it cannot drop packets, fulfilling the 'without blocking traffic' constraint.

Answer

Host-based file integrity monitoring only

Answer

Inline IPS mode with drop rules for all signatures

Answer

A vulnerability scanner run once per quarter

Question 14

A SOC wants a SOAR playbook for suspected phishing that reduces analyst workload but avoids destructive action before confirmation. Which actions are appropriate for the first automated phase? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Enrich URLs, detonate attachments in a sandbox, and collect mailbox search counts. Option D is correct because the first automated phase of a SOAR playbook for suspected phishing should focus on enrichment and triage without taking destructive action. Enriching URLs (e.g., via VirusTotal or URL scan APIs), detonating attachments in a sandbox (e.g., using Cuckoo or FireEye), and collecting mailbox search counts (e.g., via EWS or Graph API) provide critical threat intelligence while preserving evidence and avoiding premature containment. This aligns with the containment trade-off phase, where the goal is to balance rapid response with forensic integrity.

Answer

Close all similar alerts as duplicates

Answer

Disable the reporting user's account immediately

Answer

Automatically delete all messages from the sender across all mailboxes

Question 15

A host alert shows certutil.exe downloading a file from an external URL, followed by execution from a user-writable directory. What should the analyst focus on? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Living-off-the-land binary misuse and the downloaded file's hash, origin, and child process. Option B is correct because certutil.exe is a known living-off-the-land binary (LOLBin) that attackers abuse to download payloads from external URLs, bypassing application whitelisting. The root-cause analysis must focus on the downloaded file's hash (to identify malware), its origin (the external URL), and any child processes spawned (to trace execution chain), as these directly explain the malicious activity.

Answer

Reinstall the browser used by the user

Answer

Ignore it because certutil is signed by Microsoft

Answer

Only check whether antivirus signatures are current