CS0-003 Security Operations Practice Test 7 — 15 Questions

Question 1

An endpoint is actively beaconing to a known malicious IP and spawning credential-dumping tools. The business owner wants evidence preserved. What is the BEST containment action? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Network-isolate the endpoint through EDR while preserving disk and memory evidence. Network-isolating the endpoint via EDR preserves volatile memory and disk evidence while stopping the active beaconing and credential dumping. This allows forensic acquisition without the risk of the attacker wiping data or triggering anti-forensic mechanisms, which powering off (Option A) would cause by losing memory evidence. The isolation action provides the clearest next triage step because the analyst can then safely collect a memory dump and disk image for analysis.

Answer

Power off the machine immediately in every case

Answer

Run disk cleanup to remove temporary files

Answer

Allow the host to run until the next maintenance window

Question 2

During incident reconstruction, firewall events appear five minutes earlier than endpoint events for the same connection. What should the analyst check first? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Time synchronization and timezone normalization across log sources. A five-minute discrepancy between firewall and endpoint logs for the same connection strongly indicates a time synchronization issue. The analyst should first verify NTP configuration and timezone normalization across all log sources to ensure a consistent timeline. Without synchronized clocks, event ordering and correlation are unreliable, which can lead to incorrect conclusions during incident reconstruction.

Answer

Delete one source from the timeline

Answer

Prioritize only the source with the highest EPS

Answer

Assume the firewall logs are falsified

Question 3

A vendor shares indicators marked TLP:AMBER+STRICT. How should the SOC handle them? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

Use them internally with only people who need to know and avoid wider redistribution. Option A is correct because TLP:AMBER+STRICT restricts sharing to individuals within the organization who have a specific need to know, and explicitly prohibits redistribution beyond that group. In detection engineering, using these indicators to create tuned detection rules (e.g., SIEM correlation logic) reduces false positives by focusing on verified threat data while preserving the signal by not over-broadening the rule scope.

Answer

Send the indicators to all customers

Answer

Publish the indicators on a public GitHub repository

Answer

Ignore the indicators because TLP markings are optional

Question 4

A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the containment trade-off phase, Which response balances containment with evidence preservation?

Accepted Answer

Credential access or lateral movement activity that warrants high-priority investigation. The presence of a deception credential in a file share that is used to authenticate to a server, with no legitimate user knowing it, strongly indicates that an attacker has discovered and used the credential to gain unauthorized access. This is a classic sign of credential access (stealing credentials) followed by lateral movement (using them to authenticate to another system). Such activity is a high-priority incident because it suggests the attacker has moved beyond initial compromise and is actively expanding their foothold, which requires immediate containment and investigation.

Answer

A scheduled password rotation completed successfully

Answer

The file share requires more storage capacity

Answer

The SIEM parser is always broken

Question 5

A container workload unexpectedly starts a shell, mounts the host filesystem, and attempts outbound connections to an unknown IP. Which telemetry is MOST useful? In the root-cause analysis phase, Which finding would most directly explain the activity?

Accepted Answer

Container runtime events, Kubernetes audit logs, and network flow from the pod. Container runtime events (e.g., `docker events` or CRI-O logs) capture the unexpected shell execution and host filesystem mount. Kubernetes audit logs record the API calls that initiated the pod, revealing the attacker's initial access vector. Network flow logs from the pod (e.g., via Calico or Cilium) show the outbound connections to the unknown IP, linking the lateral movement to the compromised container. Together, these three telemetry sources provide the complete chain of events needed for root-cause analysis.

Answer

Only user password age reports

Answer

Only physical datacenter access logs

Answer

Only monthly vulnerability scan summaries

Question 6

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant? In the alert triage phase, Which action gives the analyst the clearest next triage step?

Accepted Answer

Office document spawning a script interpreter from a user context. Option D is correct because the scenario describes a classic technique where a malicious macro or script embedded in an Office document executes wscript.exe (Windows Script Host) from the user's profile. This detection logic directly identifies the suspicious parent-child process relationship of an Office application spawning a script interpreter, which is a strong indicator of a script-based attack, such as a macro virus or initial access payload.

Answer

Successful DHCP renewal

Answer

A password expiry warning

Answer

High CPU usage on the print server

Question 7

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected? In the evidence source phase, Which evidence source best supports or refutes the detection?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. The alert describes a workstation requesting a high number of Kerberos service tickets (TGS-REQ) for many different Service Principal Names (SPNs) without subsequently accessing those services. This pattern is classic for Kerberoasting reconnaissance, where an attacker with valid domain credentials (e.g., a compromised user account) enumerates SPNs to request TGS tickets for accounts that have servicePrincipalName attributes set. The attacker then extracts the encrypted ticket data offline to crack the associated service account passwords. The lack of corresponding service access confirms the tickets were harvested, not used for legitimate authentication.

Answer

ARP spoofing

Answer

DNS cache poisoning

Answer

Pass-the-hash using NTLM only

Question 8

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?

Accepted Answer

MFA fatigue or push-bombing attack. The scenario describes MFA fatigue (also called push-bombing), where an attacker repeatedly sends MFA push notifications to a user until the user, annoyed or confused, approves one. This is a social engineering technique that exploits human behavior, not a technical vulnerability. Option C correctly identifies this attack pattern, which is a known tactic in credential-stuffing and account-takeover campaigns.

Answer

DNS tunnelling

Answer

SSL certificate expiry

Answer

Password spraying only

Question 9

A SIEM receives endpoint, firewall, identity, and cloud logs for the same incident, but timestamps do not align across sources. Which actions should the analyst take before finalizing the timeline? (Choose two.)

Accepted Answer

Verify time synchronization and timezone parsing for each source. Option B is correct because without verifying time synchronization (e.g., NTP configuration) and timezone parsing for each log source, the analyst cannot trust the chronological order of events. A SIEM relies on accurate timestamps to correlate logs from endpoints, firewalls, identity systems, and cloud platforms; misaligned timestamps can lead to incorrect incident reconstruction.

Answer

Assume the latest arriving event happened last

Answer

Discard every source except the firewall

Question 10

A security analyst is reviewing alerts from multiple security tools. Which three of the following are key indicators of a potential credential-based attack in the environment? (Choose three.)

Accepted Answer

Multiple failed logon attempts followed by a single successful logon from the same source IP address.. Multiple failed logon attempts followed by a single successful logon from the same source IP address is a classic indicator of a password spraying or brute-force attack. The attacker tries many usernames or passwords, and when one succeeds, the pattern shifts from failures to a success. This sequence is a key sign of credential compromise.

Answer

A spike in outbound DNS traffic from a workstation during business hours.

Answer

An increase in the number of TCP SYN packets sent to a single external IP address.

Answer

A system event log showing a successful logon after a scheduled patch reboot.

Question 11

An incident response team is analyzing a suspected malware outbreak on a corporate network. Which three of the following actions should be performed as part of the containment phase? (Choose three.)

Accepted Answer

Isolating affected systems from the network by disabling their network interfaces.. Isolating affected systems from the network by disabling their network interfaces is a core containment action because it immediately stops the malware from communicating with command-and-control (C2) servers or spreading to other hosts. Blocking outbound communication from infected hosts at the firewall prevents data exfiltration and further C2 activity without requiring physical access to each machine. Implementing network segmentation (e.g., VLANs or ACLs) restricts lateral movement by limiting the infected system's ability to reach other subnets, which is critical in containing a worm or ransomware outbreak.

Answer

Creating a forensic image of the infected systems for later analysis.

Answer

Identifying and patching the vulnerability exploited by the malware.

Answer

Notifying law enforcement agencies about the incident.

Question 12

A Security Operations Center (SOC) analyst is tuning a SIEM rule to reduce false positives. Which three of the following are valid approaches to improve the signal-to-noise ratio of a detection rule? (Choose three.)

Accepted Answer

Adding a whitelist for known benign source IP addresses or user accounts.. Adding a whitelist for known benign source IP addresses or user accounts is a valid approach because it directly reduces false positives by excluding traffic that is known to be safe from triggering the rule. This improves the signal-to-noise ratio by ensuring that only truly suspicious activity generates alerts, without altering the detection logic itself.

Answer

Increasing the severity level of the alert to ensure faster response.

Answer

Removing the rule entirely to eliminate all associated noise.

Answer

Adding additional event sources to broaden the scope of detection.

Question 13

During a threat hunting exercise, a security analyst discovers unusual outbound traffic from a server that typically only communicates internally. Which three of the following are effective actions to validate and respond to this finding? (Choose three.)

Accepted Answer

Check the server’s process list and running services for unknown or suspicious processes.. Checking the server’s process list and running services (Option 1) is effective because it directly identifies any unauthorized or malicious processes that may be generating the unusual outbound traffic. Reviewing recent DNS logs (Option 3) helps correlate the outbound traffic with domain queries, revealing potential command-and-control (C2) destinations. Comparing outbound traffic against threat intelligence feeds (Option 5) validates whether the destination IPs or domains are known malicious indicators, providing context for the anomaly.

Answer

Immediately block all outbound traffic from the server at the network perimeter.

Answer

Perform a vulnerability scan on the server to identify missing patches.

Answer

Disable the server’s network interface and reimage it immediately.

Question 14

A security analyst is reviewing the output of a recent vulnerability scan and correlating it with threat intelligence feeds. Which four of the following actions are most appropriate for an effective security operations workflow? (Choose four.)

Accepted Answer

Correlate detected vulnerabilities with active exploitation in the wild.. Correlating detected vulnerabilities with active exploitation in the wild is correct because it allows the analyst to prioritize vulnerabilities that are currently being used by threat actors, moving beyond theoretical risk to real-world urgency. This aligns with threat-informed defense, where vulnerability management is driven by actual attack patterns rather than static severity scores.

Answer

Prioritize remediation based on the CVSS score alone.

Answer

Apply patches to all identified vulnerabilities immediately without testing.

Question 15

Arrange the steps for conducting a security incident response in the correct order.