CS0-003 Security Operations — Timed 20 Questions

Question 1

A SIEM correlation rule for impossible travel is creating noise from VPN users. Which refinements should improve fidelity? (Choose two.)

Accepted Answer

Require a second signal such as new device, failed MFA, or mailbox rule creation. Option B is correct because requiring a second signal—such as a new device, failed MFA, or mailbox rule creation—adds an additional layer of verification that helps confirm the user's identity and intent. This reduces false positives from VPN users whose IP addresses may change rapidly, as the SIEM can now correlate the impossible travel event with other suspicious activities that indicate a genuine compromise rather than a legitimate VPN connection.

Answer

Disable all identity alerts

Answer

Treat every VPN login as malicious

Question 2

A SOC is onboarding endpoint logs into a SIEM. Which fields are most important for process-chain investigations? (Choose three.)

Accepted Answer

Parent process name and command line. Parent process name and command line are critical for process-chain investigations because they establish the lineage of an execution event. In a SIEM, these fields allow analysts to trace how a process was spawned, identifying whether it originated from a legitimate application (e.g., explorer.exe) or a suspicious parent (e.g., wscript.exe launching cmd.exe). Without this context, it is impossible to reconstruct the attack kill chain from initial execution to lateral movement or privilege escalation.

Answer

Monitor refresh rate

Question 3

A threat hunter suspects data exfiltration over HTTPS from a database server. Which data sources are most useful? (Choose two.)

Accepted Answer

Database audit logs showing queried objects and accounts. Database audit logs record which objects (tables, columns) were queried and by which accounts, directly revealing unauthorized access or unusual data retrieval patterns that could indicate exfiltration. NetFlow or proxy logs capture destination IP addresses, data volumes, and timing of HTTPS sessions, allowing the hunter to spot large or anomalous outbound transfers to suspicious hosts, even though the payload is encrypted.

Answer

Printer toner status

Answer

Building temperature logs

Question 4

A SOC wants to reduce alert fatigue without missing confirmed malicious activity. Which actions are appropriate? (Choose two.)

Accepted Answer

Suppress alerts only with documented criteria and expiry. Option A is correct because suppressing alerts based on documented criteria (e.g., known false-positive signatures, scheduled maintenance windows) with an expiry date ensures that the suppression is temporary and reviewed periodically. This reduces alert fatigue while maintaining visibility into potential threats, as expired suppressions automatically re-enable alerting. Without an expiry, a suppression could inadvertently hide malicious activity that later matches the same criteria.

Answer

Delete noisy detections permanently without review

Answer

Route every alert directly to executives

Question 5

Which signals strengthen an alert for Kerberoasting activity? (Choose two.)

Accepted Answer

Unusual volume of TGS requests for many service principals. Kerberoasting involves requesting Ticket-Granting Service (TGS) tickets for service principals (SPNs) to crack their passwords offline. An unusual volume of TGS requests for many SPNs is a strong indicator because attackers typically enumerate SPNs and request tickets in bulk, which deviates from normal user behavior.

Answer

A user changing their desktop wallpaper

Answer

Successful DHCP lease renewal

Question 6

A detection engineer is writing a Sigma rule for suspicious rundll32 usage. Which fields should be included? (Choose two.)

Accepted Answer

Command line containing unusual DLL path or URL pattern. Sigma rules for suspicious rundll32 usage focus on detecting abnormal command-line arguments, such as DLL paths from unusual locations (e.g., temp directories, network shares) or URLs that indicate remote payload retrieval. The 'Command line' field is critical because rundll32.exe is a legitimate Windows binary often abused by attackers to execute malicious DLLs, and anomalous patterns in its arguments are a strong indicator of compromise.

Answer

Desk phone extension

Answer

Laptop battery health

Question 7

A cloud workload identity begins accessing secrets outside its normal application scope. Which evidence should be reviewed? (Choose two.)

Accepted Answer

Cloud audit logs for secret-read operations. Cloud audit logs record all API calls, including secret-read operations. If a workload identity is accessing secrets outside its normal scope, the audit logs will show the specific secret-read API calls (e.g., GetSecretValue in AWS Secrets Manager or accessSecretVersion in Google Cloud Secret Manager) made by that identity. Reviewing these logs directly confirms the anomalous access pattern and identifies which secrets were retrieved, providing the primary evidence of the breach.

Answer

Legacy fax transmission logs

Answer

The colour of the application logo

Question 8

A phishing detection rule looks only for known malicious URLs and misses newly registered lookalike domains. Which improvements help? (Choose two.)

Accepted Answer

Add domain age and lookalike/typosquatting checks. Option A is correct because phishing detection rules that rely solely on static URL blacklists cannot catch newly registered lookalike domains. By incorporating domain age checks (e.g., domains registered less than 30 days ago are suspicious) and lookalike/typosquatting detection (e.g., using Levenshtein distance or homoglyph analysis), the rule can proactively identify malicious domains that have not yet been reported or blacklisted.

Answer

Allow all newly registered domains

Answer

Trust emails with company logos automatically

Question 9

An analyst suspects DNS tunnelling but wants to avoid over-escalating normal CDN behaviour. Which comparisons help? (Choose two.)

Accepted Answer

Baseline query length, entropy, and subdomain uniqueness for the host. DNS tunnelling encodes non-DNS data (e.g., file exfiltration or C2 commands) into DNS queries, often producing abnormally long, high-entropy subdomains. Comparing current query length, entropy, and subdomain uniqueness against a baseline for the same host helps distinguish tunnelling from legitimate CDN traffic, which typically uses short, predictable subdomains. This approach focuses on the structural characteristics of the queries themselves, avoiding false positives from normal CDN behaviour.

Answer

Check whether the user likes the website

Answer

Count the number of icons on the desktop

Question 10

A SOAR playbook enriches suspicious IP addresses. Which enrichment sources are useful? (Choose two.)

Accepted Answer

Threat intelligence reputation and first-seen date. Threat intelligence reputation feeds (e.g., VirusTotal, AlienVault OTX) provide a risk score and first-seen date for an IP, which helps determine if it is known for malicious activity and how recently it became active. Internal asset and previous-seen telemetry (e.g., from a SIEM or asset management database) reveals if the IP belongs to an internal host or has been observed in past incidents, enabling context-aware response. Both sources directly support enrichment by adding authoritative, actionable data to the playbook.

Answer

Random social media comments about cybersecurity

Answer

Office chair inventory

Question 11

A SOC is tuning a detection for suspected DNS tunnelling. Which evidence points are useful before escalating the alert? (Choose two.)

Accepted Answer

Volume and timing of queries to the same domain or name server. Option B is correct because DNS tunnelling often relies on a high volume of queries to a single domain or name server to exfiltrate data or establish a command-and-control channel. Anomalous query timing—such as regular, machine-like intervals—combined with an unusual query count per minute compared to baseline user behaviour is a strong indicator of automated tunnelling activity. SOC analysts should correlate volume and timing with other suspicious patterns before escalating.

Answer

The user's monitor size

Answer

The colour scheme of the SIEM dashboard

Question 12

A malware alert shows a signed binary performing suspicious actions. Which facts help decide whether it is living-off-the-land abuse? (Choose two.)

Accepted Answer

The binary is normally administrative but launched from an unusual parent process. Option A is correct because living-off-the-land (LotL) abuse often involves legitimate administrative binaries (e.g., PowerShell, certutil, wmic) being executed from an unexpected parent process, such as a Microsoft Office application or a script host. This deviation from the normal process tree (e.g., cmd.exe or explorer.exe spawning the binary) is a strong indicator of malicious intent, as attackers leverage trusted tools to evade detection.

Answer

The binary has a familiar vendor name only

Answer

The endpoint wallpaper is unchanged

Question 13

Which evidence helps distinguish a true brute-force attack from a misconfigured service account? (Choose two.)

Accepted Answer

Source distribution and timing of failed logons. Option B is correct because a true brute-force attack typically originates from multiple source IP addresses or a single source with a high frequency of failed logons over a short time window, whereas a misconfigured service account usually fails from a consistent source at regular intervals. Analyzing the source distribution and timing of failed logons helps distinguish automated attack patterns from predictable service account behavior, such as retry intervals defined in application configuration.

Answer

The number of monitors used by the administrator

Answer

The brand of the office router only

Question 14

A Kubernetes audit alert shows a service account creating privileged pods. Which checks are most relevant? (Choose two.)

Accepted Answer

Pod spec fields such as privileged mode, hostPath, and hostNetwork. Option C is correct because privileged pods can bypass container security boundaries, and hostPath or hostNetwork access can lead to host-level compromise. The audit alert specifically flags a service account creating such pods, which violates the principle of least privilege and indicates a potential security incident that requires immediate investigation of the pod spec fields.

Answer

The number of comments in application code

Answer

User profile pictures in the HR system

Question 15

An IDS signature fires on outbound traffic but analysts suspect a false positive. Which validation steps are appropriate? (Choose two.)

Accepted Answer

Check whether the destination and application protocol match the rule intent. Option B is correct because validating whether the destination and application protocol match the rule intent directly confirms if the IDS signature fired on legitimate traffic or a false positive. For example, if a signature is designed to detect SQL injection over HTTP but the outbound traffic is HTTPS or a different protocol, the alert is likely a false positive. This step aligns with standard validation procedures in security operations, where analysts verify the context of the alert against the signature's defined criteria.

Answer

Assume all signatures are always correct

Answer

Disable every IDS rule from the same vendor

Question 16

A SOC wants to measure whether alert enrichment is improving operations. Which metrics are useful? (Choose two.)

Accepted Answer

Reduction in analyst triage time for enriched alerts. Option A is correct because a primary goal of alert enrichment is to reduce the time analysts spend investigating alerts. By automatically populating context such as asset owner, criticality, and vulnerability data, enrichment eliminates manual lookup steps, directly lowering mean time to triage (MTTT). This metric quantifies operational efficiency gains from enrichment.

Answer

Amount of storage used by desktop screenshots

Answer

Number of unused browser bookmarks

Question 17

A user opens an invoice document and shortly afterward the endpoint runs wscript.exe from the user's profile. Which detection logic is most relevant?

Accepted Answer

Office document spawning a script interpreter from a user context. The correct detection logic is 'Office document spawning a script interpreter from a user context' because the scenario describes a classic phishing attack where a malicious macro or embedded script in an invoice document launches wscript.exe (a Windows Script Host interpreter) from the user's profile directory. This behavior is a strong indicator of script-based malware execution, as legitimate Office documents rarely spawn script interpreters directly from user-writable paths. The detection logic specifically targets the parent-child process relationship between an Office application (e.g., WINWORD.EXE, EXCEL.EXE) and wscript.exe, which is a common technique used by attackers to bypass application whitelisting and execute arbitrary code.

Answer

A password expiry warning

Answer

High CPU usage on the print server

Answer

Successful DHCP renewal

Question 18

A SIEM alert shows one workstation requesting a high number of Kerberos service tickets for many SPNs, followed by no corresponding service access. Which attack should be suspected?

Accepted Answer

Kerberoasting reconnaissance or ticket harvesting. A high volume of Kerberos service ticket requests for many SPNs, followed by no actual service access, is characteristic of Kerberoasting reconnaissance. In this attack, an adversary with valid domain credentials requests TGS tickets for service accounts to extract the NTLM hash embedded in the ticket, which can then be cracked offline. The lack of subsequent service access confirms the tickets were obtained solely for offline brute-force cracking, not legitimate use.

Answer

DNS cache poisoning

Answer

Pass-the-hash using NTLM only

Answer

ARP spoofing

Question 19

A user receives repeated MFA prompts and eventually approves one they did not initiate. Which behaviour should the analyst classify this as?

Accepted Answer

MFA fatigue or push-bombing attack. Repeated MFA prompts that the user eventually approves out of frustration or habit is the hallmark of MFA fatigue (also called push-bombing). The attacker sends a flood of push notifications to the user's device, hoping the user will mistakenly approve one to stop the annoyance. This bypasses the MFA control without needing to compromise the second factor.

Answer

Password spraying only

Answer

DNS tunnelling

Answer

SSL certificate expiry

Question 20

A new cloud log source is onboarded, but analytics fail because source IP, user, and action fields are mapped inconsistently. What should the engineer fix?

Accepted Answer

Log normalization and field mapping in the parser. Log normalization and field mapping in the parser ensure that source IP, user, and action fields from the new cloud log source are consistently transformed into the schema expected by the SIEM or analytics platform. Without this, the analytics engine cannot correlate or alert on the data because the fields are not recognized or are mapped to incorrect attributes, leading to failed analytics.

Answer

Disable all enrichment lookups

Answer

Increase the dashboard refresh interval

Answer

Move logs to cold storage immediately