CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A process with a memory region that is both writable and executable (RWX)

  Why this is correct

  Memory injection techniques, such as process hollowing or DLL injection, require allocating memory with write permissions to copy payload code, and then execute permissions to run it. Legitimate software rarely allocates memory regions with concurrent Read-Write-Execute (RWX) permissions due to security mitigations like Data Execution Prevention (DEP) or W^X (Write XOR Execute). Finding an RWX memory region strongly indicates that shellcode has been injected and is prepared for execution.

• ✗

  A process that is running from a temp directory

  Why it's wrong here

  While executing binaries from temporary directories (like %TEMP% or /tmp) is a common indicator of compromise (IoC) associated with initial access or dropper execution, it does not directly indicate memory injection. Legitimate installers and self-extracting archives frequently run from these directories. Memory injection specifically involves manipulating the virtual memory space of a running process, regardless of the initial binary's disk location.

• ✗

  A process that has an unusually high handle count

  Why it's wrong here

  An elevated handle count typically points to a resource leak within an application, where system resources like files, registry keys, or threads are opened but not properly closed. While an attacker might open handles to target processes during an injection attempt, a high handle count on its own is a generic performance anomaly rather than a definitive indicator of memory injection.

• ✗

  A process with multiple threads in a suspended state

  Why it's wrong here

  Although some injection techniques, such as process hollowing, temporarily suspend a target process's primary thread to replace its code, suspended threads are common in normal operating system behavior. Legitimate applications frequently suspend threads during debugging, synchronization, or resource management. Therefore, the mere presence of suspended threads is too non-specific to serve as a reliable indicator of an active memory injection attack.

Go deeper

Related to this question