Security Operations practice questions

False positive

Why wrong: A false positive occurs when a security control or SIEM rule incorrectly flags legitimate, benign network traffic or system activity as malicious. In this scenario, because the alert triggered on actual suspicious behavior that warrants investigation, classifying it as a false positive is incorrect. Analysts must continuously tune rules to minimize these occurrences to prevent alert fatigue.

False negative

Why wrong: A false negative represents a critical security failure where malicious activity bypasses detection mechanisms entirely, resulting in no alert being generated. Because the SIEM successfully detected the event and generated an alert for the analyst to review, this scenario cannot be classified as a false negative. Security teams often perform threat hunting to uncover these undetected gaps.

True negative

Why wrong: A true negative is a state where benign, authorized activity correctly flows through the network without triggering any security alerts. Since an alert was actively generated by the SIEM in this scenario, the system did not remain silent, making the concept of a true negative completely inapplicable to this active alert investigation.

HTTP smuggling

Why wrong: HTTP request smuggling relies on manipulating HTTP/1.1 headers, such as Content-Length and Transfer-Encoding, to desynchronize the request processing between front-end proxies and back-end servers. Because this attack vector is strictly confined to HTTP/HTTPS application-layer traffic, typically on ports 80 and 443, it does not explain anomalous or repeated traffic observed on TCP port 53.

TCP handshake anomaly

Why wrong: A TCP handshake anomaly involves malformed packets, incomplete handshakes like SYN floods, or out-of-order flags during the connection establishment phase. In this scenario, the connections are successfully completing and transmitting payload data over port 53, indicating that the transport-layer handshake mechanism itself is functioning normally without protocol violations.

Beaconing

Why wrong: Beaconing is a command-and-control (C2) communication pattern characterized by highly regular, predictable, and periodic polling intervals used by malware to check in with its controller. The presence of highly irregular or sporadic traffic intervals observed in this traffic analysis contradicts the highly structured, heartbeat-like timing signature that defines classic beaconing behavior.

WMI persistence

Why wrong: This option is incorrect because Windows Management Instrumentation (WMI) persistence relies on creating event filters, consumers, and bindings to execute payloads in response to specific system triggers. While PowerShell can be used to configure these WMI objects, the specific alert details a download cradle mechanism rather than the establishment of a persistent administrative trigger.

Scheduled task creation

Why wrong: This option is incorrect because scheduled task creation involves registering a task with the Task Scheduler service, using tools like schtasks.exe or the Register-ScheduledTask cmdlet, to achieve execution at specific intervals or events. The alert in question focuses strictly on the retrieval of an external payload via a download cradle, not the configuration of a persistent execution schedule.

DLL side-loading

Why wrong: This option is incorrect because DLL side-loading is an execution technique where an adversary places a malicious DLL in the same directory as a legitimate, trusted executable that is vulnerable to DLL search order hijacking. The EDR alert describes a network-based download cradle utilizing PowerShell, which does not involve manipulating the Windows dynamic-link library search order or hijacking legitimate binary execution paths.

Schedule an immediate emergency patch

Why wrong: While patching is the ultimate remediation, scheduling an immediate emergency patch is unnecessary and introduces operational risk, such as system instability or downtime. Because an active Web Application Firewall (WAF) serves as an effective compensating control, the immediate threat is mitigated, allowing the security team to thoroughly test and schedule the patch during a standard maintenance window.

Remove the WAF to ensure the vulnerability is addressed

Why wrong: Deactivating or removing the Web Application Firewall (WAF) would strip away an active layer of defense, immediately exposing the unpatched application to exploitation. This action unnecessarily increases the organization's attack surface and risk profile. Security best practices dictate maintaining compensating controls until a permanent fix can be safely deployed and verified.

Ignore the finding because it is a false positive

Why wrong: The vulnerability scanner's finding is technically accurate and represents a real flaw in the application, meaning it is not a false positive. Simply ignoring the report is a dangerous practice, as compensating controls like WAFs can be bypassed, misconfigured, or temporarily disabled. The vulnerability must still be tracked and eventually remediated, rather than dismissed entirely.

Disable the rule permanently

Why wrong: Permanently disabling the rule creates a critical blind spot in the organization's security posture by completely removing the capability to detect genuine attacks that leverage the same techniques. Instead of resolving the noise through proper rule tuning, this action leaves the network vulnerable to malicious actors exploiting the unmonitored vector.

Report the scanner as compromised

Why wrong: Reporting the scanner as compromised is an inappropriate response because the high volume of alerts is a predictable result of routine, authorized vulnerability scanning rather than malicious exploitation. Initiating an incident response workflow for a known, benign administrative tool wastes valuable analyst resources and misidentifies legitimate operational traffic as an active threat.

Increase the severity of the rule

Why wrong: Elevating the severity level of the rule does nothing to filter out the benign traffic generated by the scanner; instead, it exacerbates alert fatigue by flooding the SIEM console with high-priority false positives. This misconfiguration can distract security analysts from investigating actual critical incidents that require immediate triage and remediation.

Domain generation algorithm (DGA)

Why wrong: Domain generation algorithms (DGAs) are utilized by malware to dynamically generate a high volume of pseudo-random domain names for command-and-control (C2) communications. NetFlow data of a DGA would typically show numerous failed DNS queries or short-lived connections to diverse domains, rather than a sustained, high-volume data transfer to a single external IP address.

Lateral movement

Why wrong: Lateral movement describes an attacker's progression through an internal network to compromise additional hosts and locate high-value assets. This activity is characterized by east-west traffic patterns between internal subnets, such as RDP, SSH, or SMB connections, whereas a massive outbound transfer to an external destination represents north-south egress traffic.

Normal backup activity

Why wrong: While normal backup operations do involve transferring large volumes of data, they are highly structured, scheduled events that target known, authorized offsite or cloud-based backup repositories. An unexpected, unscheduled spike in outbound traffic to an unverified or anomalous external IP address deviates from this established baseline, pointing to malicious activity rather than routine maintenance.

WMI persistence

Why wrong: WMI persistence involves event subscriptions, not process injection.

Process hollowing

Why wrong: Incorrect. Process hollowing creates a new process in a suspended state, unmaps its legitimate code, and replaces it with malicious code. The scenario describes injection into an already-running process, not hollowing.

DLL side-loading

Why wrong: DLL side-loading exploits legitimate executables to load malicious DLLs; not shown.

Non-credentialed scans during business hours

Why wrong: Non-credentialed scans only see the system as an unauthenticated outsider would, missing local misconfigurations and missing patches visible only via authenticated checks, and running them during business hours adds network load and probe traffic right when critical systems are under peak production use.

External scans only

Why wrong: Limiting scanning to external-facing only entirely skips internal infrastructure, which is precisely the scope management asked to be assessed, leaving internal systems' vulnerabilities completely unvalidated and unreported.

Continuous non-credentialed scans

Why wrong: Running scans continuously without credentials combines the worst of both concerns: constant network probing sustains ongoing load on critical systems around the clock, while the lack of authentication still produces an incomplete, less accurate picture of actual vulnerabilities present.

T1078 (Valid Accounts)

Why wrong: While adversaries frequently abuse legitimate credentials (T1078) to gain initial access or escalate privileges within an environment, this technique does not describe the execution of commands or scripts to download external payloads. A threat hunter looking specifically at a PowerShell-based download mechanism would focus on execution techniques rather than identity-based access vectors.

T1053.005 (Scheduled Task)

Why wrong: Scheduled Tasks (T1053.005) are primarily utilized by threat actors to establish persistence or execute code at specific times or system events. Although a scheduled task can be configured to run a malicious script, the task itself is a scheduling mechanism rather than the specific execution environment or utility used to retrieve files from the internet.

T1047 (WMI)

Why wrong: Windows Management Instrumentation (T1047) is a powerful administrative framework used for system management, querying device information, and executing remote processes. While WMI can trigger execution on remote hosts, it is not the primary mechanism used to initiate web requests or download payloads directly from external command-and-control servers.

Normal behavior for an administrator

Why wrong: While administrators often perform remote management tasks across multiple systems, authenticating to geographically separated systems within a one-minute window is highly anomalous. This pattern indicates lateral movement rather than standard administrative workflows, as physical or logical transit times make such rapid, disparate logins impossible under normal operations.

A user with superhuman speed

Why wrong: Although 'superhuman speed' or 'impossible travel' is an informal term used by some identity protection systems to flag anomalous geographic logins, it is not a technically precise security diagnosis. In a professional analysis, this symptom must be attributed to the underlying attack mechanism, such as credential theft or session hijacking.

A false positive due to time synchronization issues

Why wrong: Although Network Time Protocol (NTP) synchronization failures can cause log timestamps to appear skewed or out of order, they do not account for the specific sequence of successful authentications originating from a single source IP to distinct targets. A true time sync issue would manifest as systemic, broad-spectrum logging discrepancies rather than isolated, targeted lateral authentication events.

Multiple successful connections to a single external IP

Why wrong: Repeated successful connections to one fixed external IP describe static beaconing to a hardcoded C2 address, which is essentially the opposite pattern of DGA malware, whose entire purpose is to avoid a single static indicator by algorithmically rotating through many domains.

Large data transfers over HTTPS

Why wrong: Large HTTPS data transfers are the hallmark of a data exfiltration stage, reflecting volume of outbound traffic rather than the domain resolution pattern that defines DGA; a correlation rule for DGA needs DNS query characteristics, not payload size metrics.

Unusual parent-child process relationships

Why wrong: Unusual parent-child process relationships, such as a Word process spawning PowerShell, are endpoint-based indicators of execution or living-off-the-land techniques observed via EDR telemetry, which is unrelated to the DNS-layer resolution behavior a DGA detection rule must analyze.

Frequent DNS queries

Why wrong: No DNS anomalies observed.

HTTP POST requests

Why wrong: Traffic is on port 22, not HTTP.

ICMP echo requests

Why wrong: No ICMP tunneling observed.

explorer.exe spawning cmd.exe

Why wrong: Normal user activity.

rundll32.exe spawning powershell.exe

Why wrong: This could be lateral movement but is less direct; rundll32 is often used for code execution, but it's not a primary lateral movement technique.

Ignore the false positives and continue

Why wrong: Ignoring does not solve the issue.

Expand the rule to include all risky IPs

Why wrong: This would increase false positives.

Disable the rule

Why wrong: Disabling removes detection entirely.

True positive

Why wrong: A true positive occurs when a security control correctly identifies and alerts on actual malicious behavior or an active policy violation. Because the analyst determined that the login was legitimate and authorized, no actual threat existed, meaning this classification is incorrect.

True negative

Why wrong: In a true negative scenario, benign activity occurs and the SIEM correctly ignores it without generating any alerts. Since an alert was actively generated by the system in this case, the event cannot be classified as a true negative.

False negative

Why wrong: A false negative represents a critical security failure where malicious activity bypasses detection mechanisms entirely without triggering an alert. This does not apply here because an alert was successfully generated, and the underlying event was benign rather than malicious.

Lateral movement using SMB

Why wrong: Server Message Block (SMB) is a network file-sharing protocol that operates over TCP port 445, or NetBIOS ports 137, 138, and 139, to facilitate lateral movement and resource sharing within a local network. Because SMB does not utilize UDP or TCP port 53, which is reserved exclusively for DNS traffic, this protocol is unrelated to the observed port 53 anomaly.

Port scan activity from an internal host

Why wrong: A port scan involves systematically sending reconnaissance packets to a wide range of target ports on one or more destination hosts to identify open services. This activity produces a highly distributed traffic pattern across multiple destination ports, which contrasts sharply with a high volume of persistent, structured traffic directed specifically and solely to port 53.

Beaconing to a command-and-control server

Why wrong: Command-and-control (C2) beaconing typically relies on standard web protocols like HTTP or HTTPS over ports 80 and 443 to blend in with legitimate outbound web browsing traffic. While some advanced C2 frameworks can use DNS for beaconing, standard beaconing behavior is characterized by highly regular, periodic check-in intervals rather than the continuous, high-throughput data streams typical of active data exfiltration.

The user double-clicked a PowerShell script attached to the email

Why wrong: If the user had directly double-clicked a PowerShell script attachment from their email client, the process tree would show powershell.exe spawning with the mail client, such as outlook.exe, or explorer.exe as its parent process; the observed parent process is winword.exe, meaning the PowerShell execution was triggered from inside Word after the document was already opened, not from clicking a separate attached file.

A scheduled task started PowerShell that initiated Word

Why wrong: A scheduled task that starts PowerShell, which then launches Word, would produce a process tree with taskeng.exe or svchost.exe as the parent of powershell.exe and winword.exe as a child or sibling process at most, which is the reverse of the relationship reported; the alert clearly shows winword.exe as the parent of powershell.exe, ruling out this ordering entirely.

The user is running a legitimate PowerShell script from within a Word document

Why wrong: While enterprise environments occasionally use legitimate document automation that shells out to PowerShell, this is uncommon, typically restricted to signed and centrally deployed macros, and highly unusual for a document delivered via an external email; given the context of a user opening an unsolicited emailed attachment, the far more probable explanation in a security triage is malicious rather than authorized automation.

Reclassify the vulnerability as low severity

Why wrong: Severity ratings are determined by standardized frameworks like the Common Vulnerability Scoring System (CVSS) based on the intrinsic characteristics of the flaw itself. While compensating controls reduce the overall operational risk, they do not alter the underlying code defect or lower its official severity score. Reclassifying the severity arbitrarily violates vulnerability management standards and masks the true nature of the threat.

Immediately patch the vulnerability

Why wrong: Although applying a patch is the ultimate remediation goal, doing so immediately without testing can cause critical system downtime or compatibility issues. In enterprise environments, change management processes require thorough regression testing before deployment. Given that compensating controls like DMZ isolation are already mitigating the immediate threat, an emergency, untested patch is not the most appropriate immediate action.

Ignore the finding as a false positive

Why wrong: A false positive occurs when a scanner incorrectly identifies a non-existent vulnerability or misinterprets a benign configuration. In this scenario, the vulnerability is genuine and confirmed by the scanner's signature match, meaning it cannot be disregarded. Ignoring a validated critical vulnerability simply because it resides behind a compensating control introduces severe blind spots into the organization's security posture.

Snort rule

Why wrong: Snort is an open-source network intrusion detection and prevention system (IDS/IPS). Its rules analyze packet payloads and network protocol headers in transit, making them incapable of parsing local endpoint event logs or monitoring process execution events like regsvr32.exe spawning on a host.

YARA rule

Why wrong: YARA is a tool primarily designed for malware classification and file-based pattern matching on disk or in memory. While highly effective for identifying static indicators within binaries or active process memory dumps, it is not designed to parse structured event logs to detect live process creation arguments.

Suricata rule

Why wrong: Suricata is a high-performance network threat detection engine that inspects live network traffic, PCAP files, and protocol transactions. Because it operates entirely at the network layer, it cannot inspect local endpoint operating system logs to identify specific command-line arguments used during a process execution.

Reflective DLL injection

Why wrong: Reflective DLL injection bypasses standard Windows API loading mechanisms by mapping a DLL directly into a target process's memory space and executing its entry point. While this technique avoids writing the DLL to disk, the injected payload still retains its PE (Portable Executable) structure and header characteristics. It does not involve unmapping a legitimate process's entire executable memory space to replace it with a completely different, unbacked payload.

API hooking

Why wrong: API hooking modifies the control flow of specific function calls within a process, typically by inserting jumps (trampolines) or modifying import address tables to redirect execution to malicious monitoring code. This technique is used to intercept and alter data in transit rather than replacing the entire memory image of a running process. Consequently, it does not result in a completely unbacked executable memory region replacing a legitimate process image.

DLL injection

Why wrong: Standard DLL injection forces a target process to load a malicious library, typically by using the CreateRemoteThread API to call LoadLibrary with a path to a DLL on disk. This technique leaves a distinct footprint because the injected DLL is registered as a loaded module within the process's Process Environment Block (PEB) and is backed by a physical file on the filesystem. It does not replace the primary executable image of the host process with unbacked memory.