Tools and Techniques CS0-003 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC analyst notices that the SIEM is generating thousands of low-severity alerts for failed logins from a single user account across multiple workstations. The analyst suspects a brute-force attack but is overwhelmed by the noise. Which approach would best reduce the noise while still detecting the attack?

   • ASuppress all alerts for that user account for the next 24 hours to allow the analyst to focus on other tasks.
   • BCreate a SIEM correlation rule that aggregates failed logins for the same account and triggers only when the count exceeds a threshold within a time window.
   • CWrite a Python script to parse the SIEM API and manually count failed logins, then email the analyst daily.
   • DIncrease the severity of every failed-login alert to 'high' so the analyst notices them more quickly.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A SOC analyst is reviewing a SIEM alert that was generated from a correlation rule. What is the primary purpose of correlation rules in a SIEM?

   • ATo replace the need for manual log analysis
   • BTo store logs in a normalized format
   • CTo automatically block malicious IP addresses
   • DTo identify relationships between different events that may indicate an attack
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst needs to automate the detection of a potential brute-force attack by analyzing the SIEM logs. The analyst wants to write a Python script that reads a log file, extracts failed login events, and identifies source IPs that have more than 5 failed attempts within a 10-minute window. Which Python approach is most efficient?

   • AUse the `datetime` module to parse timestamps and then sort the events by IP.
   • BRead the file and count all failed logins per IP, then flag any IP with more than 5 total failed logins.
   • CUse a dictionary to store source IPs and their timestamps, then for each new event, check if the IP has more than 5 timestamps within the last 10 minutes.
   • DUse a list to store all failed login events and then use a nested loop to compare each event with every other event.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security analyst is investigating a potential data exfiltration. The analyst has a Wireshark capture of outbound traffic and notices a large amount of data being sent to a single external IP over port 443. The traffic is encrypted, but the analyst wants to determine if the data is being sent in a covert manner. Which approach would be most effective?

   • ABlock the external IP address immediately to stop the exfiltration.
   • BAnalyze the packet sizes and timing of the TLS records to look for unusual patterns that might indicate tunneling.
   • CUse the SIEM to check if the external IP is on a threat intelligence blocklist.
   • DDecrypt the TLS traffic using the server's private key obtained from the external party.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Windows administrator needs to automate the collection of security event logs from multiple servers and forward them to a central SIEM. The administrator wants to use a PowerShell script to gather the logs. Which approach is most appropriate?

   • AUse `Get-EventLog` to retrieve all logs and manually copy them to the SIEM.
   • BUse `Get-Service` to check the status of security services and export the results.
   • CUse `Get-WinEvent` with a filter for security event IDs and export the results to a format that the SIEM can ingest.
   • DUse `Get-Process` to list running processes and export them to the SIEM.
   Reveal Solution Discussion Select an answer first