CompTIA CS0-003 CySA+ Exam Dumps and Practice Test Questions Set 4 Q46-60

Visit here for our full CompTIA CS0-003 exam dumps and practice test questions.

Question 46

A SOC analyst notices that several endpoints are connecting to a cloud storage service using accounts that have never been used before. File uploads are occurring at random intervals, and the file types include sensitive documents. The activity is not aligned with business operations. What is the most likely scenario, and what should the immediate response be?

A) Routine employee cloud storage usage; allow traffic.
B) Unauthorized data exfiltration using compromised credentials; disable accounts, capture network traffic, and isolate endpoints.
C) Scheduled automated backups; verify configuration.
D) Users testing new cloud applications; notify users.

Answer: B)

Explanation:

Option A assumes routine employee cloud storage usage. Legitimate usage is typically predictable, occurs under known accounts, and aligns with business hours or operational needs. The observed behavior—use of accounts that have never been active, file uploads including sensitive data, and random intervals—does not match normal activity. Allowing this traffic could enable unauthorized data exfiltration, leading to potential compliance violations or sensitive data exposure.

Option B is correct. Compromised accounts are often leveraged by attackers to exfiltrate sensitive information using cloud storage services. Indicators include first-time account activity, off-hours or random interval uploads, and sensitive document types. The immediate response should include disabling affected accounts to prevent further exfiltration, capturing network traffic for analysis to identify what data has been uploaded, and isolating affected endpoints to prevent lateral movement. Endpoint forensics can identify malware, scripts, or browser-based extensions facilitating the exfiltration. Analysts should also correlate this activity with SIEM alerts and threat intelligence to identify patterns, source IPs, or malicious infrastructure. After containment, remediation includes restoring account credentials, applying multi-factor authentication, reviewing cloud access policies, and monitoring other endpoints for similar suspicious behavior. This process ensures that data is protected, attackers are prevented from maintaining access, and forensic evidence is preserved for analysis and compliance purposes.

Option C suggests scheduled automated backups. Backup jobs are typically documented, use known accounts, and follow a predictable schedule. Uploading random sensitive documents using new accounts deviates from standard backup behavior and is not a plausible explanation.

Option D assumes users are testing new cloud applications. Such activity is usually authorized, documented, and involves known accounts. The pattern described in this scenario—first-time accounts, sensitive data uploads, and random timing—indicates a threat rather than user experimentation.

The rationale for selecting option B lies in the behavioral indicators of unauthorized data exfiltration: new accounts, off-hours activity, sensitive files, and cloud services usage outside normal operations. Early containment, evidence capture, and endpoint isolation prevent further data loss while allowing analysis to determine the method of compromise and scope. Implementing multi-factor authentication, account monitoring, and enhanced logging can prevent similar future attacks. This comprehensive response minimizes operational disruption while safeguarding sensitive information.

Question 47

A network administrator notices repeated ARP requests from several endpoints to a device that is not registered in the network inventory. The traffic occurs in bursts and is interspersed with scans of other local subnets. What is the most likely threat, and what should the immediate action be?

A) Routine network discovery by IT; allow traffic.
B) Internal reconnaissance activity by malware; isolate endpoints, capture network traffic, and identify unauthorized devices.
C) Misconfigured network device; correct configuration.
D) Normal broadcast traffic; ignore.

Answer: B)

Explanation:

Option A assumes routine network discovery by IT. IT-initiated scans are typically planned, documented, and originate from authorized devices or management servers. Unregistered endpoints conducting repeated ARP requests and subnet scans do not follow expected behavior and should be treated as suspicious. Ignoring this activity could allow attackers to map internal network infrastructure for later attacks.

Option B is correct. Repeated ARP requests and scanning of other subnets are classic indicators of internal reconnaissance, often performed by malware or an attacker who has gained initial foothold within the network. The unregistered device could be a rogue host or compromised endpoint being used to gather information about network topology, active devices, and potential attack vectors. Immediate action includes isolating the scanning endpoints to prevent further reconnaissance and potential lateral movement. Capturing network traffic allows analysts to identify all devices targeted, determine attack patterns, and reconstruct the reconnaissance activity. Identifying the unregistered device involves physical inspection, endpoint monitoring, and correlating logs with DHCP and network inventory systems. Analysts should also check for indicators of compromise on affected endpoints, including abnormal processes, newly installed services, or unauthorized credentials. Remediation involves removing rogue devices, cleaning infected endpoints, updating firewall and monitoring rules, and improving network segmentation to limit lateral movement. Threat intelligence may provide context if similar scanning patterns are associated with known malware campaigns.

Option C suggests misconfigured devices. While misconfigurations can generate unusual network traffic, repeated scanning behavior, bursts of ARP requests, and scanning of multiple subnets indicate deliberate activity rather than accidental misconfiguration. Assuming misconfiguration risks missing active reconnaissance.

Option D implies normal broadcast traffic. Standard broadcast traffic is predictable, low-volume, and directed to known endpoints or subnets. The scenario describes a targeted scanning activity inconsistent with normal broadcast behavior.

Selecting option B prioritizes early detection, containment, and forensic investigation. It prevents attackers from gaining intelligence on the internal network, preserves evidence for further analysis, and supports remediation to prevent recurrence. Analysts can also improve detection of similar reconnaissance techniques in the future through updated monitoring and alerting policies.

Question 48

A SOC analyst observes a Windows endpoint creating multiple scheduled tasks that execute scripts downloading files from external IPs. The scripts run under system privileges, obfuscate code, and attempt to disable security software. What is the most likely scenario, and what is the recommended response?

A) Routine administrative automation; allow execution.
B) Malware establishing persistence and evading detection; isolate the endpoint, capture memory, and analyze scripts.
C) Misconfigured automation scripts; update scripts.
D) User testing new software; notify users.

Answer: B)

Explanation:

Option A suggests legitimate administrative automation. Routine administrative scripts typically run under authorized accounts, are signed, and follow predictable schedules. Running multiple scripts from scheduled tasks, downloading external files, and attempting to disable security software indicate malicious activity, not normal administration. Ignoring this behavior could allow malware to persist, spread, or exfiltrate data.

Option B is correct. The described activity—scheduled tasks, external downloads, obfuscation, and disabling security services—is consistent with malware attempting to establish persistence while evading detection. Immediate response involves isolating the endpoint to prevent lateral movement and further compromise. Memory forensics allows investigators to capture active processes, scripts, and injected code. Script analysis helps identify the attack vector, command-and-control infrastructure, and payload behavior. Correlating network traffic and SIEM alerts can reveal whether other endpoints are affected. Remediation includes cleaning the endpoint, restoring security services, updating detection rules, and enhancing monitoring for similar activity across the network. Threat intelligence may help identify malware families and TTPs, guiding broader containment and defense strategies.

Option C proposes misconfigured automation scripts. While misconfigurations can generate unexpected activity, they do not typically involve external downloads, code obfuscation, and attempts to disable security software. Treating this as a misconfiguration risks persistent malware.

Option D assumes user testing. Legitimate testing is usually documented, performed under user accounts, and does not disable security mechanisms or run hidden scripts from scheduled tasks. Assuming benign testing could allow compromise to continue unnoticed.

Selecting option B ensures containment, forensic capture, and remediation, preventing malware persistence while preserving evidence for analysis. Early detection of scheduled task abuse is critical for preventing further compromise and understanding attacker methods.

Question 49

A SOC analyst notices that a Linux server is repeatedly attempting connections to multiple unusual ports on external IP addresses. The server has no business purpose for these connections, and system logs show repeated failed authentication attempts. What is the most likely threat, and what should be done first?

A) Routine software updates; allow.
B) Compromised server performing scanning or lateral attacks; isolate the server, capture network traffic, and perform system forensics.
C) Misconfigured firewall rules; update configuration.
D) Temporary network instability; monitor.

Answer: B)

Explanation:

Option A assumes routine software updates. Updates usually connect to known vendor servers using standard ports, not multiple unusual external ports. Allowing this traffic without verification could result in continued unauthorized activity.

Option B is correct. Multiple connections to unusual external ports, coupled with failed authentication attempts, indicate potential compromise, with the server either scanning for vulnerabilities or participating in lateral attacks. Immediate response includes isolating the server to prevent further external or internal compromise. Capturing network traffic allows analysts to identify target IPs, scanning patterns, and potentially exfiltrated data. System forensics can reveal malware or scripts executing these scans and any persistence mechanisms. Review of logs and endpoint telemetry helps determine whether the activity is limited to this server or indicative of broader compromise. Remediation includes cleaning the server, updating security policies, patching vulnerabilities, and improving monitoring to detect similar behavior on other systems.

Option C suggests misconfigured firewall rules. While misconfigurations can block or allow unintended traffic, they do not cause repeated failed authentication attempts or coordinated connections to multiple external ports. Treating this as a firewall issue would overlook malicious activity.

Option D proposes temporary network instability. Network instability does not generate targeted connections or authentication failures. Ignoring the behavior risks allows an active compromise to persist.

Selecting option B prioritizes early containment, evidence capture, and system remediation. Understanding the source and purpose of the connections ensures accurate threat assessment and prevents further compromise.

Question 50

A SOC analyst identifies endpoints sending repeated HTTP POST requests with encrypted data to newly registered domains during off-hours. The traffic volume is low but persistent. Antivirus has not detected any malware. What is the most likely scenario, and what should the SOC do first?

A) Normal application telemetry; allow traffic.
B) Covert data exfiltration via HTTP; capture traffic, isolate endpoints, and analyze payloads.
C) Antivirus updates; verify vendor.
D) Internal testing of web applications; notify users.

Answer: B)

Explanation:

Option A assumes normal telemetry. Typical telemetry is predictable, sent to known domains, and aligned with operational schedules. Low-volume, encrypted, off-hours traffic to newly registered domains deviates from this pattern. Ignoring the traffic risks of undetected data exfiltration.

Option B is correct. Encrypted, repeated POST requests to unknown domains are indicative of covert exfiltration. Low volume and persistence suggest attackers are attempting to avoid detection thresholds. Immediate action includes capturing network traffic to determine the nature of data, isolating affected endpoints to prevent further exfiltration, and analyzing payloads for sensitive content. Endpoint analysis helps identify processes or scripts responsible for the activity. Threat intelligence can contextualize the domains. Remediation includes cleaning infected hosts, updating detection rules, and monitoring for similar activity. Evidence preservation ensures forensic analysis and supports incident reporting.

Option C assumes antivirus updates. Updates are sent to trusted vendor domains and generally not obfuscated in this manner. The observed traffic is inconsistent with legitimate updates.

Option D suggests user testing. Internal testing is typically limited, documented, and uses authorized accounts. Random off-hour encrypted POST requests point to malicious activity, not testing.

Selecting option B ensures containment, forensic investigation, and remediation while preventing sensitive data loss. Early action minimizes risk and supports future threat detection improvements.

Question 51

A SOC analyst observes multiple endpoints establishing outbound SSH connections to unknown external IP addresses over non-standard ports. The connections are low-volume but persistent, and system logs show unusual process execution. What is the most likely threat, and what should the immediate action be?

A) Routine administrative SSH access; allow connections.
B) Malicious SSH tunnels used for data exfiltration or command-and-control; isolate endpoints, capture traffic, and analyze processes.
C) Misconfigured automation scripts; correct configuration.
D) Endpoint monitoring software communicating externally; verify with vendor.

Answer: B)

Explanation:

Option A assumes routine SSH access. Standard administrative SSH connections use known ports and IPs, originate from authorized accounts, and occur during expected maintenance windows. Low-volume persistent connections to unknown IPs over non-standard ports deviate from normal administrative patterns and indicate potential malicious activity. Ignoring this could allow attackers to maintain covert communication channels for extended periods.

Option B is correct. The behavior described is indicative of malicious SSH tunnels, often established for command-and-control or data exfiltration purposes. Persistent low-volume traffic over non-standard ports is a common evasion tactic to avoid detection. Immediate action includes isolating the affected endpoints to prevent lateral movement and further data exfiltration. Network traffic should be captured for analysis, focusing on the identification of external hosts, transmitted data, and potential indicators of compromise. Endpoint forensics, including process and memory analysis, helps uncover the malware or scripts responsible for initiating the connections. Cross-referencing external IP addresses with threat intelligence sources provides context and aids in identifying the attacker’s infrastructure. Following containment and analysis, remediation involves terminating unauthorized connections, cleaning infected endpoints, updating security monitoring rules, and strengthening endpoint controls to prevent recurrence. This structured response ensures evidence preservation, minimizes operational disruption, and reduces the risk of sensitive data compromise.

Option C suggests misconfigured automation scripts. While scripts can generate unusual network activity, they rarely establish persistent encrypted connections to unknown external IPs over non-standard ports. Treating this as a misconfiguration risks ignoring an active compromise.

Option D assumes monitoring software communication. Legitimate endpoint monitoring typically occurs over known domains, standard ports, and predictable intervals. The irregular, low-volume persistent connections to unknown IPs indicate malicious activity rather than legitimate monitoring.

Choosing option B allows the SOC to respond proactively to potential covert channels, contain compromised systems, and preserve forensic evidence for analysis and future prevention.

Question 52

A SOC analyst discovers multiple Linux endpoints generating DNS queries with extremely long subdomains. Some responses contain encoded payloads, and the queries occur primarily outside business hours. What is the most likely threat, and what should be the immediate response?

A) Normal DNS activity; ignore.
B) DNS tunneling used for covert data exfiltration; capture traffic, isolate hosts, and decode payloads.
C) Misconfigured internal DNS servers; update configuration.
D) Antivirus telemetry over DNS; verify vendor.

Answer: B)

Explanation:

Option A assumes normal DNS behavior. Regular DNS queries typically involve short, meaningful domain names directed at known endpoints. Extremely long subdomains and encoded responses, particularly occurring outside normal operating hours, indicate anomalous behavior inconsistent with routine network operations. Ignoring this may allow attackers to exfiltrate sensitive data undetected.

Option B is correct. DNS tunneling is a well-known technique for covert exfiltration or command-and-control communication. Large, encoded subdomains transmitted outside business hours are consistent with attackers trying to bypass traditional monitoring. Immediate response should involve capturing the DNS traffic to analyze the content, isolating affected hosts to prevent further exfiltration, and decoding payloads to determine the type of data being transmitted. Endpoint investigation is essential to identify processes initiating the queries, uncover persistence mechanisms, and assess the scope of the compromise. Correlating findings with SIEM logs and threat intelligence sources helps identify attacker infrastructure and tactics. Remediation involves cleaning affected endpoints, updating detection rules to recognize DNS tunneling patterns, and monitoring for similar activity across the environment. Preserving forensic evidence ensures a comprehensive understanding and documentation of the incident.

Option C proposes misconfigured DNS servers. Misconfigurations may generate unusual traffic but rarely result in repeated, encoded, high-volume queries to external resolvers. Assuming misconfiguration could overlook a sophisticated exfiltration technique.

Option D assumes antivirus telemetry. Legitimate antivirus DNS queries are predictable, directed at trusted domains, and do not use encoded payloads. The behavior described does not align with vendor telemetry protocols.

Selecting option B prioritizes early detection, containment, and forensic analysis, ensuring sensitive data is protected while allowing a thorough understanding of attacker methods and infrastructure.

Question 53

A security analyst identifies Windows endpoints executing obfuscated PowerShell scripts that modify registry keys, disable antivirus services, and attempt outbound communication to unknown IP addresses. No alerts were generated by the endpoint security system. What is the likely threat, and what is the recommended response?

A) Routine administrative scripts; allow execution.
B) Fileless malware using PowerShell to maintain persistence and C2 channels; isolate endpoints, capture memory, and analyze scripts.
C) Misconfigured automation scripts; update scripts.
D) Users testing scripts; notify users.

Answer: B)

Explanation:

Option A assumes legitimate administrative activity. Administrative scripts generally run under documented accounts, are signed, and follow predictable behaviors. Obfuscation, registry modifications, and disabling antivirus services indicate malicious intent. Ignoring this behavior risks compromise and persistent malware presence.

Option B is correct. Fileless malware leverages legitimate system tools like PowerShell to execute in memory, bypassing traditional antivirus detection. Indicators include obfuscated scripts, registry modifications for persistence, and outbound connections to unknown hosts. Immediate response includes isolating affected endpoints to prevent further spread, capturing memory to analyze in-memory processes, and analyzing scripts to determine attacker techniques and payloads. Network traffic analysis helps identify command-and-control servers and data exfiltration attempts. Cross-referencing external IPs with threat intelligence provides context and identifies known malicious infrastructure. Remediation involves cleaning infected endpoints, restoring disabled security services, updating detection mechanisms, and monitoring other systems for similar activity. This structured approach balances containment with forensic preservation.

Option C suggests misconfigured automation scripts. Misconfigurations rarely include obfuscation, disabling security services, and connecting to unknown external hosts. Treating the activity as a benign misconfiguration could allow malware to persist.

Option D assumes user testing. Legitimate testing is typically documented, performed under user accounts, and does not disable security controls or attempt external communication. Ignoring the threat could result in compromise.

Choosing option B ensures containment, investigation, and remediation of advanced malware, protecting endpoints and preserving forensic evidence for future security improvements.

Question 54

A SOC analyst detects multiple endpoints performing repeated failed authentication attempts on cloud accounts with administrative privileges. The attempts originate from IPs in various countries. What is the most likely threat, and what is the immediate mitigation step?

A) User mistyped credentials; notify users.
B) Credential-stuffing attacks targeting cloud accounts; block IPs, enforce MFA, and review logs.
C) Legitimate mobile device logins; allow.
D) Misconfigured cloud settings; adjust configurations.

Answer: B)

Explanation:

Option A assumes user error. While occasional mistyped credentials occur, repeated failed attempts from global IP addresses targeting administrative accounts are indicative of malicious activity, not routine mistakes. Ignoring this behavior could result in compromised cloud accounts.

Option B is correct. Credential-stuffing attacks use stolen or guessed credentials to gain access. Targeting privileged accounts increases risk to sensitive data and administrative control. Immediate mitigation includes blocking offending IP addresses, enabling multi-factor authentication, reviewing logs for successful logins, and auditing account activity. Analysts should correlate attack patterns with threat intelligence to identify known attacker infrastructure. Enforcement of strong password policies and monitoring for anomalies reduces future risk. Remediation ensures compromised accounts are reset and access integrity is restored.

Option C suggests legitimate mobile logins. Legitimate access typically originates from trusted devices, known locations, and predictable patterns. Global IP failed attempts targeting multiple administrative accounts are inconsistent with normal mobile behavior.

Option D assumes misconfigured cloud settings. Misconfigurations do not generate repeated failed logins from various countries. Treating this as a configuration issue risks overlooking active attacks.

Selecting option B ensures rapid mitigation of credential-based attacks, safeguarding administrative accounts, and protecting sensitive cloud resources.

Question 55

A SOC analyst identifies endpoints executing scripts that create scheduled tasks to run scripts downloaded from external servers. The scripts obfuscate code and attempt to disable logging services. What is the most likely threat, and what is the recommended response?

A) Routine administrative automation; allow execution.
B) Malware establishing persistence and evading detection; isolate endpoints, capture memory, and analyze scripts.
C) Misconfigured automation; update scripts.
D) User-initiated testing; notify users.

Answer: B)

Explanation:

Option A assumes routine administration. Administrative scripts are documented, signed, and predictable. Creating multiple tasks to download and execute scripts that disable logging is indicative of malicious activity. Ignoring this could allow persistence and unauthorized access.

Option B is correct. Malware often uses scheduled tasks to maintain persistence while evading detection. Indicators include obfuscated scripts, external downloads, and tampering with logging. Immediate response involves isolating affected endpoints, capturing memory for forensic analysis, and analyzing scripts to understand behavior and potential C2 communication. Correlating activity with network traffic helps identify external infrastructure. Remediation includes cleaning endpoints, restoring logging services, updating detection rules, and monitoring other endpoints for similar behavior. Preserving evidence supports incident response, threat hunting, and forensic investigation.

Option C suggests misconfiguration. Misconfigured scripts rarely include obfuscation, external downloads, and logging tampering. Assuming a benign misconfiguration could allow malware to persist.

Option D assumes testing. User-initiated testing is usually documented and does not involve disabling security controls. Ignoring this threat could result in compromise.

Selecting option B ensures proper containment, forensic analysis, and remediation while preventing malware persistence and further compromise.

Question 56

A SOC analyst notices multiple Windows endpoints attempting outbound connections to newly registered domains over HTTPS during off-hours. The traffic consists of small encrypted POST requests, and no antivirus alerts have been triggered. What is the most likely scenario, and what is the immediate response?

A) Normal application telemetry; allow traffic.
B) Covert data exfiltration via HTTP/HTTPS; capture network traffic, isolate endpoints, and analyze payloads.
C) Antivirus updates; verify vendor domains.
D) User testing web applications; notify users.

Answer: B)

Explanation:

Option A assumes normal telemetry. Legitimate telemetry is generally sent to known domains, uses predictable schedules, and does not consist of obfuscated, encrypted POST requests. Off-hour, low-volume, encrypted traffic to newly registered domains is inconsistent with normal telemetry patterns. Ignoring this could allow attackers to exfiltrate sensitive information undetected.

Option B is correct. The described behavior is indicative of covert data exfiltration. Attackers frequently use HTTP or HTTPS POST requests to transfer small encrypted data chunks to newly registered domains to evade detection. Immediate response involves isolating the affected endpoints to prevent further data transfer, capturing network traffic for forensic analysis, and decoding payloads to determine the type of data being transmitted. Endpoint investigation helps identify processes or scripts responsible for the activity, along with any persistence mechanisms. Cross-referencing the domains with threat intelligence can reveal associated attacker infrastructure. Remediation includes cleaning affected systems, restoring security services, updating detection rules, and enhancing monitoring to detect similar activity. This approach ensures evidence preservation, containment, and protection of sensitive data while maintaining operational continuity.

Option C assumes antivirus updates. Antivirus updates are sent to trusted vendor domains, not newly registered or suspicious domains. Their regularly encrypted POST traffic is not consistent with legitimate updates.

Option D suggests user testing. Testing is typically documented, involves authorized accounts, and occurs in controlled environments. Random off-hour encrypted POST requests to unknown domains are unlikely to be legitimate testing activity.

Selecting option B ensures containment, forensic capture, and remediation while preventing sensitive data loss and improving detection of future exfiltration attempts.

Question 57

A SOC analyst observes that multiple Linux servers are making repeated outbound SSH connections to external IP addresses using non-standard ports. System logs show these servers executing unusual processes, and connections persist despite no scheduled administration tasks. What is the most likely threat, and what should the SOC do first?

A) Routine administrative SSH connections; allow.
B) Malicious SSH tunnels for data exfiltration or command-and-control; isolate servers, capture network traffic, and analyze processes.
C) Misconfigured automation scripts; update configuration.
D) Monitoring software; verify with vendor.

Answer: B)

Explanation:

Option A assumes routine administration. Normal SSH connections use standard ports and are associated with documented maintenance or remote management tasks. Low-volume persistent connections to external IPs on non-standard ports, combined with unusual process execution, suggest malicious activity. Allowing this could result in covert data exfiltration or attacker persistence.

Option B is correct. The pattern of outbound SSH connections on non-standard ports, coupled with unusual processes, indicates that attackers may be using SSH tunnels to exfiltrate data or maintain command-and-control channels. Immediate SOC response should include isolating affected servers to prevent further compromise, capturing network traffic for analysis, and examining processes and memory on the endpoints. Network analysis identifies external IP addresses, transmitted data, and potentially malicious infrastructure. Endpoint forensics can reveal malware persistence, unauthorized accounts, or scripts controlling the connections. Following containment, remediation involves terminating unauthorized processes, cleaning servers, updating security monitoring, and reviewing firewall rules to prevent recurrence. Threat intelligence can provide context regarding attacker tactics and infrastructure.

Option C suggests misconfigured automation scripts. While scripts may cause unusual activity, they rarely result in persistent SSH connections to unknown external hosts over non-standard ports. Assuming misconfiguration risks overlooking active compromise.

Option D suggests that the unusual activity could be attributed to monitoring software operating on the network or endpoints. While monitoring tools are common in enterprise environments and can generate network traffic as part of their normal operations, legitimate monitoring behavior is typically well-defined, predictable, and consistent with organizational policies. Standard monitoring solutions usually communicate with known management servers, operate over approved ports such as 443 for secure communications or 161/162 for SNMP, and produce traffic patterns that are regular and easily distinguishable from anomalous activity. Their purpose is to observe, report, and alert on system health, performance, or security without introducing unexpected connections or obfuscating operations.

The scenario described, involving low-volume persistent SSH connections to unknown external IP addresses, does not align with the behavior expected from legitimate monitoring software. Standard monitoring tools rarely establish direct SSH sessions to unknown hosts, especially outside of internal management networks, because such connections could pose security risks and are not necessary for typical monitoring functions. Additionally, persistent low-volume traffic may indicate an attempt to maintain stealthy communication, which is inconsistent with the transparent and documented operations of legitimate software. Known monitoring solutions generate predictable patterns, such as scheduled data collection, periodic heartbeats, or routine reporting to centralized servers. Deviations from these patterns, particularly connections to unknown external endpoints, raise significant security concerns.

Assuming this activity is normal monitoring without verification could result in overlooking malicious behavior, such as malware establishing command-and-control channels or exfiltrating data. While monitoring software should be considered when analyzing network traffic, it is critical to verify its configuration, destination servers, and communication patterns to distinguish between authorized operations and potential compromise. Careful assessment ensures that anomalous activity is correctly classified, enabling appropriate mitigation measures and reducing the risk of undetected threats compromising the environment.

Choosing option B ensures proper containment, forensic analysis, and mitigation of covert channels while preventing data loss or lateral movement.

Question 58

A SOC analyst observes endpoints performing repeated failed login attempts on administrative cloud accounts from multiple international IP addresses. The activity is continuous and targets multiple accounts. What is the most likely threat, and what is the immediate mitigation step?

A) User mistyping passwords; notify users.
B) Credential-stuffing attacks targeting cloud administrative accounts; block IPs, enforce multi-factor authentication, and audit logs.
C) Legitimate mobile device logins; allow.
D) Misconfigured cloud services; update settings.

Answer: B)

Explanation:

Option A assumes user errors. While occasional mistyped credentials occur, repeated global login attempts on multiple administrative accounts strongly suggest malicious activity. Treating this as benign user behavior risks account compromise.

Option B is correct. Credential-stuffing attacks involve attackers using stolen or guessed credentials to gain access to cloud accounts, often targeting privileged roles for maximum impact. Immediate mitigation includes blocking offending IP addresses, enforcing multi-factor authentication, auditing account logs for any successful logins, and monitoring for anomalous behavior. Threat intelligence may provide context about attacking infrastructure or related campaigns. Following mitigation, enforcing strong password policies, resetting affected credentials, and validating user activity ensure account security and compliance. This approach minimizes risk, contains ongoing attacks, and improves visibility into credential abuse.

Option C assumes legitimate mobile logins. Normal mobile activity is usually predictable, originates from known devices or geolocations, and rarely targets multiple administrative accounts across international IPs.

Option D suggests cloud misconfiguration. Misconfigurations do not create repeated failed login attempts from diverse global sources. Treating this activity as a configuration issue could allow attackers to succeed.

Selecting option B provides rapid containment, reduces account compromise risk, and strengthens security controls for future incidents.

Question 59

A SOC analyst detects multiple endpoints accessing rarely used network shares, reading small portions of files, and attempting unauthorized writes. The activity occurs primarily outside business hours. What is the most likely threat, and what should the SOC do first?

A) Normal backup activity; allow.
B) Malware performing lateral movement or reconnaissance; isolate endpoints, review logs, and perform endpoint analysis.
C) Misconfigured scheduled tasks; correct configuration.
D) Legitimate off-hours user activity; notify users.

Answer: B)

Explanation:

Option A assumes normal backup activity. Backup processes typically access full files at scheduled times, use known accounts, and follow predictable patterns. Reading small portions of files and performing unauthorized writes deviates from normal backup behavior. Allowing this activity could facilitate malware reconnaissance or propagation.

Option B is correct. Malware performing lateral movement often probes network shares to identify accessible files and permissions. Indicators include accessing rarely used shares, reading small portions of files, attempting unauthorized writes, and activity outside business hours. Immediate SOC response involves isolating affected endpoints, reviewing file access logs to determine what resources were targeted, and performing endpoint analysis to identify malware or scripts facilitating movement. Remediation involves cleaning compromised endpoints, strengthening access controls, updating monitoring and alerting rules, and validating account integrity to prevent further compromise. Preserving forensic evidence allows the SOC to understand attacker techniques and improve detection capabilities.

Option C proposes misconfigured scheduled tasks. Misconfigurations generally follow predictable behavior and affect limited endpoints. Observing multiple endpoints performing suspicious activity is unlikely to be caused by misconfiguration alone.

Option D assumes that off-hours activity observed on the network or endpoints is legitimate, suggesting that unusual access to resources such as rarely used shares or attempted writes outside normal working hours may be benign. While legitimate users or automated business processes can operate outside standard hours, in practice, such activity is uncommon and usually well-documented or tied to scheduled jobs. Most employees access commonly used shares, files, or applications during standard business hours, and any off-hours interactions with rarely accessed resources should be treated with caution. Unauthorized or unexpected attempts to write to sensitive or infrequently used locations, particularly during off-hours, are inconsistent with normal user behavior. These actions may indicate that a system has been compromised and that malware or an unauthorized actor is attempting to manipulate files, spread laterally, or establish persistence.

Assuming that off-hours activity is automatically legitimate introduces significant risk. Malware and other malicious actors often exploit periods of low monitoring, such as nights, weekends, or holidays, to carry out their operations while avoiding detection. This includes activities like creating or modifying files, uploading stolen data, altering permissions, or installing persistence mechanisms. By categorizing these actions as benign based solely on the time they occur, security teams may overlook early indicators of compromise, allowing malware to propagate further within the network. Lateral movement, in particular, is a critical risk, as attackers can leverage compromised accounts to gain access to additional systems or sensitive data. Early detection is essential to contain threats, prevent exfiltration, and limit operational impact.

Behavioral baselines and anomaly detection are key in differentiating between legitimate off-hours activity and malicious behavior. While legitimate off-hours processes are typically scheduled, well-documented, and predictable, malicious actions are often inconsistent, targeting rarely accessed resources, using abnormal credentials, or attempting unauthorized writes. Treating these anomalies as harmless because they occur off-hours ignores the context and intent of the actions. Security monitoring and incident response should prioritize validation of unusual access patterns, cross-referencing with known schedules, and reviewing access logs to identify potential compromises.

Ignoring off-hours anomalies also undermines proactive cybersecurity practices. Organizations that fail to investigate atypical access or write risk delay detection, allowing threats to entrench themselves in critical systems and complicate remediation efforts. Prompt investigation can help isolate affected systems, remove malware, and strengthen defenses to prevent recurrence. Effective response balances operational disruption with security, using targeted investigation rather than blanket assumptions about activity timing.

Assuming off-hours access to rarely used shares or unauthorized writes is legitimate is inherently risky. Normal user behavior rarely includes these actions, and malware often exploits off-hours windows to operate undetected. Treating these activities as benign can allow malicious actors to continue spreading, compromising sensitive data, and maintaining persistence within the network. Careful analysis, verification, and contextual evaluation are essential to distinguish between legitimate operations and potential threats, ensuring timely mitigation and protection of organizational assets.

Selecting option B ensures containment, forensic analysis, and remediation while preventing further internal compromise and improving detection of similar lateral movement attempts.

Question 60

A SOC analyst observes endpoints executing scripts that download and run files from untrusted external sources directly in memory. The scripts leave no disk artifacts, and antivirus alerts have not triggered. What is the most likely threat, and what is the recommended response?

A) Routine software installation; allow execution.
B) Fileless malware using memory-based execution; isolate endpoints, perform memory forensics, and analyze scripts.
C) Misconfigured automation scripts; update scripts.
D) Legitimate patching process; verify with administrator.

Answer: B)

Explanation:

Option A assumes routine installation. Normal software installation involves signed binaries, disk persistence, and predictable behavior. Running untrusted scripts directly in memory with no disk artifacts is highly suspicious and inconsistent with standard operations. Ignoring this behavior risks compromise and persistence.

Option B is correct. Fileless malware operates primarily in memory, avoiding traditional endpoint detection. Indicators include downloading and executing files from untrusted sources, the absence of disk artifacts, and the lack of antivirus alerts. Immediate response involves isolating affected endpoints to prevent lateral movement and further compromise. Memory forensics allows analysts to capture running processes, injected code, and in-memory payloads. Script analysis helps determine malware behavior, persistence methods, and potential command-and-control communication. Network traffic analysis identifies external infrastructure. Remediation includes cleaning infected endpoints, updating detection signatures, and monitoring other endpoints for similar activity. Preserving evidence ensures forensic and threat intelligence analysis can be performed to prevent recurrence.

Option C raises the possibility of misconfigured automation scripts or processes as the source of unusual system activity. Automation scripts, by design, are intended to execute predefined tasks in a controlled and predictable manner. When these scripts are misconfigured, the issues typically manifest as failed executions, repeated errors, unexpected log entries, or predictable and easily traceable network traffic. For example, a script may repeatedly attempt to access a local resource, generate error logs when parameters are incorrect, or attempt to connect to an internal server outside scheduled windows. While misconfigured automation can produce anomalies, these anomalies generally follow discernible patterns and do not involve sophisticated, high-risk behaviors such as memory execution of external files.

Direct memory execution of external files is a technique commonly associated with advanced malware or targeted attacks. Unlike a misconfigured script, which might inadvertently read or write to the filesystem or generate predictable network connections, memory execution allows malicious code to run without leaving persistent artifacts on disk, thereby evading traditional detection mechanisms. This behavior is indicative of a deliberate effort to maintain stealth and avoid forensic discovery, as the malicious code resides only in volatile memory and disappears upon system restart. Treating such activity as a benign scripting error can have serious consequences, as it risks leaving malware fully operational on the system, potentially allowing it to maintain persistence, exfiltrate sensitive data, or propagate laterally across the network.

Misconfigured automation does not typically implement the mechanisms required for in-memory execution. Scripts and scheduled tasks execute predefined commands or programs, and while errors may occur, these operations usually involve files on disk or loggable network actions that administrators can trace. Conversely, malware leveraging memory execution often uses advanced techniques such as reflective loading, code injection, or process hollowing to avoid detection, which are not byproducts of simple automation errors. The presence of such activity alongside other indicators—such as unknown external connections, unusual ports, or cleared logs—strongly suggests malicious intent rather than accidental misconfiguration.

Therefore, treating direct memory execution of external files as a routine misconfiguration is both dangerous and negligent. It bypasses proper investigation, leaving sophisticated threats undetected and potentially allowing continued exploitation of the system. The correct response requires thorough forensic analysis, including memory forensics, network traffic inspection, and verification of system integrity. By properly identifying and mitigating malicious activity rather than assuming a benign cause, organizations can prevent persistent threats, protect sensitive assets, and maintain the security of their infrastructure. In conclusion, while automation misconfigurations should be investigated as a possible source of system anomalies, direct memory execution of external files is a strong indicator of deliberate malware, and misclassifying it as benign exposes the organization to significant ongoing risk.

Option D assumes legitimate patching. Patching processes are signed, documented, and follow predictable procedures. Fileless execution of untrusted downloads does not align with standard patch management.

Selecting option B ensures containment, investigation, and remediation of sophisticated memory-based threats while preserving forensic evidence for analysis and improving detection of similar attacks.