CompTIA CySA+ CS0-003 Indicators Of Potentially Malicious Activity Practice Test

 

Objective 1.2 • 40 original questions

This CompTIA CySA+ CS0-003 practice test focuses on objective 1.2: indicators of potentially malicious activity. All questions are original ExamSnap scenarios aligned to the official CS0-003 objective set; they are not copied from live CompTIA exam content. Review every option explanation to understand why a choice fits or does not fit the scenario. For broader exam preparation, review the CompTIA CySA+ CS0-003 Exam Dumps page.

Instructions: Select the best answer unless the question explicitly says Select TWO or Select THREE. Review the explanation and option review after answering.

Question 1

During a security review, a cloud security analyst must address two separate needs: repeated outbound connections occur at nearly fixed intervals, and a protected host shows configuration changes with no change ticket. Select TWO. The environment follows least privilege and preserves evidence where incident handling is involved.

1. Resource-consumption anomaly
2. Service interruption
3. Application-log anomaly
4. Unauthorized configuration change
5. Beaconing

Correct answers: D, E

Why: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket. Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals.

Option review:

A: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

B: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

C: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

D: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket.

E: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals.

Learning point: Use Beaconing, Unauthorized configuration change when the key requirement is to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

Question 2

At Coho Winery, a systems security analyst has two simultaneous requirements: workstations begin communicating directly with many peers outside the expected client-server pattern, and a standard user unexpectedly gains administrative rights. Which TWO options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Unexpected outbound application communication
2. Unusual traffic spike
3. Irregular peer-to-peer communication
4. Unauthorized privilege change
5. Obfuscated-link indicator

Correct answers: C, D

Why: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern. New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights.

Option review:

A: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern; a standard user unexpectedly gains administrative rights.

B: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern; a standard user unexpectedly gains administrative rights.

C: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern.

D: New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights.

E: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern; a standard user unexpectedly gains administrative rights.

Learning point: Use Irregular peer-to-peer communication, Unauthorized privilege change when the key requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern; a standard user unexpectedly gains administrative rights.

Question 3

A review at Litware Manufacturing finds a gap: the team cannot reliably an unknown device appears on a protected network segment. Which option best closes that gap? The team wants the most defensible analyst action before expanding the investigation.

1. Unexpected outbound application communication
2. Malicious or abnormal process behavior
3. New-account anomaly
4. Rogue device detection
5. Scan or sweep activity

Correct answer: D

Why: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. It directly fits this scenario because the requirement is to an unknown device appears on a protected network segment.

Option review:

A: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

B: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

C: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

D: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. It directly fits this scenario because the requirement is to an unknown device appears on a protected network segment.

E: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

Learning point: Use Rogue device detection when the key requirement is to an unknown device appears on a protected network segment.

Question 4

Fourth Coffee is designing a combined control. It must one source rapidly probes many hosts or many ports, and a new scheduled task launches an unfamiliar executable at logon. Which TWO options are most appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Scan or sweep activity
2. Malicious or abnormal process behavior
3. Unauthorized scheduled task
4. Obfuscated-link indicator
5. Unauthorized software

Correct answers: A, C

Why: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. It directly fits this scenario because the requirement is to one source rapidly probes many hosts or many ports. Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. It directly fits this scenario because the requirement is to a new scheduled task launches an unfamiliar executable at logon.

Option review:

A: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. It directly fits this scenario because the requirement is to one source rapidly probes many hosts or many ports.

B: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to one source rapidly probes many hosts or many ports; a new scheduled task launches an unfamiliar executable at logon.

C: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. It directly fits this scenario because the requirement is to a new scheduled task launches an unfamiliar executable at logon.

D: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to one source rapidly probes many hosts or many ports; a new scheduled task launches an unfamiliar executable at logon.

E: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to one source rapidly probes many hosts or many ports; a new scheduled task launches an unfamiliar executable at logon.

Learning point: Use Scan or sweep activity, Unauthorized scheduled task when the key requirement is to one source rapidly probes many hosts or many ports; a new scheduled task launches an unfamiliar executable at logon.

Question 5

While supporting a customer-facing messaging service, a response lead is asked to network utilization sharply increases without a planned business event. Which concept or tool is the clearest match? Assume the activity is authorized and must follow normal enterprise change control.

1. Unexpected-port activity
2. Social-engineering indicator
3. Rogue device detection
4. Unusual traffic spike
5. Unexpected outbound application communication

Correct answer: D

Why: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. It directly fits this scenario because the requirement is to network utilization sharply increases without a planned business event.

Option review:

A: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

B: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

C: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

D: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. It directly fits this scenario because the requirement is to network utilization sharply increases without a planned business event.

E: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

Learning point: Use Unusual traffic spike when the key requirement is to network utilization sharply increases without a planned business event.

Question 6

At Adventure Works, a blue-team analyst has two simultaneous requirements: a server communicates on ports not documented for its application role, and an internal application begins making outbound connections not present in its baseline. Which TWO options should be selected? Assume no additional product-specific features are available beyond the concepts listed.

1. Unexpected outbound application communication
2. Unexpected-port activity
3. Obfuscated-link indicator
4. Unauthorized scheduled task
5. Unauthorized configuration change

Correct answers: A, B

Why: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. It directly fits this scenario because the requirement is to an internal application begins making outbound connections not present in its baseline. Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. It directly fits this scenario because the requirement is to a server communicates on ports not documented for its application role.

Option review:

A: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. It directly fits this scenario because the requirement is to an internal application begins making outbound connections not present in its baseline.

B: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. It directly fits this scenario because the requirement is to a server communicates on ports not documented for its application role.

C: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a server communicates on ports not documented for its application role; an internal application begins making outbound connections not present in its baseline.

D: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a server communicates on ports not documented for its application role; an internal application begins making outbound connections not present in its baseline.

E: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a server communicates on ports not documented for its application role; an internal application begins making outbound connections not present in its baseline.

Learning point: Use Unexpected-port activity, Unexpected outbound application communication when the key requirement is to a server communicates on ports not documented for its application role; an internal application begins making outbound connections not present in its baseline.

Question 7

For a global corporate network, the team must accomplish both of these goals: an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline, and a business service becomes unavailable during suspicious network activity. Which TWO choices together provide the best match? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Malicious or abnormal process behavior
2. Data exfiltration indicator
3. Resource-consumption anomaly
4. Service interruption
5. Unexpected outbound application communication

Correct answers: C, D

Why: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. It directly fits this scenario because the requirement is to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline. Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity.

Option review:

A: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

B: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

C: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. It directly fits this scenario because the requirement is to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline.

D: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity.

E: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

Learning point: Use Resource-consumption anomaly, Service interruption when the key requirement is to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

Question 8

At Datum Fabrication, a security architect needs to an endpoint inventory shows an unapproved remote-access or utility package. Which option is the BEST fit for a mixed Windows and Linux estate? Base the decision on the primary security requirement, not on implementation convenience.

1. Scan or sweep activity
2. Unauthorized configuration change
3. Service interruption
4. Unauthorized software
5. Beaconing

Correct answer: D

Why: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. It directly fits this scenario because the requirement is to an endpoint inventory shows an unapproved remote-access or utility package.

Option review:

A: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint inventory shows an unapproved remote-access or utility package.

B: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint inventory shows an unapproved remote-access or utility package.

C: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint inventory shows an unapproved remote-access or utility package.

D: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. It directly fits this scenario because the requirement is to an endpoint inventory shows an unapproved remote-access or utility package.

E: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint inventory shows an unapproved remote-access or utility package.

Learning point: Use Unauthorized software when the key requirement is to an endpoint inventory shows an unapproved remote-access or utility package.

Question 9

During an investigation at Tailspin Toys, the immediate requirement is to a process has an unusual parent-child relationship and unexpected network connections. What should a SOC lead select? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Malicious or abnormal process behavior
2. Unauthorized privilege change
3. Service interruption
4. Unauthorized configuration change
5. Rogue device detection

Correct answer: A

Why: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. It directly fits this scenario because the requirement is to a process has an unusual parent-child relationship and unexpected network connections.

Option review:

A: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. It directly fits this scenario because the requirement is to a process has an unusual parent-child relationship and unexpected network connections.

B: New or elevated privileges without business justification can indicate account compromise or privilege escalation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

C: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

D: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

E: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

Learning point: Use Malicious or abnormal process behavior when the key requirement is to a process has an unusual parent-child relationship and unexpected network connections.

Question 10

Proseware Research is updating its security operations standard for a restricted research segment. Which option most directly helps the team a protected host shows configuration changes with no change ticket? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Data exfiltration indicator
2. Beaconing
3. Unauthorized privilege change
4. Resource-consumption anomaly
5. Unauthorized configuration change

Correct answer: E

Why: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket.

Option review:

A: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

B: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

C: New or elevated privileges without business justification can indicate account compromise or privilege escalation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

D: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

E: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket.

Learning point: Use Unauthorized configuration change when the key requirement is to a protected host shows configuration changes with no change ticket.

Question 11

A ticket at Wingtip Services asks a SOC analyst to a standard user unexpectedly gains administrative rights. Which choice addresses the requirement most directly? The team wants the most defensible analyst action before expanding the investigation.

1. Scan or sweep activity
2. Application-log anomaly
3. Unauthorized privilege change
4. Obfuscated-link indicator
5. Social-engineering indicator

Correct answer: C

Why: New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights.

Option review:

A: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a standard user unexpectedly gains administrative rights.

B: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a standard user unexpectedly gains administrative rights.

C: New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights.

D: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a standard user unexpectedly gains administrative rights.

E: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a standard user unexpectedly gains administrative rights.

Learning point: Use Unauthorized privilege change when the key requirement is to a standard user unexpectedly gains administrative rights.

Question 12

In a high-value payment environment, a threat hunter must a host sends a large archive to an external destination it has never contacted. Which approach is MOST appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Data exfiltration indicator
2. Unexpected outbound application communication
3. Beaconing
4. Malicious or abnormal process behavior
5. Unauthorized scheduled task

Correct answer: A

Why: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. It directly fits this scenario because the requirement is to a host sends a large archive to an external destination it has never contacted.

Option review:

A: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. It directly fits this scenario because the requirement is to a host sends a large archive to an external destination it has never contacted.

B: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a host sends a large archive to an external destination it has never contacted.

C: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a host sends a large archive to an external destination it has never contacted.

D: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a host sends a large archive to an external destination it has never contacted.

E: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a host sends a large archive to an external destination it has never contacted.

Learning point: Use Data exfiltration indicator when the key requirement is to a host sends a large archive to an external destination it has never contacted.

Question 13

A review at Humongous Insurance finds a gap: the team cannot reliably a new scheduled task launches an unfamiliar executable at logon. Which option best closes that gap? Assume the activity is authorized and must follow normal enterprise change control.

1. Obfuscated-link indicator
2. Rogue device detection
3. Data exfiltration indicator
4. Malicious or abnormal process behavior
5. Unauthorized scheduled task

Correct answer: E

Why: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. It directly fits this scenario because the requirement is to a new scheduled task launches an unfamiliar executable at logon.

Option review:

A: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a new scheduled task launches an unfamiliar executable at logon.

B: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a new scheduled task launches an unfamiliar executable at logon.

C: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a new scheduled task launches an unfamiliar executable at logon.

D: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a new scheduled task launches an unfamiliar executable at logon.

E: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. It directly fits this scenario because the requirement is to a new scheduled task launches an unfamiliar executable at logon.

Learning point: Use Unauthorized scheduled task when the key requirement is to a new scheduled task launches an unfamiliar executable at logon.

Question 14

a SOC analyst at Contoso Health is comparing several approaches. The deciding requirement is to an application or directory suddenly contains a new account with no request record. Which option should be chosen? Assume no additional product-specific features are available beyond the concepts listed.

1. New-account anomaly
2. Rogue device detection
3. Beaconing
4. Malicious or abnormal process behavior
5. Unauthorized software

Correct answer: A

Why: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. It directly fits this scenario because the requirement is to an application or directory suddenly contains a new account with no request record.

Option review:

A: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. It directly fits this scenario because the requirement is to an application or directory suddenly contains a new account with no request record.

B: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

C: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

D: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

E: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

Learning point: Use New-account anomaly when the key requirement is to an application or directory suddenly contains a new account with no request record.

Question 15

While supporting an airline operations network, a security operations engineer is asked to an internal application begins making outbound connections not present in its baseline. Which concept or tool is the clearest match? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Unexpected outbound application communication
2. Social-engineering indicator
3. Irregular peer-to-peer communication
4. Resource-consumption anomaly
5. Scan or sweep activity

Correct answer: A

Why: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. It directly fits this scenario because the requirement is to an internal application begins making outbound connections not present in its baseline.

Option review:

A: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. It directly fits this scenario because the requirement is to an internal application begins making outbound connections not present in its baseline.

B: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

C: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

D: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

E: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

Learning point: Use Unexpected outbound application communication when the key requirement is to an internal application begins making outbound connections not present in its baseline.

Question 16

A new security procedure at Lucerne Publishing must enable analysts to a business service becomes unavailable during suspicious network activity. Which option is the BEST choice? Base the decision on the primary security requirement, not on implementation convenience.

1. Unexpected outbound application communication
2. Unauthorized software
3. Malicious or abnormal process behavior
4. Unauthorized scheduled task
5. Service interruption

Correct answer: E

Why: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity.

Option review:

A: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

B: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

C: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

D: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

E: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity.

Learning point: Use Service interruption when the key requirement is to a business service becomes unavailable during suspicious network activity.

Question 17

The primary objective for Fabrikam Finance is to the investigation requires evidence about application-specific errors and request behavior. Which selection best satisfies that objective in an online banking environment? The environment follows least privilege and preserves evidence where incident handling is involved.

1. New-account anomaly
2. Resource-consumption anomaly
3. Unauthorized privilege change
4. Application-log anomaly
5. Unauthorized scheduled task

Correct answer: D

Why: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. It directly fits this scenario because the requirement is to the investigation requires evidence about application-specific errors and request behavior.

Option review:

A: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

B: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

C: New or elevated privileges without business justification can indicate account compromise or privilege escalation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

D: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. It directly fits this scenario because the requirement is to the investigation requires evidence about application-specific errors and request behavior.

E: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

Learning point: Use Application-log anomaly when the key requirement is to the investigation requires evidence about application-specific errors and request behavior.

Question 18

At City Power Utilities, the response plan has three distinct requirements: a user receives an urgent request designed to bypass normal verification; network utilization sharply increases without a planned business event; and a standard user unexpectedly gains administrative rights. Which THREE options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Malicious or abnormal process behavior
2. Unusual traffic spike
3. Unauthorized privilege change
4. Social-engineering indicator
5. Unauthorized software

Correct answers: B, C, D

Why: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. It directly fits this scenario because the requirement is to network utilization sharply increases without a planned business event. New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights. Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. It directly fits this scenario because the requirement is to a user receives an urgent request designed to bypass normal verification.

Option review:

A: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a user receives an urgent request designed to bypass normal verification; network utilization sharply increases without a planned business event; a standard user unexpectedly gains administrative rights.

B: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. It directly fits this scenario because the requirement is to network utilization sharply increases without a planned business event.

C: New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights.

D: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. It directly fits this scenario because the requirement is to a user receives an urgent request designed to bypass normal verification.

E: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a user receives an urgent request designed to bypass normal verification; network utilization sharply increases without a planned business event; a standard user unexpectedly gains administrative rights.

Learning point: Use Social-engineering indicator, Unusual traffic spike, Unauthorized privilege change when the key requirement is to a user receives an urgent request designed to bypass normal verification; network utilization sharply increases without a planned business event; a standard user unexpectedly gains administrative rights.

Question 19

During an investigation at A. Datum Logistics, the immediate requirement is to a message contains a shortened or encoded link whose true destination is hidden. What should a security consultant select? The team wants the most defensible analyst action before expanding the investigation.

1. Unexpected-port activity
2. Obfuscated-link indicator
3. Resource-consumption anomaly
4. Beaconing
5. New-account anomaly

Correct answer: B

Why: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. It directly fits this scenario because the requirement is to a message contains a shortened or encoded link whose true destination is hidden.

Option review:

A: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a message contains a shortened or encoded link whose true destination is hidden.

B: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. It directly fits this scenario because the requirement is to a message contains a shortened or encoded link whose true destination is hidden.

C: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a message contains a shortened or encoded link whose true destination is hidden.

D: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a message contains a shortened or encoded link whose true destination is hidden.

E: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a message contains a shortened or encoded link whose true destination is hidden.

Learning point: Use Obfuscated-link indicator when the key requirement is to a message contains a shortened or encoded link whose true destination is hidden.

Question 20

Northwind Traders is updating its security operations standard for a regional distribution network. Which option most directly helps the team repeated outbound connections occur at nearly fixed intervals? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Unauthorized software
2. Beaconing
3. Scan or sweep activity
4. Unauthorized privilege change
5. Unexpected-port activity

Correct answer: B

Why: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals.

Option review:

A: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals.

B: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals.

C: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals.

D: New or elevated privileges without business justification can indicate account compromise or privilege escalation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals.

E: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals.

Learning point: Use Beaconing when the key requirement is to repeated outbound connections occur at nearly fixed intervals.

Question 21

A ticket at Alpine Ski House asks a cloud security analyst to workstations begin communicating directly with many peers outside the expected client-server pattern. Which choice addresses the requirement most directly? Assume the activity is authorized and must follow normal enterprise change control.

1. Unauthorized software
2. Unauthorized scheduled task
3. Rogue device detection
4. Unauthorized configuration change
5. Irregular peer-to-peer communication

Correct answer: E

Why: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern.

Option review:

A: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern.

B: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern.

C: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern.

D: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern.

E: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern.

Learning point: Use Irregular peer-to-peer communication when the key requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern.

Question 22

In a branch-office network, a systems security analyst must an unknown device appears on a protected network segment. Which approach is MOST appropriate? Assume no additional product-specific features are available beyond the concepts listed.

1. Scan or sweep activity
2. Unauthorized software
3. Data exfiltration indicator
4. Irregular peer-to-peer communication
5. Rogue device detection

Correct answer: E

Why: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. It directly fits this scenario because the requirement is to an unknown device appears on a protected network segment.

Option review:

A: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

B: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

C: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

D: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an unknown device appears on a protected network segment.

E: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. It directly fits this scenario because the requirement is to an unknown device appears on a protected network segment.

Learning point: Use Rogue device detection when the key requirement is to an unknown device appears on a protected network segment.

Question 23

A review at Litware Manufacturing finds a gap: the team cannot reliably one source rapidly probes many hosts or many ports. Which option best closes that gap? The organization wants a vendor-neutral approach that can be explained during audit review.

1. New-account anomaly
2. Unexpected outbound application communication
3. Data exfiltration indicator
4. Service interruption
5. Scan or sweep activity

Correct answer: E

Why: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. It directly fits this scenario because the requirement is to one source rapidly probes many hosts or many ports.

Option review:

A: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to one source rapidly probes many hosts or many ports.

B: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to one source rapidly probes many hosts or many ports.

C: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to one source rapidly probes many hosts or many ports.

D: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to one source rapidly probes many hosts or many ports.

E: A scan or sweep touches many addresses or ports to discover hosts, services, or weaknesses. It directly fits this scenario because the requirement is to one source rapidly probes many hosts or many ports.

Learning point: Use Scan or sweep activity when the key requirement is to one source rapidly probes many hosts or many ports.

Question 24

a security administrator at Fourth Coffee is comparing several approaches. The deciding requirement is to network utilization sharply increases without a planned business event. Which option should be chosen? Base the decision on the primary security requirement, not on implementation convenience.

1. New-account anomaly
2. Unusual traffic spike
3. Service interruption
4. Rogue device detection
5. Social-engineering indicator

Correct answer: B

Why: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. It directly fits this scenario because the requirement is to network utilization sharply increases without a planned business event.

Option review:

A: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

B: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. It directly fits this scenario because the requirement is to network utilization sharply increases without a planned business event.

C: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

D: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

E: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to network utilization sharply increases without a planned business event.

Learning point: Use Unusual traffic spike when the key requirement is to network utilization sharply increases without a planned business event.

Question 25

While supporting a customer-facing messaging service, a response lead is asked to a server communicates on ports not documented for its application role. Which concept or tool is the clearest match? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Unauthorized privilege change
2. Obfuscated-link indicator
3. Data exfiltration indicator
4. Malicious or abnormal process behavior
5. Unexpected-port activity

Correct answer: E

Why: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. It directly fits this scenario because the requirement is to a server communicates on ports not documented for its application role.

Option review:

A: New or elevated privileges without business justification can indicate account compromise or privilege escalation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a server communicates on ports not documented for its application role.

B: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a server communicates on ports not documented for its application role.

C: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a server communicates on ports not documented for its application role.

D: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a server communicates on ports not documented for its application role.

E: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. It directly fits this scenario because the requirement is to a server communicates on ports not documented for its application role.

Learning point: Use Unexpected-port activity when the key requirement is to a server communicates on ports not documented for its application role.

Question 26

At Adventure Works, a blue-team analyst has two simultaneous requirements: an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline, and a business service becomes unavailable during suspicious network activity. Which TWO options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Service interruption
2. Resource-consumption anomaly
3. Unauthorized configuration change
4. Unexpected outbound application communication
5. Application-log anomaly

Correct answers: A, B

Why: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity. Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. It directly fits this scenario because the requirement is to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline.

Option review:

A: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity.

B: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. It directly fits this scenario because the requirement is to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline.

C: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

D: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

E: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

Learning point: Use Resource-consumption anomaly, Service interruption when the key requirement is to an endpoint suddenly consumes much more processor, memory, or disk capacity than its baseline; a business service becomes unavailable during suspicious network activity.

Question 27

For a global corporate network, the team must accomplish both of these goals: an endpoint inventory shows an unapproved remote-access or utility package, and the investigation requires evidence about application-specific errors and request behavior. Which TWO choices together provide the best match? The team wants the most defensible analyst action before expanding the investigation.

1. Obfuscated-link indicator
2. New-account anomaly
3. Unauthorized software
4. Application-log anomaly
5. Unexpected outbound application communication

Correct answers: C, D

Why: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. It directly fits this scenario because the requirement is to an endpoint inventory shows an unapproved remote-access or utility package. Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. It directly fits this scenario because the requirement is to the investigation requires evidence about application-specific errors and request behavior.

Option review:

A: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint inventory shows an unapproved remote-access or utility package; the investigation requires evidence about application-specific errors and request behavior.

B: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint inventory shows an unapproved remote-access or utility package; the investigation requires evidence about application-specific errors and request behavior.

C: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. It directly fits this scenario because the requirement is to an endpoint inventory shows an unapproved remote-access or utility package.

D: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. It directly fits this scenario because the requirement is to the investigation requires evidence about application-specific errors and request behavior.

E: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an endpoint inventory shows an unapproved remote-access or utility package; the investigation requires evidence about application-specific errors and request behavior.

Learning point: Use Unauthorized software, Application-log anomaly when the key requirement is to an endpoint inventory shows an unapproved remote-access or utility package; the investigation requires evidence about application-specific errors and request behavior.

Question 28

At Datum Fabrication, a security architect needs to a process has an unusual parent-child relationship and unexpected network connections. Which option is the BEST fit for a mixed Windows and Linux estate? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Data exfiltration indicator
2. Unexpected-port activity
3. Resource-consumption anomaly
4. Malicious or abnormal process behavior
5. Unauthorized software

Correct answer: D

Why: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. It directly fits this scenario because the requirement is to a process has an unusual parent-child relationship and unexpected network connections.

Option review:

A: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

B: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

C: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

D: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. It directly fits this scenario because the requirement is to a process has an unusual parent-child relationship and unexpected network connections.

E: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a process has an unusual parent-child relationship and unexpected network connections.

Learning point: Use Malicious or abnormal process behavior when the key requirement is to a process has an unusual parent-child relationship and unexpected network connections.

Question 29

During an investigation at Tailspin Toys, the immediate requirement is to a protected host shows configuration changes with no change ticket. What should a SOC lead select? Assume the activity is authorized and must follow normal enterprise change control.

1. Unusual traffic spike
2. Unexpected-port activity
3. Unauthorized configuration change
4. Service interruption
5. Beaconing

Correct answer: C

Why: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket.

Option review:

A: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

B: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

C: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket.

D: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

E: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a protected host shows configuration changes with no change ticket.

Learning point: Use Unauthorized configuration change when the key requirement is to a protected host shows configuration changes with no change ticket.

Question 30

At Proseware Research, a malware analyst has two simultaneous requirements: a standard user unexpectedly gains administrative rights, and repeated outbound connections occur at nearly fixed intervals. Which TWO options should be selected? Assume no additional product-specific features are available beyond the concepts listed.

1. Unexpected-port activity
2. Beaconing
3. Unauthorized privilege change
4. Unauthorized software
5. Unauthorized scheduled task

Correct answers: B, C

Why: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals. New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights.

Option review:

A: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a standard user unexpectedly gains administrative rights; repeated outbound connections occur at nearly fixed intervals.

B: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals.

C: New or elevated privileges without business justification can indicate account compromise or privilege escalation. It directly fits this scenario because the requirement is to a standard user unexpectedly gains administrative rights.

D: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a standard user unexpectedly gains administrative rights; repeated outbound connections occur at nearly fixed intervals.

E: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a standard user unexpectedly gains administrative rights; repeated outbound connections occur at nearly fixed intervals.

Learning point: Use Unauthorized privilege change, Beaconing when the key requirement is to a standard user unexpectedly gains administrative rights; repeated outbound connections occur at nearly fixed intervals.

Question 31

For a managed cloud environment, the team must accomplish both of these goals: a host sends a large archive to an external destination it has never contacted, and workstations begin communicating directly with many peers outside the expected client-server pattern. Which TWO choices together provide the best match? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Unexpected-port activity
2. Service interruption
3. Data exfiltration indicator
4. Irregular peer-to-peer communication
5. Unauthorized scheduled task

Correct answers: C, D

Why: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. It directly fits this scenario because the requirement is to a host sends a large archive to an external destination it has never contacted. Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern.

Option review:

A: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a host sends a large archive to an external destination it has never contacted; workstations begin communicating directly with many peers outside the expected client-server pattern.

B: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a host sends a large archive to an external destination it has never contacted; workstations begin communicating directly with many peers outside the expected client-server pattern.

C: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. It directly fits this scenario because the requirement is to a host sends a large archive to an external destination it has never contacted.

D: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern.

E: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a host sends a large archive to an external destination it has never contacted; workstations begin communicating directly with many peers outside the expected client-server pattern.

Learning point: Use Data exfiltration indicator, Irregular peer-to-peer communication when the key requirement is to a host sends a large archive to an external destination it has never contacted; workstations begin communicating directly with many peers outside the expected client-server pattern.

Question 32

Woodgrove Bank is designing a combined control. It must a new scheduled task launches an unfamiliar executable at logon, and an unknown device appears on a protected network segment. Which TWO options are most appropriate? Base the decision on the primary security requirement, not on implementation convenience.

1. Unauthorized configuration change
2. New-account anomaly
3. Rogue device detection
4. Unauthorized scheduled task
5. Unexpected-port activity

Correct answers: C, D

Why: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. It directly fits this scenario because the requirement is to an unknown device appears on a protected network segment. Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. It directly fits this scenario because the requirement is to a new scheduled task launches an unfamiliar executable at logon.

Option review:

A: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a new scheduled task launches an unfamiliar executable at logon; an unknown device appears on a protected network segment.

B: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a new scheduled task launches an unfamiliar executable at logon; an unknown device appears on a protected network segment.

C: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. It directly fits this scenario because the requirement is to an unknown device appears on a protected network segment.

D: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. It directly fits this scenario because the requirement is to a new scheduled task launches an unfamiliar executable at logon.

E: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a new scheduled task launches an unfamiliar executable at logon; an unknown device appears on a protected network segment.

Learning point: Use Unauthorized scheduled task, Rogue device detection when the key requirement is to a new scheduled task launches an unfamiliar executable at logon; an unknown device appears on a protected network segment.

Question 33

A review at Humongous Insurance finds a gap: the team cannot reliably an application or directory suddenly contains a new account with no request record. Which option best closes that gap? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Rogue device detection
2. Social-engineering indicator
3. New-account anomaly
4. Malicious or abnormal process behavior
5. Unexpected-port activity

Correct answer: C

Why: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. It directly fits this scenario because the requirement is to an application or directory suddenly contains a new account with no request record.

Option review:

A: A newly observed, unauthorized device may bypass inventory, policy, and monitoring controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

B: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

C: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. It directly fits this scenario because the requirement is to an application or directory suddenly contains a new account with no request record.

D: Unexpected process names, paths, parents, privileges, or network behavior can reveal malware or process injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

E: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an application or directory suddenly contains a new account with no request record.

Learning point: Use New-account anomaly when the key requirement is to an application or directory suddenly contains a new account with no request record.

Question 34

a SOC analyst at Contoso Health is comparing several approaches. The deciding requirement is to an internal application begins making outbound connections not present in its baseline. Which option should be chosen? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Unexpected outbound application communication
2. Irregular peer-to-peer communication
3. Unexpected-port activity
4. Data exfiltration indicator
5. Social-engineering indicator

Correct answer: A

Why: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. It directly fits this scenario because the requirement is to an internal application begins making outbound connections not present in its baseline.

Option review:

A: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. It directly fits this scenario because the requirement is to an internal application begins making outbound connections not present in its baseline.

B: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

C: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

D: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

E: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to an internal application begins making outbound connections not present in its baseline.

Learning point: Use Unexpected outbound application communication when the key requirement is to an internal application begins making outbound connections not present in its baseline.

Question 35

While supporting an airline operations network, a security operations engineer is asked to a business service becomes unavailable during suspicious network activity. Which concept or tool is the clearest match? The team wants the most defensible analyst action before expanding the investigation.

1. Resource-consumption anomaly
2. Application-log anomaly
3. Service interruption
4. Unauthorized scheduled task
5. Obfuscated-link indicator

Correct answer: C

Why: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity.

Option review:

A: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

B: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

C: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. It directly fits this scenario because the requirement is to a business service becomes unavailable during suspicious network activity.

D: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

E: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a business service becomes unavailable during suspicious network activity.

Learning point: Use Service interruption when the key requirement is to a business service becomes unavailable during suspicious network activity.

Question 36

A new security procedure at Lucerne Publishing must enable analysts to the investigation requires evidence about application-specific errors and request behavior. Which option is the BEST choice? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Unauthorized software
2. Resource-consumption anomaly
3. Application-log anomaly
4. Irregular peer-to-peer communication
5. New-account anomaly

Correct answer: C

Why: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. It directly fits this scenario because the requirement is to the investigation requires evidence about application-specific errors and request behavior.

Option review:

A: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

B: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

C: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. It directly fits this scenario because the requirement is to the investigation requires evidence about application-specific errors and request behavior.

D: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

E: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to the investigation requires evidence about application-specific errors and request behavior.

Learning point: Use Application-log anomaly when the key requirement is to the investigation requires evidence about application-specific errors and request behavior.

Question 37

The primary objective for Fabrikam Finance is to a user receives an urgent request designed to bypass normal verification. Which selection best satisfies that objective in an online banking environment? Assume the activity is authorized and must follow normal enterprise change control.

1. Unauthorized scheduled task
2. Beaconing
3. Social-engineering indicator
4. Unusual traffic spike
5. Service interruption

Correct answer: C

Why: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. It directly fits this scenario because the requirement is to a user receives an urgent request designed to bypass normal verification.

Option review:

A: Unexpected scheduled jobs are a common persistence mechanism and should be validated against change records and known software. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a user receives an urgent request designed to bypass normal verification.

B: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a user receives an urgent request designed to bypass normal verification.

C: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. It directly fits this scenario because the requirement is to a user receives an urgent request designed to bypass normal verification.

D: A sudden unexplained traffic increase may reflect exfiltration, denial of service, malware propagation, or a legitimate workload change. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a user receives an urgent request designed to bypass normal verification.

E: Unexpected loss of availability may indicate denial of service, destructive activity, misconfiguration, or system failure. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a user receives an urgent request designed to bypass normal verification.

Learning point: Use Social-engineering indicator when the key requirement is to a user receives an urgent request designed to bypass normal verification.

Question 38

At City Power Utilities, the response plan has three distinct requirements: a message contains a shortened or encoded link whose true destination is hidden; a server communicates on ports not documented for its application role; and a host sends a large archive to an external destination it has never contacted. Which THREE options should be selected? Assume no additional product-specific features are available beyond the concepts listed.

1. Unexpected outbound application communication
2. Obfuscated-link indicator
3. Application-log anomaly
4. Unexpected-port activity
5. Data exfiltration indicator

Correct answers: B, D, E

Why: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. It directly fits this scenario because the requirement is to a message contains a shortened or encoded link whose true destination is hidden. Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. It directly fits this scenario because the requirement is to a server communicates on ports not documented for its application role. Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. It directly fits this scenario because the requirement is to a host sends a large archive to an external destination it has never contacted.

Option review:

A: Applications contacting unknown external services can indicate compromise, telemetry misuse, or hidden dependencies. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a message contains a shortened or encoded link whose true destination is hidden; a server communicates on ports not documented for its application role; a host sends a large archive to an external destination it has never contacted.

B: Encoded, shortened, or visually deceptive links can conceal a malicious destination and require careful expansion and reputation checks. It directly fits this scenario because the requirement is to a message contains a shortened or encoded link whose true destination is hidden.

C: Application logs can expose failed authentication, unusual errors, injection attempts, or access patterns that other telemetry misses. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to a message contains a shortened or encoded link whose true destination is hidden; a server communicates on ports not documented for its application role; a host sends a large archive to an external destination it has never contacted.

D: Traffic on a port inconsistent with the asset role can signal tunneling, unauthorized services, or attacker tooling. It directly fits this scenario because the requirement is to a server communicates on ports not documented for its application role.

E: Unusual outbound data volume, destinations, protocols, or staging activity can signal unauthorized data transfer. It directly fits this scenario because the requirement is to a host sends a large archive to an external destination it has never contacted.

Learning point: Use Obfuscated-link indicator, Unexpected-port activity, Data exfiltration indicator when the key requirement is to a message contains a shortened or encoded link whose true destination is hidden; a server communicates on ports not documented for its application role; a host sends a large archive to an external destination it has never contacted.

Question 39

For a newly acquired subsidiary, the team must accomplish both of these goals: repeated outbound connections occur at nearly fixed intervals, and a protected host shows configuration changes with no change ticket. Which TWO choices together provide the best match? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Unauthorized configuration change
2. Irregular peer-to-peer communication
3. Unauthorized privilege change
4. New-account anomaly
5. Beaconing

Correct answers: A, E

Why: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket. Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals.

Option review:

A: Unapproved system, file, or registry changes may indicate persistence, defense evasion, or policy bypass. It directly fits this scenario because the requirement is to a protected host shows configuration changes with no change ticket.

B: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

C: New or elevated privileges without business justification can indicate account compromise or privilege escalation. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

D: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

E: Beaconing is periodic outbound communication that can indicate malware checking in with command-and-control infrastructure. It directly fits this scenario because the requirement is to repeated outbound connections occur at nearly fixed intervals.

Learning point: Use Beaconing, Unauthorized configuration change when the key requirement is to repeated outbound connections occur at nearly fixed intervals; a protected host shows configuration changes with no change ticket.

Question 40

At Northwind Traders, the response plan has three distinct requirements: workstations begin communicating directly with many peers outside the expected client-server pattern; an endpoint inventory shows an unapproved remote-access or utility package; and an application or directory suddenly contains a new account with no request record. Which THREE options should be selected? Base the decision on the primary security requirement, not on implementation convenience.

1. Irregular peer-to-peer communication
2. Resource-consumption anomaly
3. New-account anomaly
4. Unauthorized software
5. Social-engineering indicator

Correct answers: A, C, D

Why: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern. Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. It directly fits this scenario because the requirement is to an application or directory suddenly contains a new account with no request record. Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. It directly fits this scenario because the requirement is to an endpoint inventory shows an unapproved remote-access or utility package.

Option review:

A: Unexpected peer-to-peer connections between endpoints can indicate unauthorized tools, lateral movement, or covert transfer. It directly fits this scenario because the requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern.

B: Abnormal CPU, memory, or storage use can indicate malicious processes, cryptomining, runaway activity, or data staging. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern; an endpoint inventory shows an unapproved remote-access or utility package; an application or directory suddenly contains a new account with no request record.

C: Unexpected accounts, especially privileged or service accounts, can indicate persistence or unauthorized access. It directly fits this scenario because the requirement is to an application or directory suddenly contains a new account with no request record.

D: Software that is not approved can introduce vulnerabilities, remote access, policy violations, or malicious functionality. It directly fits this scenario because the requirement is to an endpoint inventory shows an unapproved remote-access or utility package.

E: Unexpected requests for credentials, payments, secrets, or urgent actions often indicate phishing, impersonation, or related social engineering. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to workstations begin communicating directly with many peers outside the expected client-server pattern; an endpoint inventory shows an unapproved remote-access or utility package; an application or directory suddenly contains a new account with no request record.

Learning point: Use Irregular peer-to-peer communication, Unauthorized software, New-account anomaly when the key requirement is to workstations begin communicating directly with many peers outside the expected client-server pattern; an endpoint inventory shows an unapproved remote-access or utility package; an application or directory suddenly contains a new account with no request record.