Pass Your CompTIA CS0-003 Exam Easy!

Known approved automation should not produce recurring unqualified high-severity exfiltration alerts. It would tune verified backup transfer false positive, but it would not contextualize business video traffic spike.

Distinct attribution and scope separate routine asset discovery from intrusions. It could help differentiate sanctioned SMB asset scan, but it would not contextualize business video traffic spike.

Periodic traffic alone cannot prove command-and-control activity. That is relevant to mixed benign and malicious traffic, not to contextualize business video traffic spike.

Abnormal bulk service-ticket requests may indicate offline password-cracking preparation. That is relevant to east-west lateral movement, not to identify WMI-based lateral execution.

Broad horizontal probing over SMB may precede lateral movement. It would distinguish SMB sweep from approved discovery, but it would not identify WMI-based lateral execution.

Unusual privilege reach and time can indicate compromised service credentials. It could help triage abnormal service account lateral reach, but it would not identify WMI-based lateral execution.

Privileged persistence in writable locations is high risk without authorization. That is relevant to linux compromise indicators, not to detect web application command execution.

Service-child behavior can indicate exploit-driven command execution or abused SSH sessions. It could help investigate anomalous sshd child shell, but it would not detect web application command execution.

Sustained compute consumption can reflect cryptojacking, but resource evidence needs attribution. That is relevant to linux compromise indicators, not to detect web application command execution.

Unapproved administrative principals can establish persistent privileged access. It would investigate rogue directory administrator creation, but it would not investigate scheduled outbound persistence.

Service identities should not generally acquire unsolicited interactive sessions. It could help triage interactive service-account misuse, but it would not investigate scheduled outbound persistence.

Source deviation is material even when the account's scheduled jobs are legitimate. It would identify reused maintenance credential, but it would not investigate scheduled outbound persistence.

Brief privileged grants can be abused even when quickly removed. It could help investigate temporary rogue privilege elevation, but it would not investigate unusual high-privilege OAuth consent.

Server-side mail rules can persist after credential theft and leak sensitive content. That is relevant to suspicious account behavior and persistence, not to investigate unusual high-privilege OAuth consent.

Unusual reset volume from one actor can indicate compromised delegated authority. It would triage mass password reset actions, but it would not investigate unusual high-privilege OAuth consent.

Certificate utilities can be abused to stage payloads outside normal installers. It would triage certutil download abuse, but it would not evaluate legitimate admin command enumeration.

Executing remote content without validation risks immediate host compromise. It could help investigate curl-to-shell execution, but it would not evaluate legitimate admin command enumeration.

Obfuscation plus unapproved network retrieval increases maliciousness suspicion. That is relevant to unusual command-line activity, not to evaluate legitimate admin command enumeration.

Quishing hides a destination that still needs independent URL analysis. It would investigate QR-code phishing, but it would not evaluate email domain alignment failure.

Sender authentication success does not confirm legitimate business instructions. That is relevant to email lure and impersonation, not to evaluate email domain alignment failure.

MFA one-time codes are authentication secrets that support fraudulent sign-ins. It would detect voice-based MFA social engineering, but it would not evaluate email domain alignment failure.

Server-side mail rules can persist after credential theft and leak sensitive content. It could help detect unauthorized email forwarding rule, but it would not triage mass password reset actions.

Brief privileged grants can be abused even when quickly removed. That is relevant to suspicious account behavior and persistence, not to triage mass password reset actions.

Admin consent can grant broad tenant access to a malicious app. It could help investigate unusual high-privilege OAuth consent, but it would not triage mass password reset actions.

Domain logon scripts can distribute malicious commands widely. That is relevant to registry and file tamper chain, not to identify suspicious event-log clearing.

Modified file-association handlers can execute attacker code during ordinary actions. It would detect file association hijack, but it would not identify suspicious event-log clearing.

Writable trusted tool paths can allow future binary replacement. It could help fix writable trusted executable path, but it would not identify suspicious event-log clearing.

Geographic velocity is suspicious but shared VPN exits can create false positives. It could help validate impossible-travel detection, but it would not triage missing privileged MFA challenge.

Breadth across users with low per-user volume is characteristic of spraying. That is relevant to authentication attack patterns, not to triage missing privileged MFA challenge.

IP rotation can disguise high-frequency credential guessing against one account. It would detect distributed-source account brute force, but it would not triage missing privileged MFA challenge.

Rapid answer churn may indicate resilient malicious hosting rather than routine CDN use. It could help evaluate suspicious fast-flux DNS, but it would not triage DNS tunneling pattern.

Repeated failed pseudo-random lookups are common to generated rendezvous attempts. It would test DGA-driven lookup hypothesis, but it would not triage DNS tunneling pattern.

Legitimate service discovery can use TXT records and must be distinguished by context. It could help validate benign TXT query spike, but it would not triage DNS tunneling pattern.