Pass Your CompTIA CS0-003 Exam Easy!

Privileged group drift can stem from faulty automation or abuse. That is relevant to endpoint controls and data paths, not to remove shared backup service credential.

A detection or quarantine alone does not establish successful execution. It would distinguish file detection from executed process, but it would not remove shared backup service credential.

Controls at the endpoint can enforce transfer restrictions before data leaves. It could help enforce removable-media data controls, but it would not remove shared backup service credential.

Exposure is an authorization problem requiring containment and attribution. It could help contain misconfigured public cloud storage, but it would not add cloud control-plane monitoring.

Narrow entitlements limit the impact of a compromised automation identity. That is relevant to cloud entitlement and control-plane coverage, not to add cloud control-plane monitoring.

Root activity is high-impact and cannot be accepted solely because MFA was present. It would triage abnormal cloud root API session, but it would not add cloud control-plane monitoring.

Zero trust should reassess device state rather than rely on a one-time grant. It could help continuously evaluate device trust, but it would not enforce high-assurance privileged authentication.

Limited elevation windows reduce persistent credential exposure. It would reduce standing administrator privilege, but it would not enforce high-assurance privileged authentication.

Valid authentication does not imply authorization for every target role. It could help distinguish federation authentication from role authorization, but it would not enforce high-assurance privileged authentication.

Disabling interactive sign-in may not cancel prior API credentials. That is relevant to alert identity enrichment and authentication gaps, not to distinguish posture denial from bad password.

Identity collisions undermine attribution and can cross authorization boundaries. It would correct SAML subject mapping collision, but it would not distinguish posture denial from bad password.

Identity enrichment makes cross-system activity attributable without conflating users. That is relevant to alert identity enrichment and authentication gaps, not to distinguish posture denial from bad password.

Ephemeral workloads need centrally retained logs beyond their short lifetime. It would observe short-lived serverless actions, but it would not link identities across cloud and data center.

External log persistence preserves evidence when containers are replaced. It could help preserve container telemetry across redeployments, but it would not link identities across cloud and data center.

Hypervisor hardening alone does not ensure guest operating-system integrity. That is relevant to cloud and on-prem telemetry boundaries, not to link identities across cloud and data center.

Ordered horizontal probing suggests enumeration and possible pivot preparation. That is relevant to honeypot and reconnaissance indicators, not to verify approved red-team scanning.

Decoy interaction can reveal attack behavior but must not introduce real access. It would analyze honeypot credential attack sequence, but it would not verify approved red-team scanning.

Reputation can become stale when infrastructure addresses are reassigned. It could help challenge stale indicator attribution, but it would not verify approved red-team scanning.

Living-off-the-land utilities can load unexpected content through valid binaries. That is relevant to suspicious windows process trees, not to correlate browser-to-LOLBin persistence.

Trusted parent processes can execute malicious libraries through unsafe search paths. It could help detect potential DLL sideloading, but it would not correlate browser-to-LOLBin persistence.

Office-to-shell ancestry is suspicious when followed by external communication. That is relevant to suspicious windows process trees, not to correlate browser-to-LOLBin persistence.

MFA one-time codes are authentication secrets that support fraudulent sign-ins. It would detect voice-based MFA social engineering, but it would not triage business email compromise lure.

Quishing hides a destination that still needs independent URL analysis. It could help investigate QR-code phishing, but it would not triage business email compromise lure.

Valid DKIM for a different domain does not establish aligned sender legitimacy. It would evaluate email domain alignment failure, but it would not triage business email compromise lure.

Fixed cadence plus suspicious process lineage can indicate automated command-and-control beaconing. It could help test regular TLS beaconing hypothesis, but it would not distinguish scheduled backup from theft.

Evasion-like retry behavior increases suspicion beyond one failed transfer. That is relevant to http exfiltration indicators, not to distinguish scheduled backup from theft.

Transfer volume and destination age become meaningful when tied to endpoint actions. It would investigate suspected web data exfiltration, but it would not distinguish scheduled backup from theft.

Performance anomalies may arise from authorized application changes. It would distinguish workload spike from suspicious process, but it would not triage executable memory injection.

Privileged driver execution can compromise host integrity beyond ordinary user code. It could help investigate suspicious kernel driver loading, but it would not triage executable memory injection.

Memory growth with process churn can signal malicious code or faulty services. That is relevant to memory pressure and execution indicators, not to triage executable memory injection.

Browser extensions can read sensitive web data when granted sweeping permissions. It would investigate unapproved broad-permission browser extension, but it would not distinguish image rollout change from distributed compromise.

Prevention events do not necessarily indicate successful payload launch. That is relevant to suspicious persistence across endpoints, not to distinguish image rollout change from distributed compromise.

Host-file tampering can redirect sensitive requests outside DNS controls. It would identify endpoint hosts-file redirection, but it would not distinguish image rollout change from distributed compromise.