A security analyst is investigating a host that is suspected of being part of a botnet. The host is generating a large amount of outbound traffic to a variety of external IP addresses. The analyst also notices that the host has a new service running that is not part of any approved software. Which of the following is the BEST evidence that the host is part of a botnet?

The host has a new service running

The host is communicating with a known command-and-control (C2) server

The host is generating a large amount of outbound traffic

An analyst reviews a host's event logs and finds that a new application was installed without approval from the change management process. Which host issue does this represent?

Unauthorized software installation

An attacker sends an email to an employee that appears to be from the CEO, urgently requesting a wire transfer. Which type of social engineering attack is this?

Business email compromise (BEC)

CompTIACySA+

Domain 1Objective 2

Malicious Activity Indicators CS0-003 Practice Questions (Page 1)

Part of the Security operations domain, which accounts for 33% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~21–36 in this domain), expect 4–7 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

33%of the exam

Questions 1–5

1expert · hard
A security analyst is investigating a host that is suspected of being part of a botnet. The host is generating a large amount of outbound traffic to a variety of external IP addresses. The analyst also notices that the host has a new service running that is not part of any approved software. Which of the following is the BEST evidence that the host is part of a botnet?
Select an answer first
2foundation · easy
An analyst reviews a host's event logs and finds that a new application was installed without approval from the change management process. Which host issue does this represent?
Select an answer first
3foundation · easy
An attacker sends an email to an employee that appears to be from the CEO, urgently requesting a wire transfer. Which type of social engineering attack is this?
Select an answer first
4foundation · easy
An attacker calls an employee, pretending to be from the IT help desk, and asks for the employee's password to 'fix a problem'. Which social engineering technique is this?
Select an answer first
5application · easy
An employee in the finance department receives a phone call from someone claiming to be from the company's IT help desk. The caller states there is a critical issue with the employee's email account and asks for the employee's password to fix it immediately. Which of the following social engineering techniques is being used in this scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.

Malicious Activity Indicators CS0-003 Practice Questions (Page 1)

Questions 1–5

An analyst reviews a host's event logs and finds that a new application was installed without approval from the change management process. Which host issue does this represent?

An attacker sends an email to an employee that appears to be from the CEO, urgently requesting a wire transfer. Which type of social engineering attack is this?

An attacker calls an employee, pretending to be from the IT help desk, and asks for the employee's password to 'fix a problem'. Which social engineering technique is this?

Keep studying — Security operations