A network administrator is investigating a report of slow network performance. A review of the network monitoring logs shows a significant bandwidth spike originating from a single IP address on the internal network. The IP address is not in the company's DHCP scope and is not associated with any known device. Which of the following is the BEST initial step to address this issue?

Add the IP address to the firewall's block list

Ignore the traffic as it is likely a temporary network glitch

Locate the physical device by tracing the switch port associated with the IP address

Reboot the core switch to clear the network traffic

A security analyst is monitoring a web application and notices that the application is making unexpected outbound connections to a cloud service provider. The application's documentation states that it should only communicate with the company's internal database server. The analyst also notices that the application's response times have increased significantly. Which of the following is the MOST likely explanation for this behavior?

The application is using the cloud service for legitimate load balancing

The network is congested, causing the application to route traffic through the cloud service

The application has been compromised and is being used to exfiltrate data

The application is experiencing a memory leak that is causing it to make unintended network calls

A web application that normally communicates only with its database server suddenly begins sending requests to an unknown external IP address. Which type of application irregularity is this?

Unauthorized software installation

Unexpected communication pattern

A security analyst observes a host sending large volumes of internal files to an external IP address via encrypted channels. Which host issue is this most likely to indicate?

Unauthorized software installation

A security analyst is investigating a network anomaly. A server that is normally quiet is suddenly generating a large amount of outbound traffic to a single external IP address. The traffic is encrypted, so the analyst cannot see the contents. The server is not supposed to have any external communication. Which of the following is the BEST course of action for the analyst to take?

Reboot the server to stop the traffic

Block the external IP address at the firewall

Disconnect the server from the network and begin a forensic investigation

Ignore the traffic as it may be a legitimate application update

CompTIACySA+

Domain 1Objective 2

Malicious Activity Indicators CS0-003 Practice Questions (Page 2)

Part of the Security operations domain, which accounts for 33% of the CS0-003 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~21–36 in this domain), expect 4–7 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

33%of the exam

Questions 6–10

6application · medium
A network administrator is investigating a report of slow network performance. A review of the network monitoring logs shows a significant bandwidth spike originating from a single IP address on the internal network. The IP address is not in the company's DHCP scope and is not associated with any known device. Which of the following is the BEST initial step to address this issue?
Select an answer first
7expert · hard
A security analyst is monitoring a web application and notices that the application is making unexpected outbound connections to a cloud service provider. The application's documentation states that it should only communicate with the company's internal database server. The analyst also notices that the application's response times have increased significantly. Which of the following is the MOST likely explanation for this behavior?
Select an answer first
8foundation · easy
A web application that normally communicates only with its database server suddenly begins sending requests to an unknown external IP address. Which type of application irregularity is this?
Select an answer first
9foundation · easy
A security analyst observes a host sending large volumes of internal files to an external IP address via encrypted channels. Which host issue is this most likely to indicate?
Select an answer first
10expert · hard
A security analyst is investigating a network anomaly. A server that is normally quiet is suddenly generating a large amount of outbound traffic to a single external IP address. The traffic is encrypted, so the analyst cannot see the contents. The server is not supposed to have any external communication. Which of the following is the BEST course of action for the analyst to take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CS0-003

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CS0-003” is a trademark of its owner, used for identification only.

Malicious Activity Indicators CS0-003 Practice Questions (Page 2)

Questions 6–10

A web application that normally communicates only with its database server suddenly begins sending requests to an unknown external IP address. Which type of application irregularity is this?

A security analyst observes a host sending large volumes of internal files to an external IP address via encrypted channels. Which host issue is this most likely to indicate?

Keep studying — Security operations