CS0-004 - Security Operations (34% of the exam) - Section 1.2
Given a scenario, analyze indicators of potential malicious activity.
Interpret network, host, application, and identity indicators - unusual traffic, suspicious processes, anomalous authentication, beaconing, and social-engineering artefacts - to judge whether observed activity is malicious. Correlate indicators across sources to distinguish a true positive from a false positive, and decide what the evidence in front of the analyst does and does not establish.
indicators of compromisenetwork vs host indicatorsbeaconing and C2true positive vs false positiveauthentication anomalies
Practice question for this objective
lock_openFree sampleSecurity Operationshard
An analyst is documenting the difference between a network indicator and a host-based indicator of compromise. Which item is best classified as a host-based indicator?
ARepeated outbound connections to a single external address at fixed intervals across many hours
BA DNS query for a domain generated by a known domain-generation algorithm pattern
CA run key added under the registry that relaunches an unsigned binary each time the workstation rebootscheck_circle Correct
DA spike in TLS sessions to a certificate with a mismatched common name field
Distinguish host-based indicators, observed on the endpoint, from network indicators, observed in traffic. Host-based indicators are artefacts found by examining the endpoint, such as registry persistence, file hashes, and processes, whereas anything read from packets or flows is a network indicator regardless of what created it.
Why A is wrong: Regular timed outbound connections are a classic beaconing pattern, but they are observed on the wire, making this a network indicator rather than a host one.
Why B is wrong: DNS queries are attractive because malware runs them on the host, yet the query itself is seen in network traffic, so it is a network indicator.
Why C is correct: A registry persistence entry lives on the endpoint itself and is observed by examining the host, which is the defining trait of a host-based indicator.
Why D is wrong: A suspicious certificate feels endpoint-adjacent, but it is captured by inspecting session traffic, which places it firmly among network indicators.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.
A network indicator is always a confirmed true positive, whereas a host indicator still requires validation against baseline endpoint behaviour before it can be trusted.
errorWhy it is wrong: Tempting because network alerts feel authoritative, but both indicator types require validation and neither is inherently a confirmed true positive.
An indicator of compromise is derived from threat intelligence feeds, whereas an indicator of attack can only be produced by an internal red team exercise.
errorWhy it is wrong: Tempting because feeds do carry IoCs, but IoAs come from live behavioural detection, not solely red-team activity, so the sourcing claim is wrong.
A network indicator of command-and-control, because the process is preparing to beacon to an external controller.
errorWhy it is wrong: C2 is tempting since malware often calls out, but no connection has occurred; the observed artefacts are all local host changes, so labelling this a network indicator misreads the evidence present.