CS0-004 - Security Operations - Section 1.2

Given a scenario, analyze indicators of potential malicious activity.

Interpret network, host, application, and identity indicators - unusual traffic, suspicious processes, anomalous authentication, beaconing, and social-engineering artefacts - to judge whether observed activity is malicious. Correlate indicators across sources to distinguish a true positive from a false positive, and decide what the evidence in front of the analyst does and does not establish.

indicators of compromisenetwork vs host indicatorsbeaconing and C2true positive vs false positiveauthentication anomalies

Practice question for this objective

Free sampleSecurity Operationshard

An analyst is documenting the difference between a network indicator and a host-based indicator of compromise. Which item is best classified as a host-based indicator?

ARepeated outbound connections to a single external address at fixed intervals across many hours
BA DNS query for a domain generated by a known domain-generation algorithm pattern
CA run key added under the registry that relaunches an unsigned binary each time the workstation reboots Correct
DA spike in TLS sessions to a certificate with a mismatched common name field

Distinguish host-based indicators, observed on the endpoint, from network indicators, observed in traffic. Host-based indicators are artefacts found by examining the endpoint, such as registry persistence, file hashes, and processes, whereas anything read from packets or flows is a network indicator regardless of what created it.

Why A is wrong: Regular timed outbound connections are a classic beaconing pattern, but they are observed on the wire, making this a network indicator rather than a host one.

Why B is wrong: DNS queries are attractive because malware runs them on the host, yet the query itself is seen in network traffic, so it is a network indicator.

Why C is correct: A registry persistence entry lives on the endpoint itself and is observed by examining the host, which is the defining trait of a host-based indicator.

Why D is wrong: A suspicious certificate feels endpoint-adjacent, but it is captured by inspecting session traffic, which places it firmly among network indicators.

See more CS0-004 practice questions, answers explained.

More in this domain

Back to all Security Operations objectives, or the CS0-004 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.