CS0-004 - Security Operations (34% of the exam) - Section 1.3

Given a scenario, use tools to determine malicious activity.

Select and interpret the right analysis tool for the evidence: packet analysers, SIEM queries, endpoint and log analysis utilities, sandboxing, and file/hash reputation. Understand what each tool can prove - full session content from packet capture, correlation from a SIEM, execution behaviour from a sandbox - and read tool output such as log excerpts, hashes and command lines to reach a supported conclusion.

SIEM correlationpacket capture and protocol analysisendpoint and log analysis toolssandboxing and detonationfile and hash reputation

Practice question for this objective

Free sampleSecurity Operationshard

A detonation sandbox returns a report for an emailed invoice.docm. The behaviour summary lists: spawns powershell.exe with an encoded command, writes %APPDATA%\svc\upd.exe, creates a Run key for that path, and queries api.ipify.org. VirusTotal shows the file hash at 2 of 72 engines. An analyst must decide how to weight this before responding. Which conclusion is best supported?

processes: winword.exe -> powershell.exe -enc <base64>
filesystem: write %APPDATA%\svc\upd.exe
registry: HKCU\...\Run\svc = %APPDATA%\svc\upd.exe

AThe low 2/72 detection ratio outweighs the behaviour, so the file should be treated as likely benign pending more engine coverage.
BThe query to api.ipify.org confirms active data exfiltration to an attacker server, which is the single finding that determines the verdict.
CThe observed macro-spawned encoded PowerShell, dropped executable and Run-key persistence are strong behavioural indicators of malware regardless of the low hash reputation, and the sample should be treated as malicious. Correct
DBecause only 2 engines flagged the hash, the sandbox result is probably a detonation artefact and the document should be released to the user.

Weight direct sandbox behavioural evidence above hash reputation, which lags for novel or targeted samples. File and hash reputation is a lagging signal that stays low for new or narrowly distributed malware, whereas a detonation report showing macro-launched encoded PowerShell, an executable drop and a Run-key gives observed, attack-consistent behaviour; the behaviour is the stronger evidence and drives the malicious verdict.

Why A is wrong: Tempting because a low hit count feels reassuring, but reputation lags for fresh or targeted samples and cannot override concrete malicious behaviour already observed in the sandbox.

Why B is wrong: Tempting because an external callout looks like exfiltration, but ipify only returns the host's public IP and is used benignly too, so it is weak evidence compared with the persistence and drop behaviour.

Why C is correct: Correct: dynamic behaviour showing execution, payload drop and persistence is direct evidence of malicious intent, and a low VirusTotal ratio is expected for novel samples and does not diminish it.

Why D is wrong: Tempting because sandboxes can produce noise, but macro-to-encoded-PowerShell with Run-key persistence is not incidental instrumentation, and releasing the file would deliver working malware.

See more CS0-004 practice questions, answers explained.

Exam traps in Security Operations

Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.

It guarantees a definitive verdict for every sample because sandboxes are immune to the evasion techniques that mislead reputation services.
Why it is wrong: Tempting because sandboxes are powerful, but wrong: malware routinely detects virtualisation or delays execution to evade sandboxes, so no guarantee exists.
A hash lookup inspects the runtime behaviour of the file, so a clean result reliably confirms the sample performs no malicious actions.
Why it is wrong: Tempting because analysts want behavioural assurance, but a hash lookup compares an identifier against known records and observes no behaviour, so it cannot confirm what a file does.
Static analysis runs the file at reduced privilege, while dynamic analysis runs the same file with full administrative rights to expose more behaviour.
Why it is wrong: Tempting because privilege affects what malware reveals, but both descriptions involve running the file, so this misses the core point that static analysis does not execute the sample at all.

More in this domain

Back to all Security Operations objectives, or the CS0-004 cert hub.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.