CySA+ (CS0-003). Set it up and run it.

1. The authentication log shows: 03:11:04 4625 svc_backup DC01 0xC000006A | 03:11:04 4625 jmorris DC01 0xC000006A | 03:11:05 4625 rpatel DC01 0xC000006A | 03:11:06 4625 tokafor DC01 0xC000006A. The pattern continues through 480 distinct accounts, one failure each, then stops for an hour and repeats. What does this MOST likely indicate?

• A. A password spraying attack pacing itself to avoid account lockout
• B. A brute-force attack against the svc_backup service account
• C. A misconfigured application replaying one stale cached credential
• D. Kerberoasting against service principal names in the domain

Correct answer: A. A single failed logon per account across hundreds of accounts, repeated on a timed interval, is the signature of password spraying: the attacker tries one common password against the whole user list slowly enough to stay under the lockout threshold.

Why the others are wrong. B: A brute force concentrates many attempts on one account; here each account is tried exactly once before the tool moves on. C: A stale cached credential would fail repeatedly for the same one or two identities, not walk through 480 different usernames in username order. D: Kerberoasting requests service tickets and cracks them offline, so it produces 4769 ticket requests rather than a wave of 4625 logon failures.

2. A steering group asks why the vulnerability team insists on credentialed scanning of servers when uncredentialed scanning is simpler to arrange. Which two statements are the strongest technical justifications? (Choose two.)

• A. It detects missing patches in operating system and third-party client software that never expose a network service
• B. It removes the need for an accurate asset inventory because authenticated hosts identify themselves
• C. It reads installed package and registry data directly, so findings do not depend on inferring versions from banners
• D. It guarantees the scan cannot disrupt fragile hosts because authenticated checks send no network traffic
• E. It replaces the need for web application scanning because credentials cover application layer testing

Correct answer: A. Credentialed scanning reads local state directly, which both reveals the local and client-side findings a network view cannot see and removes the guesswork that produces version-inference false positives.

Why the others are wrong. B: Authentication tells the scanner about hosts it already reaches; it does nothing to discover assets nobody knew existed. D: Credentialed checks still open network sessions, and authentication is no protection against disrupting a fragile device. E: Operating system credentials do not drive an application crawler or test application logic.

3. A workstation generates: 4624 | Account: dmorales | Logon Type: 3 | Authentication Package: NTLM | Source Network Address: 10.20.5.66 | Workstation Name: FIN-WS-14. The account is a helpdesk administrator and 10.20.5.66 is another user workstation, not a server. Why is this event worth investigating?

• A. Logon type 3 means an interactive console logon, so someone was physically at the machine
• B. NTLM in the authentication package field always means the credential was stolen
• C. An administrative account authenticated over the network from one workstation to another, which fits lateral movement
• D. The workstation name field being populated proves the source address was spoofed

Correct answer: C. Logon type 3 is a network logon, so an administrative credential was used to authenticate from one workstation to another over the network. Workstation-to-workstation admin authentication is a classic lateral movement pattern and is rarely legitimate helpdesk behaviour.

Why the others are wrong. A: Logon type 2 is the interactive console logon; type 3 is a network logon with no console session. B: NTLM is still used for many legitimate connections such as those made by IP address; it is a supporting detail here, not proof of theft. D: The workstation name is simply self-reported by the client and its presence says nothing about spoofing.

4. Two scans of the same 200-host server subnet finish an hour apart. The first, run without credentials, reports 412 findings. The second, run with a domain account in the local Administrators group, reports 3,180 findings, most of them missing operating system and third-party application patches. Which statement BEST explains the difference?

• A. The credentialed scan authenticated to each host and read installed software and patch state directly
• B. The non-credentialed scan was blocked by the host firewall, so almost all of its checks failed silently
• C. The credentialed scan used a more recent plugin feed, so it carried thousands of checks the earlier run lacked
• D. The credentialed scan counted each affected file on the host as a separate finding, inflating the reported total

Correct answer: A. A non-credentialed scan can only infer state from what the host exposes on the network, so patch level is guessed from banners and behaviour. A credentialed scan logs in and reads the installed package and registry data directly, which surfaces the large body of client-side and local patch findings that the network view never sees.

Why the others are wrong. B: A host firewall would have suppressed the network findings too, yet the uncredentialed scan still returned 412 of them, so reachability was not the limiting factor. C: Both scans ran an hour apart from the same scanner, and a feed difference would not selectively add thousands of local patch checks. D: Scanners report one finding per vulnerable component or missing patch, not one per file, so the increase reflects genuinely new detections.

5. During an intrusion into ACME Freight, responders reconstruct the following: 02:11 the svc_backup account authenticates to 12 hosts in 90 seconds using the same NTLM hash | 02:14 psexesvc.exe is created on four of them | 02:31 a 7-Zip archive named q3.7z is written to C:\Windows\Temp on the file server FS-04. Which Cyber Kill Chain phase does the 02:31 activity BEST represent?

• A. Actions on Objectives
• B. Installation
• C. Lateral Movement
• D. Exploitation

Correct answer: A. Collecting and staging the victim's data for removal is work performed on the objective itself. In the Lockheed Martin kill chain everything the adversary does once it has hands on keyboard inside the environment - collection, staging, exfiltration, destruction - falls under Actions on Objectives.

Why the others are wrong. B: Installation covers placing a backdoor or persistence mechanism so access survives; archiving business data is the goal, not the foothold. C: Lateral movement is a phase of the ATT&CK model and of the Unified Kill Chain, but it is not one of the seven Lockheed Martin kill chain phases. D: Exploitation is the moment code runs against a vulnerability or a user action on the target; by 02:31 the adversary already has execution and is harvesting data.

6. Event 4648 (a logon was attempted using explicit credentials) appears on a finance workstation: Subject Account: bhalvorsen | Account Whose Credentials Were Used: da_admin | Target Server: DC02 | Process: C:\Windows\System32\cmd.exe. What is the MOST likely interpretation?

• A. The da_admin account logged on interactively to the finance workstation
• B. A standard user session explicitly supplied domain administrator credentials to reach a domain controller
• C. The workstation cached the da_admin password hash for offline use
• D. A Kerberos ticket was renewed automatically for the bhalvorsen session

Correct answer: B. Event 4648 records a user supplying a different set of credentials than the ones they logged on with. A standard user launching cmd.exe with domain admin credentials against a domain controller is the signature of runas-style credential use for privilege escalation or lateral movement.

Why the others are wrong. A: An interactive logon by da_admin would be recorded as a 4624 with logon type 2 for that account, not a 4648 raised under bhalvorsen's session. C: Event 4648 records a runtime credential use; it says nothing about what was written to the credential cache. D: Automatic ticket renewal happens transparently and does not generate 4648, which requires an explicit alternate credential.

7. A weekly credentialed scan of the Linux estate returns a clean report: 60 hosts, zero findings. The scan log contains repeated entries of the form: host 10.20.4.17 | plugin: SSH login | result: Authentication failure - invalid credentials | local checks: not performed. What does this result indicate?

• A. The Linux hosts are genuinely fully patched, which is why the report contains no findings at all
• B. The scanner's plugin feed contains no Linux content, so the checks had nothing to evaluate on those hosts
• C. The credentials failed, local checks never ran, and the clean report is meaningless until the scan is repeated
• D. The hosts sit behind a firewall that dropped the scan traffic before it ever reached them

Correct answer: C. The scanner could reach the hosts but could not log in, so every local check was skipped. The empty finding list is an artefact of failed authentication, not evidence that the hosts are patched, and it is the most dangerous failure mode in vulnerability management because it looks like success.

Why the others are wrong. A: The log explicitly records that local checks were not performed, so the scan never evaluated patch state at all. B: The scanner clearly attempted an SSH login plugin against Linux hosts, so Linux content is present; the login itself failed. D: An authentication failure message proves the SSH service was reached and responded, so the traffic was not dropped.

8. An EDR alert on WKS-2210 shows: parent explorer.exe / child rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump 704 C:\Users\Public\out.bin full, followed by a handle open to lsass.exe with 0x1010 access. Which ATT&CK technique does this BEST map to?

• A. T1055 Process Injection
• B. T1218.011 System Binary Proxy Execution: Rundll32
• C. T1003.001 OS Credential Dumping: LSASS Memory
• D. T1552 Unsecured Credentials

Correct answer: C. Writing the memory of the Local Security Authority Subsystem Service to a file so credential material can be parsed offline is OS Credential Dumping: LSASS Memory (T1003.001), regardless of which signed binary is used to take the dump.

Why the others are wrong. A: Nothing here writes code into another process; rundll32 opens a handle to read memory out, which is dumping rather than injection. B: Rundll32 is indeed the proxy binary in use, but the sub-technique describes only how execution was proxied and misses the credential theft that is the point of the activity. D: Unsecured Credentials covers finding secrets already lying in files, registry keys or scripts, not extracting them from a running process's memory.