easyMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A SOC analyst is investigating a potential…
A SOC analyst is investigating a potential lateral movement within the network. Which log source is most critical for detecting lateral movement using pass-the-hash or pass-the-ticket attacks?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication logs (e.g., Windows Event ID 4624)
Authentication logs, such as Windows Event ID 4624, are the most critical for detecting lateral movement via pass-the-hash or pass-the-ticket attacks because they record logon events across systems, revealing when an attacker uses stolen credentials to access other machines. Option B (antivirus logs) is less relevant as they focus on malware, not authentication patterns. Option C (DNS logs) shows name resolution but not authentication. Option D (firewall logs) indicate network flows but lack authentication context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication logs (e.g., Windows Event ID 4624)
Why this is correct
Authentication logs track logon events and can reveal anomalous access patterns.
- ✗
Antivirus logs
Why it's wrong here
Antivirus logs show malware but not lateral movement.
- ✗
DNS logs
Why it's wrong here
DNS logs show queries but not authentication.
- ✗
Firewall logs
Why it's wrong here
Firewall logs show network connections but not authentication details.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.