This CS0-003 practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: deception credentials are fake credentials designed to detect unauthorized access.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A deception credential placed in a file share is used to authenticate to a server. No legitimate user should know the credential. What does this most likely indicate? In the evidence source phase, Which evidence source best supports or refutes the detection?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Credential access or lateral movement activity that warrants high-priority investigation
The deception credential is a honeytoken—a fake credential placed in a file share to detect unauthorized use. Since no legitimate user should know it, any authentication attempt using it indicates an attacker has accessed the file share (credential access) and is attempting to move laterally (lateral movement). This warrants high-priority investigation because it directly signals a breach in progress.
Key principle: Deception credentials are fake credentials designed to detect unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The SIEM parser is always broken
Why it's wrong here
Parser issues are possible but should not be assumed for a high-fidelity canary hit.
✗
A scheduled password rotation completed successfully
Why it's wrong here
Rotation would not normally use a deception credential.
✓
Credential access or lateral movement activity that warrants high-priority investigation
Why this is correct
Use of a honey credential is a high-fidelity signal because legitimate workflows should not touch it.
Clue confirmation
The clue words "best", "most likely" in the question point toward this answer.
Related concept
Deception credentials are fake credentials designed to detect unauthorized access.
✗
The file share requires more storage capacity
Why it's wrong here
Storage capacity is unrelated to credential use.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between a detection artifact (like a honeytoken) and a configuration issue (like a broken parser), so candidates mistakenly attribute the alert to a technical failure rather than recognizing it as a deliberate security control triggering on malicious activity.
Detailed technical explanation
How to think about this question
Honeytokens are often implemented as service account credentials stored in SMB shares or Group Policy Objects (GPOs) with no legitimate use. When an attacker uses tools like Mimikatz or BloodHound to extract credentials from the file share, any subsequent Kerberos or NTLM authentication attempt with the honeytoken triggers an alert in the SIEM via Windows Event ID 4625 (failed logon) or 4624 (successful logon) with a specific account name. This technique is part of a deception-based detection strategy that relies on the principle that any use of the token is anomalous.
KKey Concepts to Remember
Deception credentials are fake credentials designed to detect unauthorized access.
Their use is a high-fidelity indicator of compromise (IOC).
Detection often signals credential access or lateral movement by an attacker.
Deception technology helps identify attackers who have bypassed perimeter defenses.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Deception credentials are fake credentials designed to detect unauthorized access.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Deception credentials are fake credentials designed to detect unauthorized access. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CS0-003 question in full detail.
Review deception credentials are fake credentials designed to detect unauthorized access., then practise related CS0-003 questions on the same topic to reinforce the concept.
Security Operations — This question tests Security Operations — Deception credentials are fake credentials designed to detect unauthorized access..
What is the correct answer to this question?
The correct answer is: Credential access or lateral movement activity that warrants high-priority investigation — The deception credential is a honeytoken—a fake credential placed in a file share to detect unauthorized use. Since no legitimate user should know it, any authentication attempt using it indicates an attacker has accessed the file share (credential access) and is attempting to move laterally (lateral movement). This warrants high-priority investigation because it directly signals a breach in progress.
What should I do if I get this CS0-003 question wrong?
Review deception credentials are fake credentials designed to detect unauthorized access., then practise related CS0-003 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "best", "most likely". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Deception credentials are fake credentials designed to detect unauthorized access.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CS0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.