CS0-003 Security Operations Practice Question
A security analyst is creating a correlation rule in the SIEM to detect DGA (Domain Generation Algorithm) activity. Which of the following data points would be most useful to include in the rule?
⚠ Common exam trap
CS0-004 often tests whether candidates confuse network-layer DGA indicators (high-entropy DNS + NXDOMAIN) with host-layer injection indicators (parent-child process anomalies), so pick the answer tied to DNS behavior, not endpoint process trees.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
High number of DNS queries to domains with high entropy and frequent NXDOMAIN responses
DGA malware generates large volumes of pseudo-random domain names (e.g., 'aj3kf9x2qz.com') to locate its C2 server, and the vast majority of these domains are unregistered, producing NXDOMAIN responses. Correlating a high rate of DNS queries with high-entropy domain strings and a high NXDOMAIN ratio is the classic SIEM detection pattern for DGA beaconing. The other options describe behaviors that are either normal or unrelated to domain-generation activity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
High number of DNS queries to domains with high entropy and frequent NXDOMAIN responses
Why this is correct
Correct. DGA malware generates hundreds or thousands of pseudo-random candidate domains per day to locate its command-and-control server, so a rule watching for high-entropy hostnames paired with a burst of NXDOMAIN responses (since most generated domains are never registered) is the defining behavioral fingerprint of DGA activity.
- ✗
Multiple successful connections to a single external IP
Why it's wrong here
Repeated successful connections to one fixed external IP describe static beaconing to a hardcoded C2 address, which is essentially the opposite pattern of DGA malware, whose entire purpose is to avoid a single static indicator by algorithmically rotating through many domains.
- ✗
Large data transfers over HTTPS
Why it's wrong here
Large HTTPS data transfers are the hallmark of a data exfiltration stage, reflecting volume of outbound traffic rather than the domain resolution pattern that defines DGA; a correlation rule for DGA needs DNS query characteristics, not payload size metrics.
- ✗
Unusual parent-child process relationships
Why it's wrong here
Unusual parent-child process relationships, such as a Word process spawning PowerShell, are endpoint-based indicators of execution or living-off-the-land techniques observed via EDR telemetry, which is unrelated to the DNS-layer resolution behavior a DGA detection rule must analyze.
Go deeper
Related to this question
Learn chapter
Critical Windows Event IDs for Security
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
Key term
Correlation rule
A correlation rule is a set of conditions in a security information and event management (SIEM) system that combines multiple log events from different sources to detect complex threats or patterns that a single event would miss.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.