CS0-003 Security Operations Practice Question
A security analyst is creating a YARA rule to detect a specific malware strain that uses a unique string in its code section and has a characteristic import table. The analyst wants to minimize false positives. Which THREE YARA rule elements should the analyst include?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File size condition
Including file size limits, a specific string, and the import table condition reduces false positives by narrowing the scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
File size condition
Why this is correct
A file size condition in YARA, such as `filesize < 300KB`, is a fast, cheap filter that eliminates unrelated files before more expensive scanning takes place. Since many malware families produce samples with a consistent size range, imposing a size bound helps the rule avoid flagging innocuous files that happen to share other attributes. This increases precision and reduces the false-positive rate.
- ✓
PE import table condition
Why this is correct
The PE import table condition leverages the `pe` module to inspect the functions and libraries that an executable imports, for example using `pe.imports("kernel32.dll")` or checking for specific APIs. Because many malware families rely on the same set of Windows APIs, this condition can reliably identify the characteristic behavior of a threat. It is a powerful and appropriate condition when the target is a PE file with detectable import dependencies.
- ✗
Hash condition
Why it's wrong here
A hash condition (e.g., `hash.md5 == "d41d8cd98f00b204e9800998ecf8427e"`) matches exactly one artifact and fails as soon as any byte changes, including trivial repacking or recompilation. In a YARA rule for a malware family, relying on a hash provides no generalization to variants, so it is not a useful condition when the goal is to detect samples that differ slightly from the one on hand. This is why the hash condition is incorrect here.
- ✓
String condition containing the unique string
Why this is correct
A string condition uses a string declaration, such as `$a = "unique_malware_token"`, and then a condition like `$a` to require that the string appears in the file. Since the analyst knows a unique string that is present in the specimen, making it a condition directly targets the malware's identifying content. This is the most straightforward and accurate way to match the sample while avoiding unrelated files.
- ✗
Module condition (e.g., pe)
Why it's wrong here
A module in YARA, like `pe`, `elf`, or `hash`, is a collection of accessible data and functions, not a condition type per se. The label 'module condition' incorrectly suggests that including `import "pe"` or merely referencing the module satisfies the rule, whereas the actual condition must call specific module attributes such as `pe.entry_point` or `pe.sections`. Therefore, this option is wrong because it conflates module inclusion with the logical condition needed for a valid YARA rule.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Malware
Malware is any software intentionally designed to cause damage, disrupt operations, steal data, or gain unauthorized access to computer systems.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.