hardMultiple Choice
CS0-003 Portability Practice Question
A threat hunter wants a portable detection for suspicious rundll32 execution that can be converted for multiple SIEM platforms. Which artefact format best fits this goal?
⚠ Common exam trap
The CS0-004 exam often tests the distinction between detection artefacts (Sigma, YARA) and vulnerability scoring (CVSS), and the trap here is that candidates may confuse YARA's file-scanning capability with log-based SIEM detection, forgetting that YARA rules cannot be directly converted to SIEM queries without significant rework.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sigma rule
Sigma rules are the correct choice because they are designed as a generic, open-source signature format for log events, making them portable across multiple SIEM platforms (e.g., Splunk, Elastic, QRadar) without vendor lock-in. For suspicious rundll32 execution, a Sigma rule can describe the specific event log patterns (e.g., Event ID 4688 with CommandLine containing 'rundll32.exe') that can be converted into each SIEM's native query language. This portability directly meets the threat hunter's goal of creating a detection that can be reused across different environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CVSS vector string
Why it's wrong here
CVSS expresses vulnerability severity, not detection logic.
- ✓
Sigma rule
Why this is correct
Sigma is designed as a generic detection-rule format that can be translated into SIEM-specific queries.
- ✗
YARA rule
Why it's wrong here
YARA is stronger for file and memory pattern matching than cross-SIEM behavioural log detections.
- ✗
OpenIOC package only
Why it's wrong here
OpenIOC can describe indicators, but Sigma is more common for portable log detections.
Go deeper
Related to this question
Learn chapter
DNS Analysis and Anomaly Detection
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Event log
An event log is a file or record that stores a chronological list of events, changes, errors, or security incidents occurring on a computer system or network.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.