CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Firewall logs

  Why it's wrong here

  Firewall logs record permitted and denied traffic, including source/destination IP, ports, and protocols, but they do not capture the authentication method or the use of NTLM hashes. Since pass-the-hash operates as an authentication event beneath the IP layer, a firewall cannot observe the critical indicators such as hash-based logon attempts. Firewalls may show lateral movement traffic, but they cannot distinguish whether that traffic uses a legitimate credential or a stolen hash.

• ✓

  Authentication logs (e.g., Windows Event ID 4624)

  Why this is correct

  Authentication logs, specifically Windows Event ID 4624, are central to detecting pass-the-hash because they record successful and failed logon events, including the logon type, authentication package (e.g., NTLM), source workstation, and target account. In a PtH attack, an attacker uses an NTLM hash as if it were a password; the logon event will typically show a network logon (Type 3) using NTLM, often from a non-domain host or in conjunction with suspicious source IP addresses. Correlating these 4624 events with known user activity patterns can reveal an attacker authenticating with a hash from an unauthorized source.

• ✗

  DNS logs

  Why it's wrong here

  DNS logs reveal hostname resolution queries, which may indicate command-and-control or reconnaissance activity, but they provide no visibility into how a user or process was authenticated. A pass-the-hash attack does not require DNS queries that would differ from normal traffic, and the NTLM hash itself is never embedded in DNS. Thus, DNS logs are neither a primary nor a supporting source for detecting the authentication anomaly that defines PtH.

• ✓

  Endpoint process creation logs (e.g., Event ID 4688)

  Why this is correct

  Endpoint process creation logs, such as Event ID 4688, are a powerful detection source for pass-the-hash because they capture the command line and executable path for every process. PtH attacks frequently rely on tools like Mimikatz (e.g., sekurlsa::pth), Windows Credential Editor, or remote execution utilities such as PsExec, all of which generate distinctive process creation events. Correlation rules can trigger when a trusted process creates an account logon with given hash characteristics, or when known hacking tool executables and their command-line arguments appear on endpoints, revealing the attack as it executes rather than after the fact.

• ✗

  Vulnerability scan results

  Why it's wrong here

  Vulnerability scan results are a point-in-time snapshot of missing patches, misconfigurations, or weaknesses, but they do not capture ongoing authentication activity. Pass-the-hash exploits a fundamental flaw in NTLM authentication, not a specific vulnerability that a scan can flag on the fly; even fully patched systems can be compromised via PtH. While scan data can guide hardening (e.g., restricting NTLM), it cannot detect the actual on-the-wire or log-based evidence of a hash-based attack occurring.

Go deeper

Related to this question