CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Repeated failed logins to multiple hosts

  Why it's wrong here

  Repeated failed logins to multiple hosts may indicate brute-force attempts or password spraying, but they are pre-authentication failures, not evidence of an established lateral movement session. Once an attacker gains valid credentials, lateral movement often appears as successful logins or SMB connections rather than recurring failures, so this event is too noisy and ambiguous for a horizontal movement detection rule.

• ✗

  High volume of DNS queries

  Why it's wrong here

  A high volume of DNS queries is typically associated with malware beaconing, domain generation algorithms, or reconnaissance, yet it does not involve the SMB protocol (ports 445/139) that Windows lateral movement relies on for file shares, named pipes, and remote administration. Lateral movement between workstations leverages direct authenticated SMB sessions, whereas DNS is a separate name-resolution service; correlating DNS volume alone would generate many false positives from legitimate internet activity.

• ✓

  SMB traffic between workstations

  Why this is correct

  SMB traffic between workstations is a strong lateral movement indicator because in a well-managed environment, peer-to-peer file sharing or remote administration between endpoints is uncommon; most SMB flows are client-to-server (e.g., accessing a domain controller or file server). Attackers commonly use tools like PsExec or WMIC that create SMB connections from one compromised workstation to another to copy malicious payloads, execute remote services, or access shared resources, making this traffic a precise behavioral signature for lateral spread.

• ✓

  SMB traffic to administrative shares (e.g., IPC$)

  Why this is correct

  SMB traffic to administrative shares such as IPC$, ADMIN$, or C$ is a recognized lateral movement technique because these hidden shares are designed for remote administration. Tools like PsExec, WMI, and other post-exploitation frameworks connect to IPC$ and named pipes (e.g., \pipe\svcctl) to launch services or execute commands on a remote host, while C$ and ADMIN$ provide full filesystem access. Such connections from an unexpected workstation strongly indicate an attacker actively moving laterally, as standard users rarely need to access these shares directly.

• ✗

  Unusual outbound connections on port 443

  Why it's wrong here

  Unusual outbound connections on port 443 are typically HTTPS web traffic and do not represent the native SMB protocol used in lateral movement. While an attacker could tunnel SMB over port 443 (e.g., via SOCKS proxies or port forwarding), standard SMB lateral movement occurs on ports 445/139, and monitoring for admin share access or SMB peer traffic is much more direct. Outbound 443 anomalies are more often associated with command-and-control communication or data exfiltration rather than a moving between hosts via Windows file services.

Go deeper

Related to this question