CS0-003 Security Operations Practice Question
An analyst reviews AWS CloudTrail logs and detects multiple 'CreateNetworkAclEntry' API calls from a user who does not typically perform network administration. What type of activity is this?
⚠ Common exam trap
The trap is labeling suspicious but non-destructive API calls as 'misconfiguration' or 'normal'; candidates must recognize that unusual administrative actions by a non-admin user indicate compromise and potential lateral movement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privilege escalation or lateral movement
Creating Network ACL entries is a network administration task. When a user who does not normally perform such actions makes multiple CreateNetworkAclEntry calls, it suggests the user's credentials may have been compromised and are being used to modify network access controls, potentially to enable lateral movement or privilege escalation. This is a classic indicator of compromise in cloud environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud misconfiguration
Why it's wrong here
While a cloud misconfiguration can introduce security vulnerabilities, it represents a static state of improper setup rather than an active sequence of anomalous user events. CloudTrail logs record API calls and active user behaviors, indicating that the detected activity is an active threat actor manipulating resources rather than a passive configuration error.
- ✓
Privilege escalation or lateral movement
Why this is correct
When a user account suddenly executes unauthorized API calls to alter network configurations or security groups, it strongly suggests an adversary is attempting privilege escalation or lateral movement. By modifying these boundaries, the attacker aims to establish broader access to sensitive cloud resources or bypass existing security controls.
- ✗
Normal administrative activity
Why it's wrong here
This behavior cannot be classified as normal administrative activity because it deviates significantly from the user's established historical baseline. In a secure cloud environment, administrative tasks are tightly scoped, and sudden, uncharacteristic modifications to critical infrastructure trigger high-severity alerts for anomalous behavior.
- ✗
Data exfiltration via NACL
Why it's wrong here
Network Access Control Lists (NACLs) are stateless, subnet-level firewalls designed to permit or deny traffic, not to package or transmit data. While an attacker might modify a NACL to permit outbound traffic, the NACL itself is not a mechanism for data exfiltration, which instead relies on protocols like DNS, HTTP, or SSH.
Visual reference
Go deeper
Related to this question
Learn chapter
User and Entity Behaviour Analytics (UEBA)
Key term
ACL
An Access Control List is a set of rules that determines who or what can access specific network resources or data.
Key term
CloudTrail
AWS CloudTrail is a service that records every action taken in your AWS account, creating a detailed log of who did what and when for security and auditing purposes.
About these practice questions
This CS0-004 question is part of Courseiva's 701-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.