The answer is to decode the command and inspect the process tree, parent document, and network destination. This is correct because a PowerShell encoded command from winword.exe is a classic indicator of a macro-enabled phishing attack, where the encoded string hides the attacker’s payload from initial detection. Decoding it reveals the specific script logic, while examining the process tree confirms the execution chain from winword.exe to powershell.exe, and the parent document identifies the malicious attachment. On the CompTIA CySA+ CS0-003 exam, this scenario tests your ability to perform alert triage by correlating process ancestry with network artifacts, a common trap being to jump to blocking the IP without first understanding the infection vector. Remember the mnemonic “Decode, Tree, Doc, Net” to recall the four-part pivot: decode the command, inspect the process tree, examine the parent document, and analyze the network destination.
CS0-003 Security Operations Practice Question
This CS0-003 practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: encoded PowerShell is a common evasion technique for malicious scripts.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the alert triage phase, Which action gives the analyst the clearest next triage step?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Decode the command and inspect the process tree, parent document, and network destination
Option B is correct because decoding the encoded PowerShell command reveals the attacker's intent, inspecting the process tree shows the execution chain from winword.exe to powershell.exe, examining the parent document identifies the malicious attachment, and analyzing the network destination uncovers the C2 server. This systematic approach provides the clearest next triage step by correlating the initial infection vector with the subsequent malicious activity, enabling the analyst to contain the threat effectively.
Key principle: Encoded PowerShell is a common evasion technique for malicious scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Disable the SIEM parser for PowerShell events
Why it's wrong here
Disabling telemetry removes visibility during an active investigation.
✓
Decode the command and inspect the process tree, parent document, and network destination
Why this is correct
Encoded PowerShell launched by Office is a high-signal chain; decoding and process-tree review confirms intent and scope.
Clue confirmation
The clue words "best", "first" in the question point toward this answer.
Related concept
Encoded PowerShell is a common evasion technique for malicious scripts.
✗
Reimage every workstation in the department
Why it's wrong here
Reimaging without scoping may be excessive and could destroy useful evidence.
✗
Close the alert because HTTPS is expected traffic
Why it's wrong here
HTTPS is normal, but the parent-child process chain is suspicious.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the candidate's ability to prioritize investigative actions over reactive or destructive measures, trapping those who choose to disable logging or perform mass reimaging instead of conducting a structured forensic analysis.
Detailed technical explanation
How to think about this question
PowerShell's -EncodedCommand parameter accepts Base64-encoded strings, which attackers use to obfuscate malicious scripts and evade simple signature-based detection. The process tree from winword.exe to powershell.exe indicates a classic macro-based attack, where the Word document contains VBA code that invokes PowerShell via COM or WMI. Outbound HTTPS traffic to an unknown IP or domain suggests the payload establishes a C2 channel, often using SSL/TLS to blend with legitimate traffic.
KKey Concepts to Remember
Encoded PowerShell is a common evasion technique for malicious scripts.
EDR provides rich process and network telemetry for incident analysis.
Process tree analysis reveals parent-child relationships and anomalous execution.
Decoding obfuscated commands is crucial for understanding attacker intent.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Encoded PowerShell is a common evasion technique for malicious scripts.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CS0-003 question in full detail.
Review encoded PowerShell is a common evasion technique for malicious scripts., then practise related CS0-003 questions on the same topic to reinforce the concept.
Security Operations — This question tests Security Operations — Encoded PowerShell is a common evasion technique for malicious scripts..
What is the correct answer to this question?
The correct answer is: Decode the command and inspect the process tree, parent document, and network destination — Option B is correct because decoding the encoded PowerShell command reveals the attacker's intent, inspecting the process tree shows the execution chain from winword.exe to powershell.exe, examining the parent document identifies the malicious attachment, and analyzing the network destination uncovers the C2 server. This systematic approach provides the clearest next triage step by correlating the initial infection vector with the subsequent malicious activity, enabling the analyst to contain the threat effectively.
What should I do if I get this CS0-003 question wrong?
Review encoded PowerShell is a common evasion technique for malicious scripts., then practise related CS0-003 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "best", "first". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Encoded PowerShell is a common evasion technique for malicious scripts.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the containment trade-off phase, Which response balances containment with evidence preservation?
medium
A.Close the alert because HTTPS is expected traffic
B.Disable the SIEM parser for PowerShell events
✓ C.Decode the command and inspect the process tree, parent document, and network destination
D.Reimage every workstation in the department
Why C: Option C is correct because the encoded PowerShell command is the most direct artifact of the attacker's intent; decoding it reveals the executed payload, while inspecting the process tree confirms the parent-child relationship (winword.exe spawning powershell.exe), the parent document identifies the phishing vector, and the network destination pinpoints the C2 server. This triage provides the evidence needed for containment without destroying forensic data.
Variation 2. An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the detection engineering phase, Which detection or tuning approach would reduce noise without losing the signal?
medium
✓ A.Decode the command and inspect the process tree, parent document, and network destination
B.Disable the SIEM parser for PowerShell events
C.Reimage every workstation in the department
D.Close the alert because HTTPS is expected traffic
Why A: Option A is correct because the first analytic pivot in a suspected malware infection via phishing must decode the encoded PowerShell command to understand the attacker's intent, inspect the process tree to confirm parent-child relationships (winword.exe spawning powershell.exe), analyze the parent document for malicious macros or exploits, and examine the network destination to identify potential C2 infrastructure. This approach aligns with the Pyramid of Pain and ensures the analyst gathers actionable intelligence before any containment or tuning decisions.
Variation 3. An EDR alert shows powershell.exe launched by winword.exe with an encoded command line and outbound HTTPS shortly after a user opened an email attachment. What is the BEST first analytic pivot? In the root-cause analysis phase, Which finding would most directly explain the activity?
medium
A.Disable the SIEM parser for PowerShell events
B.Reimage every workstation in the department
C.Close the alert because HTTPS is expected traffic
✓ D.Decode the command and inspect the process tree, parent document, and network destination
Why D: Option D is correct because the encoded PowerShell command is the primary indicator of malicious intent; decoding it reveals the attacker's instructions. Inspecting the process tree (winword.exe spawning powershell.exe) confirms the infection vector (phishing attachment), and analyzing the parent document and network destination identifies the payload and C2 server. This sequence directly addresses root-cause analysis by tracing the attack from initial access to execution.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CS0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.