CS0-003 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  DNS query logs

  Why it's wrong here

  DNS query logs are the wrong choice because they record only hostname-to-IP resolution, not the authentication or connection attempts that occur during pass-the-hash. Even when an attacker uses SMB or other network protocols to move laterally, they often already know the target's IP or use a tool that issues no unique DNS requests, so these logs provide no visibility into the hash-based authentication handshake itself.

• ✓

  Sysmon Event ID 3 (network connection)

  Why this is correct

  Sysmon Event ID 3 is the correct choice because it records every inbound and outbound TCP/UDP connection with source/destination IP and port, giving a direct network trace of lateral movement. In pass-the-hash, an attacker typically connects from one compromised host to many others on SMB port 445 (or RPC ports) to access admin shares and execute remote code; a single host rapidly spamming connections to many distinct internal IPs on port 445 is a strong indicator. Additionally, Event 3 includes the initiating process, so an analyst can link a suspicious process like a Mimikatz-injected one directly to the anomalous traffic.

• ✓

  Domain controller authentication logs

  Why this is correct

  Domain controller authentication logs are correct because a DC is the central point for NTLM authentication across the domain, and pass-the-hash relies on presenting an NTLM hash during network authentication. When an attacker uses a stolen hash to authenticate to a remote service, the DC logs a successful NTLM logon (often Event ID 4776 or a network logon) from a source IP that may be atypical for the account. This gives the analyst a server-side view of hash use that cannot be spoofed by host-based artifacts, making it indispensable for detecting PtH across multiple endpoints.

• ✗

  Sysmon Event ID 1 (process creation)

  Why it's wrong here

  Sysmon Event ID 1, process creation, is the wrong choice because it logs the creation of processes and their command lines, not the network authentication protocol that pass-the-hash actually abuses. An attacker can perform PtH with legitimate system tools (e.g., net use, PowerShell) that do not spawn a distinctive process, and the malicious tool may run purely in memory or be injected into an existing trusted process. While unusual process names can be a supplementary indicator, the absence or presence of such processes doesn't directly reflect the hash-based SMB/NTLM authentication, which is the core of the technique.

• ✓

  Windows Security Event Log (Event ID 4624)

  Why this is correct

  Windows Security Event Log (Event ID 4624) is correct because it logs successful logon events, including the logon type, source IP, and account name, on both member servers and workstations. In a pass-the-hash attack, an attacker authenticating with a hash over the network triggers a logon type 3 (network) from a source host that is unusual for that user or account, often a member server or a non-domain administrative account. This event provides the user-to-source-IP correlation on the specific target machine, which, unlike DC logs, shows the lateral movement on the destination host itself and helps pinpoint which systems were actually accessed.

Go deeper

Related to this question