hardMultiple Select
CS0-003 Practice Question: Which signals strengthen an alert for…
Which signals strengthen an alert for Kerberoasting activity? (Choose two.)
⚠ Common exam trap
The CS0-004 exam often tests the distinction between benign user actions (like wallpaper changes) and actual Kerberos-related attack indicators, trapping candidates who confuse general system changes with authentication-specific anomalies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unusual volume of TGS requests for many service principals
Kerberoasting involves requesting Ticket-Granting Service (TGS) tickets for service principals (SPNs) to crack their passwords offline. An unusual volume of TGS requests for many SPNs is a strong indicator because attackers typically enumerate SPNs and request tickets in bulk, which deviates from normal user behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Unusual volume of TGS requests for many service principals
Why this is correct
Kerberoasting relies on requesting Ticket Granting Service (TGS) tickets for Active Directory service accounts to crack their passwords offline. An unusual spike in TGS requests across multiple distinct Service Principal Names (SPNs) from a single user account is a strong indicator of an attacker scanning and harvesting tickets for offline brute-force attacks.
- ✓
Requests from a workstation that does not normally administer services
Why this is correct
When TGS requests originate from a standard workstation or non-administrative endpoint that has no historical pattern of interacting with those specific services, the anomaly score increases. This context suggests credential abuse or lateral movement, as legitimate service administration typically occurs from designated management hosts or jump boxes.
- ✗
A user changing their desktop wallpaper
Why it's wrong here
Modifying a desktop background is a routine, low-risk user customization action handled locally by the operating system's graphical user interface. It does not involve Active Directory authentication protocols, Ticket Granting Service requests, or any cryptographic operations associated with Kerberos ticket harvesting.
- ✗
Successful DHCP lease renewal
Why it's wrong here
A Dynamic Host Configuration Protocol (DHCP) lease renewal is a standard Layer 3 network administration event that occurs automatically as client leases expire. This broadcast-based IP assignment process is completely decoupled from the Kerberos authentication framework and does not indicate any form of credential harvesting or service ticket abuse.
Go deeper
Related to this question
Learn chapter
User and Entity Behaviour Analytics (UEBA)
Key term
Alert
An alert is a notification that something unusual or potentially harmful has happened in a computer system or network.
Key term
Kerberoasting
Kerberoasting is an attack where a hacker steals service account password hashes from Active Directory to crack them offline and gain unauthorized access.
About these practice questions
One of 701 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.