NetFlow and Windows event excerpt: Host: WS-22 (10.20.5.18) 14:31 10.20.5.18 -> 10.20.5.41 TCP/445 14:32 10.20.5.18 -> 10.20.5.43 TCP/5985 14:32 10.20.5.18 -> 10.20.5.47 TCP/445 14:33 10.20.5.18 -> 10.20.5.52 TCP/5985 14:34 10.20.5.18 -> 10.20.5.61 TCP/445 Security log highlights: Event 4769 spike for user ACME\rlopez Event 7045: Service created on 10.20.5.43 named "PSEXESVC" Multiple hosts show remote logon type 3 from WS-22
Based on the exhibit, what is the MOST likely activity taking place on the network?
A user opened a spreadsheet shortly before unusual internal connection patterns began. The same account is now authenticating to many hosts in rapid succession.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A worm is flooding the network with broadcast traffic and exhausting bandwidth.
The logs show authenticated connections and remote service creation, not large broadcast storms or obvious denial-of-service behavior.
An attacker is performing lateral movement using stolen credentials and remote administration tools.
The mix of SMB, WinRM, remote logons, Kerberos activity, and PsExec service creation is consistent with movement from one compromised workstation to multiple internal hosts.
A malicious insider is exfiltrating data through a cloud sync application.
There is no evidence of bulk uploads, cloud synchronization, or outbound internet transfer in the provided logs.
A misconfigured printer is repeatedly scanning the subnet for available services.
A printer would not normally authenticate as a user account or create remote services on multiple hosts.
Common exam trap
Subnetting questions often tempt you into counting all addresses. In normal IPv4 subnets, the network and broadcast addresses are not usable host addresses.
Technical deep dive
Subnetting questions test whether you can identify the network, broadcast address, usable range, mask and correct subnet. Slow down enough to calculate the block size correctly.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
CIDR notation defines the prefix length.
The correct answer is: An attacker is performing lateral movement using stolen credentials and remote administration tools. — The exhibit shows a classic lateral movement pattern. The workstation authenticates to many internal systems over SMB and WinRM, the same user account generates a Kerberos spike, and a remote service named PSEXESVC appears on a target host. That combination strongly suggests an attacker has valid credentials or has captured a session and is using remote administration techniques to move across the environment. The behavior is much more than simple scanning and should be treated as compromise. Why others are wrong: A worm would typically generate broad, unauthenticated propagation patterns rather than a single account authenticating to multiple systems. Data exfiltration would usually produce noticeable outbound transfer activity to external destinations, which is absent here. A printer scan is not credible because the logs show authenticated remote access, Kerberos activity, and service creation that align with attacker tradecraft rather than normal device behavior.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.