SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
NetFlow and Windows event excerpt: Host: WS-22 (10.20.5.18) 14:31 10.20.5.18 -> 10.20.5.41 TCP/445 14:32 10.20.5.18 -> 10.20.5.43 TCP/5985 14:32 10.20.5.18 -> 10.20.5.47 TCP/445 14:33 10.20.5.18 -> 10.20.5.52 TCP/5985 14:34 10.20.5.18 -> 10.20.5.61 TCP/445 Security log highlights: Event 4769 spike for user ACME\rlopez Event 7045: Service created on 10.20.5.43 named "PSEXESVC" Multiple hosts show remote logon type 3 from WS-22
Based on the exhibit, what is the MOST likely activity taking place on the network?
A user opened a spreadsheet shortly before unusual internal connection patterns began. The same account is now authenticating to many hosts in rapid succession.
⚠ Common exam trap
A common mix-up: candidates confuse lateral movement with network scanning or data exfiltration; candidates often overlook that the same account authenticating to many hosts is a hallmark of credential-based lateral movement, not a misconfiguration or worm.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An attacker is performing lateral movement using stolen credentials and remote administration tools.
The exhibit shows a user opening a spreadsheet (likely a phishing vector) followed by rapid authentication attempts from the same account to many hosts. This pattern matches lateral movement using stolen credentials, where an attacker uses remote administration tools like PsExec, WinRM, or RDP to move across the network after initial compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A worm is flooding the network with broadcast traffic and exhausting bandwidth.
Why it's wrong here
The logs show authenticated SMB and WinRM sessions, Kerberos ticket requests, and the deliberate creation of remote services on multiple hosts. A self-propagating worm that is flooding the network with broadcast traffic would instead generate large volumes of broadcast/multicast packets or random connection attempts to arbitrary IPs, exhausting bandwidth without needing valid domain credentials. There is no indication of a bandwidth spike or denial-of-service behavior in the provided activity.
- ✓
An attacker is performing lateral movement using stolen credentials and remote administration tools.
Why this is correct
This pattern is classic lateral movement: an attacker who has already compromised a domain account (stolen credentials) uses those credentials to authenticate over SMB and WinRM to multiple internal hosts, request Kerberos tickets, and create remote services via PsExec. The sequence of short, authenticated logons from a single workstation to several other systems, combined with service creation, is a well-known technique for moving from one compromised host to others with administrative intent.
- ✗
A malicious insider is exfiltrating data through a cloud sync application.
Why it's wrong here
Data exfiltration through a cloud sync application would show large outbound transfers to known internet destinations or cloud provider IPs, frequent HTTPS sessions to a sync vendor, and use of application-layer protocols like WebDAV or proprietary sync APIs. The provided logs are entirely internal host-to-host traffic over SMB and WinRM, with no external connections, no bulk uploads, and no evidence of a user deliberately copying files to a cloud service.
- ✗
A misconfigured printer is repeatedly scanning the subnet for available services.
Why it's wrong here
A misconfigured printer scanning the subnet would typically perform unauthenticated probes, such as SNMP community string requests or raw IP/ARP scans, to discover devices and services. It would not authenticate as a domain user via Kerberos, initiate SMB sessions that require valid credentials, or execute commands that create remote services on multiple Windows hosts. The creation of services like PsExec requires administrative privileges and is a sign of active remote administration, not passive scanning.
Go deeper
Related to this question
Learn chapter
Phishing, Vishing, and Smishing
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Lateral movement
Lateral movement is the technique attackers use to move through a network from one compromised system to another, seeking sensitive data or higher privileges.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.