SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
NetFlow shows one workstation initiating SMB and WinRM sessions to 25 internal servers within 12 minutes, followed by a spike in Kerberos authentication requests and attempts to access admin shares. The user says they only opened an invoice spreadsheet. What is the most likely attacker objective?
⚠ Common exam trap
The trap here is that candidates may mistake the Kerberos spike for a Kerberos-based attack (e.g., Kerberoasting) rather than recognizing it as a natural byproduct of lateral movement, where each new server connection triggers a TGS request, and the admin share access confirms the attacker is using compromised credentials to pivot, not just enumerate services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lateral movement using compromised credentials to pivot across the environment.
The observed behavior—a single workstation initiating SMB and WinRM sessions to 25 internal servers in rapid succession, followed by a spike in Kerberos authentication requests and attempts to access admin shares—is a classic indicator of lateral movement using compromised credentials. The attacker likely obtained the user's credentials (e.g., via phishing in the invoice spreadsheet) and is using them to authenticate to multiple servers via WinRM for remote command execution and SMB for file access, with the Kerberos spike reflecting TGT/TGS requests as they pivot across the environment to escalate privileges or deploy ransomware.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Distributed denial-of-service activity against the internal network.
Why it's wrong here
This traffic is not volumetric or disruptive in nature. A DDoS attack against the internal network would manifest as a flood of packets—typically UDP, ICMP, or SYN—consuming bandwidth or exhausting connection tables. Instead, the observed SMB and WinRM sessions are interactive, authenticated application-layer connections from a single workstation to multiple hosts, which is the signature of an attacker performing targeted lateral movement rather than a denial-of-service event.
- ✓
Lateral movement using compromised credentials to pivot across the environment.
Why this is correct
The pattern of SMB, WinRM, Kerberos, and admin-share activity strongly suggests an attacker is using one compromised workstation to move laterally and reach additional systems. That behavior matches post-compromise pivoting, often with stolen credentials or remote execution tooling. The invoice spreadsheet is likely the initial infection vector.
- ✗
Port scanning from an external attacker trying to enumerate exposed services.
Why it's wrong here
Port scanning from an external attacker would generate a high volume of connection attempts to many different ports, often leaving incomplete TCP handshakes and no authenticated application-layer sessions. Here, the traffic shows established SMB, WinRM, and Kerberos sessions from an internal host to internal targets—these protocols require valid credentials and successful authentication. An external attacker would not have access to internal Kerberos tickets or be able to initiate authenticated SMB sessions without first compromising credentials, so this is clearly east-west lateral movement, not external reconnaissance.
- ✗
DNS tunneling used to bypass content filtering and exfiltrate data.
Why it's wrong here
DNS tunneling is characterized by an abnormal volume of DNS queries, especially with long subdomains or base64-encoded payloads, and is used when attackers need to bypass egress filtering to exfiltrate data or issue C2 commands. The observed activity involves SMB and WinRM—interactive protocols for file access and remote execution—which are not used in DNS tunneling. Moreover, Kerberos authentication traffic would not appear in a DNS-tunneling scheme; the session pattern instead aligns with credential-based lateral movement across hosts.
Go deeper
Related to this question
Learn chapter
Phishing, Vishing, and Smishing
Key term
Ransomware
Ransomware is a type of malicious software that encrypts a victim's files or locks them out of their system, demanding payment, usually in cryptocurrency, to restore access.
Key term
WinRM
WinRM is Microsoft's implementation of WS-Management, enabling secure remote management of Windows systems over HTTP/HTTPS.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.