SY0-701 · Objective 2.4 · Threats, Vulnerabilities, and Mitigations
2.4 Indicators of malicious activity explained
The official objective: “Given a scenario, analyze indicators of malicious activity.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 2.4 covers
Objective 2.4 is a 'given a scenario' objective, which means questions describe what an analyst sees and ask what is happening. It is one of the widest objectives on the exam, so it helps to sort it into families.
Malware is the first family. Ransomware encrypts files and demands payment. A trojan looks useful but hides something malicious. A worm spreads by itself across a network without user action. Spyware and keyloggers collect information quietly. A virus attaches to files and spreads when they are opened. A logic bomb waits for a trigger. A rootkit hides itself and other malware from the operating system, and bloatware is unwanted preinstalled software that widens the attack surface.
Physical attacks include brute force against doors or locks, RFID badge cloning, and environmental attacks such as disabling cooling. Network attacks include distributed denial of service (including amplified and reflected forms), DNS attacks, wireless attacks, on-path attacks, credential replay and malicious code. Application attacks include injection, buffer overflow, replay, privilege escalation, forgery and directory traversal. Cryptographic attacks include downgrade, collision and birthday attacks. Password attacks include spraying, which tries one common password against many accounts to avoid lockouts, and brute force, which tries many passwords against one account or one stolen hash.
The second half of the objective is the list of indicators: the clues themselves. Account lockout spikes. Concurrent session usage, where one account is active in two places at once. Blocked content. Impossible travel, where sign-ins come from locations too far apart for the time between them. Resource consumption that doesn't match normal use. Resource inaccessibility, such as files that suddenly won't open. Out-of-cycle logging. Published or documented evidence, such as your data appearing on a leak site. Missing logs, which often means someone tried to cover their tracks.
When you answer, look for the detail that only one attack would produce. Many attempts against one account point to brute force; one or two attempts each across hundreds of accounts point to spraying. A gap in one server's logs while others recorded normally points to tampering rather than a fault. Regular small outbound connections at fixed intervals point to command and control beaconing.
What candidates mix up
- Password spraying versus brute force: spraying is one password across many accounts; brute force is many passwords against one target.
- Worm versus virus: a worm spreads on its own; a virus needs a host file and a user action.
- Impossible travel versus concurrent sessions: impossible travel is sign-ins too far apart in time and space; concurrent sessions are two active sessions at once.
- Missing logs are an indicator in their own right, not just a logging fault, when nothing explains the gap.
Practice questions for 2.4
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
An identity provider logs a successful sign-in for one account from New York, followed twenty minutes later by another successful sign-in for the same account from Singapore. Which indicator does this represent?
- AImpossible travel
- BAccount lockout
- CResource consumption
- DBlocked content
Show answer and explanation
Answer: A) Impossible travel
- ANo one can physically travel that distance in twenty minutes, so the second sign-in suggests stolen credentials or session theft.
- BA lockout happens after repeated failed attempts; both of these sign-ins succeeded.
- CResource consumption refers to unusual CPU, memory, disk or bandwidth usage, not sign-in locations.
- DBlocked content is a filter or gateway stopping a request; nothing was blocked here.
Question 2
During a routine review, an analyst notices that the Security event log on a domain controller has no entries at all for a two-hour window overnight. Other servers in the same site logged events normally during that time, and no maintenance was scheduled. How should the analyst treat this finding?
- AAs a possible indicator that logging was stopped or the log was tampered with
- BAs the normal result of the log rolling over when it reached its size limit
- CAs a time-synchronization drift that shifted the event timestamps
- DAs expected low activity because few users sign in overnight
Show answer and explanation
Answer: A) As a possible indicator that logging was stopped or the log was tampered with
Missing logs are an indicator of possible malicious activity. An unexplained gap on a critical system like a domain controller suggests the log was cleared or logging was stopped, and it should be investigated rather than written off as a benign cause.
- ACorrect. Attackers often clear the Security log or stop the event logging service to hide activity. Microsoft says the log-cleared and logging-service-shutdown events should be monitored and investigated, so an unexplained gap on a domain controller needs investigation.
- BIncorrect. Rollover or archiving removes or moves the oldest entries at the start of the log. It doesn't create a gap in the middle of a period while newer entries remain.
- CIncorrect. Clock drift would offset timestamps across the whole log, so events would still appear, just at the wrong times. It wouldn't leave a two-hour window with no events while the rest of the log looks normal.
- DIncorrect. Domain controllers keep generating security events around the clock from computer accounts, service accounts, and Kerberos ticket activity. Fewer user sign-ins don't explain zero events for two hours.
Question 3
A SIEM alert shows one external source attempting to sign in to about 600 corporate accounts over several hours. Each account receives only one or two attempts, all using the same common password (for example, a season and year followed by '!'), and the attempts are spaced so that no account reaches the lockout threshold. Which attack is most likely taking place?
- APassword spraying using a few common passwords across many accounts
- BBrute-force attack cycling through many passwords for each account
- CCredential stuffing using username and password pairs leaked elsewhere
- DRainbow table attack using precomputed hashes to recover passwords
Show answer and explanation
Answer: A) Password spraying using a few common passwords across many accounts
Trying a few common passwords against many accounts, slowly enough to avoid lockouts, is the signature of password spraying. Brute force targets each account with many guesses, and credential stuffing replays leaked pairs.
- APassword spraying tries a small number of common passwords against many accounts and stays under per-account lockout thresholds. That matches the pattern in the alert.
- BA traditional brute-force attack makes many guesses against each account, which would quickly trigger lockouts. Here each account gets only one or two attempts.
- CCredential stuffing replays specific username/password pairs from other breaches, so the password usually differs from account to account. Here the same common password is tried everywhere.
- DRainbow tables are used offline against stolen password hashes. They don't produce live sign-in attempts against an authentication service.
Other Threats, Vulnerabilities, and Mitigations objectives
Also: the Threats, Vulnerabilities, and Mitigations domain page (22% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.