Exam CS0-003 topic 1 question 243 discussion

Actual exam question from CompTIA's CS0-003

Question #: 243
Topic #: 1

A security analyst receives an alert for suspicious activity on a company laptop. An excerpt of the log is shown below:

Which of the following has most likely occurred?

A. An Office document with a malicious macro was opened.
B. A credential-stealing website was visited.
C. A phishing link in an email was clicked.
D. A web browser vulnerability was exploited.

Show Suggested Answer

Suggested Answer: A 🗳️

by Chiniwini at July 28, 2024, 3:51 p.m.

Comments

Submit Cancel

Chiniwini

Highly Voted 11 months ago

Selected Answer: A

The sequence involving PowerShell and Microsoft Word (Event 5) strongly suggests the execution of a macro or script. This is a typical behavior of a malicious macro embedded in an Office document, which often uses PowerShell to perform further actions, such as downloading additional payloads or altering system settings.

upvoted 17 times

ybyttv

2 weeks, 6 days ago

Thank for explain. Who launch the powershell? It worked as a parent process of word. The powershell come out from nowhere

upvoted 1 times

...

thisguyfucks

Most Recent 7 months ago

Selected Answer: A

Choosing A on test.

upvoted 4 times

...