Exam CS0-003 topic 1 question 243 discussion

Actual exam question from CompTIA's CS0-003

Question #: 243
Topic #: 1

A security analyst receives an alert for suspicious activity on a company laptop. An excerpt of the log is shown below:

Which of the following has most likely occurred?

A. An Office document with a malicious macro was opened.
B. A credential-stealing website was visited.
C. A phishing link in an email was clicked.
D. A web browser vulnerability was exploited.

Show Suggested Answer

Suggested Answer: A 🗳️

by Chiniwini at July 28, 2024, 3:51 p.m.

Comments

Submit Cancel

Chiniwini

Highly Voted 9 months, 2 weeks ago

Selected Answer: A

The sequence involving PowerShell and Microsoft Word (Event 5) strongly suggests the execution of a macro or script. This is a typical behavior of a malicious macro embedded in an Office document, which often uses PowerShell to perform further actions, such as downloading additional payloads or altering system settings.

upvoted 16 times

...