CompTIA · CySA+ CS0-004
Network and host indicators
CySA+ CS0-004 · Lesson 4 of 22 · 27:02
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: rogue devices, enumeration, anomalous traffic like beaconing, activity on unexpected ports, unusual resource consumption, unauthorized software and suspicious processes, living off the land binaries like certutil and rundll32, file system changes, data staging and large transfers, ransomware patterns, and unauthorized configuration changes that reveal persistence. Includes three original practice questions.
Preview the topics
- Firewall logs show a file server that opens a small HTTPS connection to the same foreign IP address every 60 seconds, day and night, although the server never browses the web. What does this pattern most likely indicate?
- Process logs on a teller workstation show certutil downloading a file from an unknown website, then rundll32 running it. What is the best description of this activity?
- On a file server, thousands of files were renamed with the same new extension within ten minutes, and disk activity is far above normal. Which indicator does this match?