CompTIA CySA+ Cybersecurity Analyst Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  Because the log shows a remote PowerShell command explicitly adding a new user. That command only does one thing: create a new local account on the target system.

• 13

  Confusing, there seems to be some missing command syntex. Why, Oh Why CompTIA, must you make test questions like this? I'm gonna go cry now!

• Chose C8

  The correct answer is C. New account introduced. The endpoint log entry shows two commands that were executed on a computer named “clientcomputer1” using administrator credentials. The first command queries the hostname of the computer, and the second command adds a new user “invoke_u1” to the computer. This indicates that a new account was introduced to the system, which could be a sign of malicious activity or beaconing