ExamNova

Trace document-launched process and network evidence

A hands-on CS0-004 lab. You produce the real artefact and 8 automated checks verify it behaves the way the exam expects.

Try this labAll CS0-004 practice

Certification
CS0-004
Format
SQL query
Difficulty
medium
Estimated time
35 min
Automated checks
8

The brief

Write one read-only query over processes and connections. Return exactly event_id, host, office_guid, powershell_guid, network_guid and event_second. Find an observed direct parent edge from winword.exe or excel.exe to powershell.exe or pwsh.exe on the same host. Include that PowerShell instance itself and every observed descendant reached through parent GUID edges. Correlate a connection using the same host and process GUID, never PID alone. A candidate must have protocol tcp, initiated 1 and zone external. Check chronology on every edge: parent.created must be <= child.created, and the network process's created must be <= event_second. Equal seconds are valid. Emit one row per distinct (host, Office GUID, PowerShell GUID, network event ID) tuple, collapsing identical replay copies. Different event IDs remain separate even at equal times. Nested qualifying anchors each require a row for the same network event. Missing parent evidence does not establish an anchor. Include matching authorized automation; this is a review policy, not a verdict. Support changing hosts, identifiers, branches and empty results. Row order is unrestricted. Repair failed checks without Reset.

What the checks verify

Your work is graded on 8 independent properties, not on matching one reference answer.

  • Execute one safe read-only investigation query.
  • Return event_id, host, office_guid, powershell_guid, network_guid, event_second in order.
  • Derive qualifying shell and descendant connections, including empty and unfamiliar collections.
  • Preserve all descendant branches and every nested qualifying anchor.
  • Correlate by host and process GUID; never by PID alone.
  • Respect parent, child and connection creation order, including equal seconds.
  • Keep initiated external TCP connections that match the review policy.
  • Collapse identical replays; retain distinct event IDs and qualifying anchors.

Where this sits in the CS0-004 blueprint

Domain
Security Operations
Objective
Malicious Activity Indicators
Skill
Identity, Host and Network Indicators

Part of CS0-004 preparation

CS0-004

CompTIA Cybersecurity Analyst (CySA+)

All CS0-004 practiceAll labs

Labs are written by ExamNova to teach the decisions the exam tests. They are not reproductions of vendor lab content.