nerdexam
CompTIA

CS0-003 · Question #660

An analyst reviews alerts that indicate a number of different users had a spike in login attempts from the same IP. Using the security information and event management (SIEM) system, the analyst…

The correct answer is C. Spoofing. The email uses a forged sender address that appears to come from an internal HR department while actually originating from an external domain, indicating impersonation intended to deceive

Submitted by layla.eg· Mar 6, 2026Security operations

Question

An analyst reviews alerts that indicate a number of different users had a spike in login attempts from the same IP. Using the security information and event management (SIEM) system, the analyst finds that a number of users received the following email:

Which of the following best describes this activity?

Exhibit

CS0-003 question #660 exhibit

Options

  • AURL shortening
  • BWhaling
  • CSpoofing
  • DSocial engineering

How the community answered

(42 responses)
  • A
    10% (4)
  • B
    2% (1)
  • C
    76% (32)
  • D
    12% (5)

Explanation

The email uses a forged sender address that appears to come from an internal HR department while actually originating from an external domain, indicating impersonation intended to deceive

Topics

#Spoofing#Phishing#Email security#Social engineering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CS0-003 Practice