Prepare Smarter for the 300-220 Exam
Build your exam confidence with flexible preparation resources designed around the latest 300-220 exam objectives. Practice at your own pace using PDF questions, online exam simulations, or desktop practice software.
A SOC team wants to detect lateral movement performed using legitimate administrative tools rather than malware. Which telemetry source provides the MOST reliable visibility for this hunting objective?
Correct Answer: C
The correct answer is authentication and remote execution logs . Lateral movement using legitimate tools relies heavily on credential use and remote management protocols , not malware execution.
Attackers commonly use:
RDP
SMB administrative shares
WinRM
WMI
SSH
These techniques generate authentication events, remote logons, and service execution logs rather than malware alerts. Antivirus tools are ineffective here because no malicious binaries are involved.
Option A is ineffective against living-off-the-land attacks. Option B is unrelated to lateral movement. Option D may show some activity but lacks the necessary depth to identify privilege misuse or session hopping.
Authentication telemetry enables hunters to detect anomalies such as:
Logons between non-associated systems
Sudden administrative access
Credential reuse across hosts
Abnormal session timing and frequency
This data is foundational for credential-based attack detection , which remains one of the most common breach paths today. It also aligns with MITRE ATT & CK Lateral Movement and Credential Access tactics .
Thus, option C is the correct answer.