CAS-004 Practice Test 15 — 15 Questions

Question 1

A security operations center (SOC) is implementing User Behavior Analytics (UBA) to detect insider threats. Which TWO of the following data sources are most critical for establishing a baseline of normal user behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication logs from Active Directory. Authentication logs from Active Directory (A) are critical because they capture logon events, logon types, source workstations, and failure patterns (e.g., Event IDs 4624/4625), which directly define each user's normal access times, locations, and habits for UBA baselining. Network traffic logs from firewalls and proxies (C) are equally critical because they reveal each user's typical destinations, protocols, ports, data volumes, and timing, enabling detection of deviations such as large uploads or access to unusual external services. Together, identity/authentication data and network activity data form the core behavioral baseline for insider-threat detection. Threat intelligence feeds (B) describe external adversaries and indicators of compromise, not a given user's normal behavior, so they support threat matching rather than baselining. HR performance reviews (D) are subjective personnel records unrelated to technical behavior patterns. Email content and subject lines (E) are content-level data that raise privacy and legal concerns and are not required to establish behavioral baselines, which rely on metadata and activity patterns.

Answer

Threat intelligence feeds

Answer

HR records of employee performance reviews

Answer

Email content and subject lines

Question 2

During a business continuity planning meeting, the team identifies several critical systems. Which THREE of the following are key components of a Business Impact Analysis (BIA)? (Select THREE.)

Accepted Answer

Mission-essential functions. A is correct because mission-essential functions are a core component of a Business Impact Analysis (BIA). The BIA identifies and prioritizes critical business processes and the resources required to support them, directly linking to mission-essential functions to determine the impact of their disruption. This ensures continuity planning focuses on the most vital operations first.

Answer

Inventory of all hardware assets

Answer

Threat modeling of likely attack vectors

Question 3

A security analyst is conducting a threat hunt based on the hypothesis that an adversary may have used PowerShell to execute malicious scripts. Which threat hunting methodology is being employed?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a specific hypothesis, such as 'an adversary may have used PowerShell to execute malicious scripts,' and then tests that hypothesis through data analysis. This is exactly what the analyst is doing. TTP-driven hunting is broader and focuses on known adversary tactics, techniques, and procedures, while IoC-driven hunting uses specific indicators of compromise.

Answer

IoC-driven hunting

Answer

TTP-driven hunting

Answer

Baseline-driven hunting

Question 4

Match each command-line tool to its primary function.

Accepted Answer

nmap: Network discovery and security scanning. These tools are commonly used for network troubleshooting and security assessments.

Answer

nmap: Display network connections and routing tables

Answer

netstat: Capture and analyze network packets

Answer

tcpdump: Test connectivity to a remote host

Question 5

A development team is using Docker containers for microservices. The security team wants to scan containers for vulnerabilities during the CI/CD pipeline. Which approach is most effective?

Accepted Answer

Integrate image scanning into the pipeline before promoting images to the registry, using a tool like Trivy.. Integrating image scanning into the CI/CD pipeline before promoting images to the registry ensures vulnerabilities are detected early, preventing insecure images from being deployed. Tools like Trivy scan container layers against known vulnerability databases (e.g., CVE databases) at build time, aligning with DevSecOps principles of shifting security left. This approach is more effective than runtime-only scanning or post-deployment checks, as it stops vulnerable images from reaching production.

Answer

Use a runtime security tool that scans containers only when they are running.

Answer

Scan the container image only after deployment to production.

Answer

Rely on the developers to manually check for vulnerabilities.

Question 6

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect lateral movement using pass-the-hash attacks. The analyst wants to minimize false positives while ensuring detection of true positives. Which approach is most effective for reducing false positives in this scenario?

Accepted Answer

Compare authentication events against a baseline of normal user behavior and alert on anomalies. Comparing authentication events against a baseline of normal user behavior and alerting on anomalies is the most effective approach to reduce false positives while detecting pass-the-hash attacks. Pass-the-hash involves using stolen NTLM hashes to authenticate, often from unusual workstations or at unusual times. A baseline of normal behavior can identify deviations such as a user authenticating from a new workstation or at odd hours, which are strong indicators of compromise. This approach is more precise than blanket rules.

Answer

Alert on any use of NTLM authentication

Answer

Alert on multiple failed logins followed by a successful login from a different workstation

Answer

Disable NTLM authentication across the network

Question 7

A security analyst is using Volatility to analyze a memory dump from a compromised Windows system. The analyst suspects that a rootkit is hiding processes. Which Volatility plugin should the analyst use to detect hidden processes?

Accepted Answer

psxview. The 'psxview' plugin compares process listings from different sources (e.g., EPROCESS list, PspCidTable) to find discrepancies, which can reveal hidden processes.

Answer

pslist

Answer

malfind

Answer

pstree

Question 8

A security manager is reviewing a set of documents: an organizational security policy, a standard for encryption, a guideline for remote access, and a procedure for incident response. Which document is at the highest level in the policy hierarchy?

Accepted Answer

Organizational security policy. The organizational security policy is the top-level governance document — it states management's intent, scope, and high-level requirements. Standards, guidelines, and procedures all derive from and must align with the policy, making it the highest document in the hierarchy.

Answer

Remote access guideline

Answer

Encryption standard

Answer

Incident response procedure

Question 9

A SOC analyst is investigating a potential lateral movement within the network. Which log source is most critical for detecting lateral movement using pass-the-hash or pass-the-ticket attacks?

Accepted Answer

Authentication logs (e.g., Windows Event ID 4624). Authentication logs, such as Windows Event ID 4624, are the most critical for detecting lateral movement via pass-the-hash or pass-the-ticket attacks because they record logon events across systems, revealing when an attacker uses stolen credentials to access other machines. Option B (antivirus logs) is less relevant as they focus on malware, not authentication patterns. Option C (DNS logs) shows name resolution but not authentication. Option D (firewall logs) indicate network flows but lack authentication context.

Answer

Antivirus logs

Answer

DNS logs

Answer

Firewall logs

Question 10

In the shared responsibility model for cloud security, which of the following is typically the responsibility of the customer when using an Infrastructure as a Service (IaaS) model?

Accepted Answer

Encryption of data at rest within the environment. In an IaaS model, the cloud provider manages the physical infrastructure, network, and hypervisor, while the customer is responsible for everything from the guest OS upward, including data encryption at rest. Encrypting data at rest within the environment is a customer responsibility because the customer controls the data and the encryption keys. The provider secures the underlying storage but does not automatically encrypt customer data unless the customer configures it.

Answer

Configuration of the hypervisor

Answer

Network infrastructure maintenance

Answer

Physical security of data centers

Question 11

A security architect is designing a PKI hierarchy for a large enterprise that issues certificates for internal users, devices, and code signing. Which of the following best practices should be implemented to minimize the impact of a CA compromise?

Accepted Answer

Implement a segmented CA hierarchy with offline root CA and separate issuing CAs for each purpose. Using a tiered CA hierarchy with a root CA that remains offline and issuing CAs for specific purposes limits exposure. If an issuing CA is compromised, only its certificates need to be revoked, and the root CA can issue a new subordinate CA.

Answer

Rely on certificate transparency logs to detect compromises

Answer

Keep the root CA online for immediate certificate revocation

Answer

Use a single CA for all certificate types to reduce complexity

Question 12

A company is implementing a microservices architecture and needs to ensure secure service-to-service communication. Which of the following BEST describes the recommended approach?

Accepted Answer

Mutual TLS (mTLS) with certificate authentication. Mutual TLS (mTLS) with certificate authentication is the recommended approach for secure service-to-service communication in a microservices architecture because it provides both encryption and bidirectional authentication. Each service presents a unique X.509 certificate to verify its identity, preventing unauthorized access and man-in-the-middle attacks. This aligns with the principle of zero-trust networking, where no implicit trust is granted based on network location.

Answer

Basic HTTP authentication

Answer

IP whitelisting

Answer

Shared API keys

Question 13

An organization is migrating to a zero trust model and wants to implement identity-centric security. Which THREE of the following are key principles of an identity-centric zero trust approach? (Select THREE.)

Accepted Answer

Least privilege access with just-in-time privileges. Option B is correct because identity-centric zero trust enforces least privilege access, granting users only the minimum permissions needed and elevating privileges just-in-time rather than permanently, which limits the blast radius of compromised accounts. Option C is correct because zero trust requires continuous verification of identity and device health on every access request, rather than trusting a session once authenticated, using signals such as device compliance and risk scores. Option D is correct because MFA for all users strengthens identity assurance by requiring multiple factors, directly supporting the identity-centric principle that no user is trusted by default. Option A is incorrect because implicit trust based on network location is the opposite of zero trust, which assumes no implicit trust regardless of where the request originates. Option E is incorrect because a single static firewall perimeter reflects the traditional castle-and-moat model, whereas zero trust replaces perimeter-based trust with identity- and policy-based controls.

Answer

Implicit trust based on network location

Answer

Single static firewall perimeter

Question 14

Which TWO of the following are key components of a governance framework? (Select TWO)

Accepted Answer

Policies and procedures. Policies and procedures are foundational to a governance framework because they define the rules, standards, and operational guidelines that an organization must follow to ensure compliance, security, and risk management. They establish the 'what' and 'how' for decision-making and behavior, aligning with frameworks like ISO 27001 or NIST SP 800-53. Without documented policies and procedures, governance lacks enforceable structure and accountability.

Answer

Vulnerability scanning schedule

Answer

Firewall rules

Answer

Penetration test results

Question 15

Which TWO of the following are effective defenses against Server-Side Request Forgery (SSRF) attacks? (Select TWO.)

Accepted Answer

Whitelist allowed outbound IP addresses and domains. Option A is correct because an allowlist (whitelist) of permitted outbound IP addresses and domains restricts the destinations a server can reach, so even if an attacker injects an internal URL like http://169.254.169.254/ or http://localhost, the request is denied before it leaves the application. Option D is correct because disabling unused URL schemes such as file://, dict://, gopher://, and ftp:// removes dangerous protocol handlers that SSRF payloads abuse to read local files or pivot to other services, leaving only the required http/https schemes. Option B is not a reliable defense because WAF signature matching is easily bypassed with encoding, DNS rebinding, or novel payloads and cannot understand application-level intent. Option C is ineffective because the Referer header is client-controlled and trivially spoofed or omitted, and it has no bearing on server-initiated requests. Option E is insufficient on its own because URL validation is notoriously hard to implement correctly (bypasses via redirects, alternate IP encodings, and DNS rebinding), so it is not one of the two strongest defenses compared with allowlisting and scheme restriction.

Answer

Use a web application firewall (WAF) to block SSRF signatures

Answer

Enforce strict referrer headers on requests

Answer

Implement input validation on all user-supplied URLs