CAS-004 Practice Test 15 — 15 Questions

Question 1

A security analyst is investigating a malware sample and wants to determine its capabilities without executing it. The analyst examines the binary's imports, strings, and structure. What type of analysis is being performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static analysis. Static analysis examines the malware without executing it, focusing on file metadata, strings, imports, and other characteristics.

Answer

Memory analysis

Answer

Reverse engineering

Answer

Dynamic analysis

Question 2

A penetration tester is planning a test for a client that has a critical web application. The rules of engagement specify that the tester must avoid causing a denial of service (DoS). Which THREE actions are appropriate for the tester to include in the scope? (Select THREE.)

Accepted Answer

Port scanning to identify open services on the web server. Port scanning, SQL injection testing, and directory brute-forcing are common penetration testing activities that do not inherently cause DoS. DoS attacks and social engineering without approval are typically out of scope.

Answer

Conducting social engineering attacks against employees without prior approval

Answer

Performing a distributed denial-of-service (DDoS) attack to test resilience

Question 3

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect a known attack pattern that involves multiple failed logins followed by a successful login from a different IP address. Which approach best reduces false positives while maintaining detection effectiveness?

Accepted Answer

Use User Behavior Analytics (UBA) to baseline normal login patterns. UBA establishes a baseline of user behavior and flags deviations, reducing false positives from legitimate multiple failed logins (e.g., forgotten passwords) while still detecting anomalous patterns.

Answer

Create a rule that alerts on any failed login

Answer

Correlate only with known malicious IP addresses

Answer

Set a threshold of 10 failed logins within 5 minutes

Question 4

A security analyst is analyzing a memory dump from a compromised host using Volatility. Which Volatility plugin would be most useful to identify a malicious process that is hidden from the standard process listing?

Accepted Answer

psxview. Volatility's psxview plugin uses cross-view techniques to detect hidden processes by comparing process lists from multiple sources (e.g., PsActiveProcessHead, EPROCESS pools, etc.). A process that appears in some lists but not others is likely hidden.

Answer

pstree

Answer

malfind

Answer

pslist

Question 5

A security analyst is conducting a penetration test for a client. The rules of engagement specify that no social engineering is allowed. Which TWO of the following reconnaissance techniques are permitted under these rules?

Accepted Answer

Scanning the client's external network for open ports. Passive reconnaissance (OSINT) does not interact with the target and is allowed. Active reconnaissance without social engineering is also typically allowed if specified. Social engineering involves human interaction, which is prohibited.

Answer

Calling the help desk to obtain credentials

Answer

Sending phishing emails to employees

Answer

Tailgating into the building

Question 6

During a digital forensics investigation of a compromised Linux server, the investigator needs to preserve the evidence in a forensically sound manner. The server is still running. Which of the following should the investigator do first?

Accepted Answer

Capture the contents of RAM using a tool like LiME or fmem. According to the order of volatility, volatile data like memory should be captured first. On a running system, capturing memory preserves data that would be lost on shutdown.

Answer

Pull the power cord to preserve the disk state

Answer

Create a forensic image of the hard drive using dd over a network connection

Answer

Run the 'history' command to see recent user commands

Question 7

A security team is implementing a threat intelligence program and wants to consume intelligence from various sources. Which TWO of the following are commonly used threat intelligence feeds or sharing mechanisms? (Select TWO.)

Accepted Answer

ISACs. STIX/TAXII is a standard for sharing threat intelligence, and ISACs are industry-specific sharing groups.

Answer

DNS

Answer

SMTP

Answer

HTTP

Question 8

A security analyst is reviewing threat intelligence feeds and notices that a known Advanced Persistent Threat (APT) group has been using a specific technique to move laterally within networks. The analyst wants to map this technique to the MITRE ATT&CK framework. Which resource would the analyst use to find the corresponding ATT&CK technique ID?

Accepted Answer

MITRE ATT&CK Navigator or website. The MITRE ATT&CK framework provides a structured taxonomy of adversary behaviors, including techniques and procedures. The ATT&CK website or database allows mapping observed behaviors to specific technique IDs.

Answer

NIST SP 800-61

Answer

STIX/TAXII feeds

Answer

CVE database

Question 9

A security team is deploying deception technology to detect lateral movement within the network. They plan to use honeypots configured to mimic critical servers. Which TWO of the following are essential considerations for the honeypot deployment to be effective? (Choose TWO.)

Accepted Answer

Use realistic network services and data to attract attackers. Honeypots should be properly isolated to prevent them from being used as a pivot point, and they should be designed to appear realistic to attract attackers. Placing them in the same broadcast domain is not necessary and could increase risk.

Answer

Configure the honeypots with the same patch level as production systems

Answer

Ensure the honeypots are in the same broadcast domain as production servers

Answer

Disable logging on honeypots to avoid detection by attackers

Question 10

During a digital forensics investigation, an analyst is examining a Windows system suspected of being compromised. Which THREE of the following artifacts would be most useful for determining the timeline of the attack?

Accepted Answer

Windows Event Logs. Timestamps from the MFT (Master File Table), prefetch files, and event logs are key to establishing a timeline. Prefetch shows program execution, MFT shows file access/modification, and event logs record system events. The registry contains configuration data but not as reliable for timeline; SRUM is for resource usage but less direct.

Answer

Registry hives

Answer

System Resource Utilization Monitor (SRUM)

Question 11

During an incident response, the team identifies that an attacker gained initial access via a phishing email containing a malicious macro. The macro downloaded a payload from a remote server. Which phase of the incident response lifecycle is currently being executed when the team identifies the phishing email as the attack vector?

Accepted Answer

Detection and analysis. Detection and analysis involves identifying the attack and determining its nature. The team has identified the vector, so they are in this phase.

Answer

Containment, eradication, and recovery

Answer

Preparation

Answer

Lessons learned

Question 12

A SOC analyst is tuning a SIEM correlation rule to detect lateral movement. The rule currently triggers on a single failed authentication followed by a successful authentication from a new IP address within 5 minutes. Which improvement would best reduce false positives while maintaining detection of pass-the-hash attacks?

Accepted Answer

Require two failed authentications before the success. Pass-the-hash attacks often involve a single failed authentication (due to incorrect hash) followed by a success. However, requiring two failures before the success would reduce false positives from accidental typos while still catching many pass-the-hash attempts. Adding source IP whitelisting can also cut false positives from admins.

Answer

Increase the time window to 30 minutes

Answer

Add a condition that the source IP is not in the company's IP range

Answer

Remove the failed authentication requirement and only trigger on successful authentication from a new IP

Question 13

A security analyst is investigating a malware sample and wants to determine its capabilities without executing it. The analyst examines the binary's imports, strings, and structure. What type of analysis is being performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Static analysis. Static analysis involves examining the malware's code and structure without running it. This includes looking at strings (e.g., IP addresses, registry keys), PE headers, and imports/exports to understand functionality.

Answer

Dynamic analysis

Answer

Reverse engineering

Answer

Memory forensics

Question 14

During a malware analysis, an analyst runs a suspicious binary in a sandbox and observes that it attempts to communicate with a known malicious IP address, modifies registry keys, and creates a service. The analyst then extracts strings from the binary and finds references to a specific C2 server. Which analysis phase does the extraction of strings represent?

Accepted Answer

Static analysis. Static analysis involves examining the binary without executing it, such as extracting strings and PE headers.

Answer

Dynamic analysis

Answer

Reverse engineering

Answer

Memory analysis

Question 15

An organization is unable to patch a critical vulnerability in a legacy application due to vendor limitations. The risk assessment indicates a high likelihood of exploitation. Which compensating control should the organization implement to reduce the risk?

Accepted Answer

Implement network segmentation to isolate the application. When patching is not possible, compensating controls such as network segmentation, application whitelisting, or strict access controls can mitigate the risk. Network segmentation limits the attack surface by isolating the vulnerable system.

Answer

Deploy an additional firewall in front of the application

Answer

Disable the application until a patch is available

Answer

Increase the frequency of vulnerability scanning