CAS-004 Practice Test 35 — 15 Questions

Question 1

Given the exhibit, what is the effect of this S3 bucket policy on an object stored in 'bucket-name'?

Accepted Answer

All requests to the bucket are denied regardless of source IP.. Option B is correct. The Deny statement will override the Allow because Deny takes precedence. The Allow only allows GetObject from 10.0.0.0/8, but the Deny all actions for all principals will block all access, including GetObject from the allowed IP range. Option A is wrong because Deny overrides. Option C is wrong because there is an explicit Deny. Option D is wrong because the effect is to deny all, not just outside IPs.

Answer

Requests from outside 10.0.0.0/8 are allowed to read objects.

Answer

All requests from IPs in 10.0.0.0/8 are allowed to read objects.

Answer

Only anonymous requests are denied.

Question 2

A security operations team wants to improve their threat intelligence program. Which THREE of the following are most important for ensuring that threat intelligence is actionable and effectively integrated into security operations?

Accepted Answer

Ensure threat intelligence feeds provide timely indicators of compromise (IOCs) that are less than 24 hours old.. Option A (timeliness) ensures relevance; Option B (context) allows prioritization; Option D (integration with detection tools) automates response. Option C (volume) can lead to noise. Option E (anonymity) is not a key quality for intelligence.

Answer

Require that all threat intelligence sources are completely anonymous to ensure unbiased reporting.

Answer

Subscribe to as many threat intelligence feeds as possible to maximize coverage.

Question 3

During a forensic investigation, an analyst finds that a compromised system's memory dump shows signs of a kernel-mode rootkit. Which technique is MOST effective to detect the rootkit without relying on the compromised OS?

Accepted Answer

Perform memory analysis using volatility on an isolated forensic workstation.. Option D is correct because memory forensics on a different system allows analysis of the dump without trusting the compromised OS. Option A relies on the OS which may be compromised. Option B is for network traffic, not kernel rootkits. Option C may not detect rootkits if they hide from registry.

Answer

Run antivirus scans on the disk image.

Answer

Compare registry snapshots before and after infection.

Answer

Analyze network packet captures for C2 traffic.

Question 4

A threat hunter wants to identify potential lateral movement within the network. Which data source is LEAST useful for this purpose?

Accepted Answer

DNS query logs. Option B is correct because DNS logs primarily show domain resolution requests, which may not directly indicate lateral movement. Option A shows remote logins. Option C shows processes connecting to other systems. Option D shows authentication events.

Answer

Windows Event ID 4624 (Logon) from domain controllers

Answer

Windows Event ID 4648 (Logon with explicit credentials)

Answer

Windows Event ID 5140 (File share accessed)

Question 5

A large enterprise is implementing a SOAR platform to automate incident response. The security team wants to create a playbook for handling phishing emails reported by users. The playbook should: 1) validate the reported email by checking headers and attachments, 2) automatically block the sender's domain at the email gateway if malicious, 3) create a ticket, and 4) send an automated response to the user. Which of the following describes the best approach to design this playbook?

Accepted Answer

Use an automated triage step that extracts indicators, then present the verdict to an analyst in a manual approval step before executing blocks.. Option A is correct because a tiered approach with human approval before blocking prevents false positives and aligns with typical SOAR best practices. Option B is too risky without validation. Option C bypasses automated analysis, which defeats automation. Option D delays response and increases workload.

Answer

Create a ticket and route it to a junior analyst for manual investigation, then close after user acknowledgement.

Answer

Immediately sandbox the attachment and block the sender's domain if the sandbox reports malicious behavior.

Answer

Automatically delete the email from all users' inboxes and send a warning to the organization.

Question 6

A healthcare organization has suffered a ransomware attack. The ransomware encrypted all files on file servers and workstations, and a ransom note demands payment in cryptocurrency. The backup systems were also encrypted because the backup service account had write access to the backup repository. The organization's cybersecurity team has activated the incident response plan. Which of the following is the BEST course of action?

Accepted Answer

Isolate all affected systems from the network immediately to prevent further encryption.. Option A is correct because containment (isolating infected systems) is the priority to prevent spread to remaining systems. Option B is dangerous as paying the ransom encourages further attacks and provides no guarantee of recovery. Option C is futile if backups are compromised. Option D focuses on restoration without containment, risking re-encryption.

Answer

Restore data from the encrypted backups using a third-party decryption tool.

Answer

Begin restoring systems from any clean backups located on removable media.

Answer

Pay the ransom to obtain the decryption key and restore operations quickly.

Question 7

A security analyst is analyzing a network capture and sees repeated TCP SYN packets to a host but no SYN-ACK responses. Which TWO conclusions are MOST likely? (Choose two.)

Accepted Answer

A firewall is dropping the SYN packets before they reach the host.. Options A and D are correct. A SYN flood without response suggests a DDoS attack (A) or a stateful firewall blocking (D). Option B is incorrect because no SYN-ACK means no connection established. Option C is unrelated. Option E is possible but less likely than the top two.

Answer

The host is out of TCP receive window space.

Answer

The network has a loop causing packet duplication.

Answer

The host has accepted the connections.

Question 8

During a routine vulnerability scan, a security engineer discovers that a critical web application is running an outdated version of a third-party library with a known remote code execution (RCE) vulnerability. The application is in production and cannot be taken offline immediately. Which of the following is the BEST immediate action to reduce risk?

Accepted Answer

Implement a virtual patch using a web application firewall (WAF) to block exploitation patterns.. Option B is correct because a WAF rule can block exploitation attempts while a permanent fix is developed. Option A might break functionality. Option C is too slow for immediate risk reduction. Option D might not address the vulnerability entry point.

Answer

Patch the library directly in the production environment.

Answer

Schedule a maintenance window for the next weekend to apply the vendor's patch.

Answer

Disable the web application until a patch is available.

Question 9

A CSIRT is developing a threat hunting hypothesis based on the MITRE ATT&CK framework. Which THREE of the following are techniques that threat hunters would commonly investigate for initial access? (Choose three.)

Accepted Answer

Exploit public-facing application. Options A, B, and D are correct. Spear-phishing, exploitation of public-facing applications, and valid accounts are common initial access techniques. Option C is for lateral movement, and Option E is for persistence.

Answer

Remote services

Answer

Boot or logon autostart execution

Question 10

A security architect is designing a deception-based detection system for a high-security environment. The goal is to detect lateral movement by attackers who have already breached the perimeter. Which of the following deception techniques would be most effective at identifying an attacker without alerting them to the deception?

Accepted Answer

Plant honey credentials (username/password) for non-existent Active Directory accounts in a common password manager.. Option A is correct because honey tokens that appear as real credentials will be used only by attackers, and if used, provide high-confidence detection. Option B will alert attackers. Option C is easily detectable by experienced attackers. Option D may be ignored if attackers don't use network shares.

Answer

Configure a network share with honey files and monitor for file access.

Answer

Create a honeypot web server with known vulnerabilities and monitor for interactions.

Answer

Deploy fake database tables containing plausible but fictitious data.

Question 11

A security analyst is performing a risk assessment for a critical application. Which TWO of the following are characteristics of a quantitative risk assessment methodology?

Accepted Answer

Calculates Annualized Loss Expectancy (ALE). Quantitative risk assessment uses numerical values for assets, threats, and vulnerabilities. Option A (Assigns dollar values to assets and losses) is correct because it uses monetary figures. Option C (Calculates Annualized Loss Expectancy (ALE)) is also correct because ALE = SLE * ARO is a quantitative metric. Option B is qualitative (judgment-based). Option D is qualitative (expert opinion). Option E is quantitative but not a characteristic of the methodology itself; it's a common metric but not defining. However, careful: The stem asks for characteristics of quantitative methodology. ALE is a result, not a characteristic. But typical CompTIA sees ALE as part of quantitative. I'll adjust options to be clearer.

Answer

Relies on expert judgment and scenarios

Answer

Determines Exposure Factor (EF) for each asset

Answer

Uses high/medium/low ratings for likelihood and impact

Question 12

After a security incident, the IR team identifies that the attacker used a spear-phishing email with an attached malicious macro. Which log source would be MOST crucial to determine the scope of the compromise?

Accepted Answer

Proxy server logs. Option C is correct because proxy logs show outbound HTTP/HTTPS connections, which malware often uses for C2 and data exfiltration. Option A shows email from/to but not system activity. Option B shows local process execution but may not show network connections. Option D shows endpoint network connections but may not capture all outbound traffic if it's not forwarded.

Answer

Endpoint detection and response (EDR) telemetry

Answer

Windows Event Logs (Event ID 4688)

Answer

Email server logs

Question 13

A financial organization's SOC analysts have observed repeated failed authentication attempts from a single external IP address against multiple user accounts, followed by a successful authentication from the same IP using one of those accounts. Which type of security monitoring rule would be most effective at detecting this attack pattern in real time?

Accepted Answer

Alert when multiple failed logins from a single source IP are followed by a successful login from that IP within 10 minutes.. The attack pattern involves brute-force attempts followed by a success, which is a classic credential stuffing attack. Option C is a correlation rule that combines multiple failed logins with a subsequent success for the same source IP, which directly captures this behavior. Option A only detects a single failed login, not the pattern. Option B detects a success after failures but for a single target user, not the source IP pattern. Option D detects a single login after a reset, which is unrelated.

Answer

Alert when a user account has three failed logins within 5 minutes followed by a successful login.

Answer

Alert when a successful authentication occurs immediately after a password reset.

Answer

Alert on any single failed login attempt from an external IP.

Question 14

A security administrator is evaluating ways to improve endpoint detection and response (EDR) capabilities. Which TWO of the following approaches would most effectively enhance the detection of fileless malware attacks?

Accepted Answer

Monitor PowerShell script block logging and execution events.. Fileless malware often exploits memory and legitimate tools. Option A (monitoring process creation chains) detects abnormal parent-child relationships (e.g., wmic spawning cmd). Option D (monitoring PowerShell script execution) catches malicious scripts. Option B focuses on files, which may miss fileless. Option C is less effective for memory-resident malware. Option E is generally for network-based detection.

Answer

Install a network intrusion detection system (NIDS) to inspect traffic.

Answer

Enable file integrity monitoring (FIM) on critical system files.

Answer

Deploy advanced antivirus with machine learning signatures.

Question 15

A technology company suspects an insider threat is exfiltrating intellectual property. The security team has deployed user and entity behavior analytics (UEBA) and set up data loss prevention (DLP) rules. A UEBA alert flags a senior developer who is accessing the source code repository at 2 AM from a VPN connection that routes through a foreign country. The developer also recently downloaded a large quantity of source code—more than 10 times the normal volume. DLP policies are configured to block emails with attachments over 10 MB. Which of the following should the incident response team do FIRST?

Accepted Answer

Isolate the developer's workstation and revoke access to the source code repository immediately.. Option A is correct because the UEBA alert combined with anomalous behavior strongly suggests malicious activity. Immediate isolation prevents exfiltration and preserves evidence. Option B interviews the user, which could alert them and lead to data destruction. Option C focuses only on DLP, but the exfiltration may not be via email. Option D is a long-term preventive measure, not immediate response.

Answer

Implement stricter DLP policies to block large downloads from the repository.

Answer

Conduct an informal interview with the developer to ask about the unusual activity.

Answer

Review DLP logs to confirm that no emails containing source code were sent.

CAS-004 Practice Test 35 — 15 Questions

Exhibit

CAS-004 Practice Test 35 — 15 Questions

Exhibit