CAS-004 Practice Test 42 — 15 Questions

Question 1

A security analyst is investigating a possible insider threat. The analyst has access to endpoint detection and response (EDR) telemetry, network flow logs, and authentication logs. The analyst suspects that a user is exfiltrating data by encoding it into DNS queries to a domain controlled by the attacker. Which data source and analysis technique would best confirm this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inspect DNS query logs for unusually long or high-entropy subdomain strings and repeated queries to the same domain.. DNS exfiltration hides data in DNS queries, typically as encoded subdomains. The most direct way to confirm is to examine DNS query logs for indicators like long, high-entropy labels and repetitive queries to the same domain. Other data sources may show related activity but do not directly reveal the DNS-based channel.

Answer

Review authentication logs for anomalous login times or locations from the user's account.

Answer

Correlate EDR process creation events with network connections to known malicious IP addresses.

Answer

Analyze network flow logs for large outbound data transfers to external IP addresses.

Question 2

A security operations center (SOC) receives a high-severity alert indicating that a domain administrator account was used to authenticate to a workstation at 03:00. The account is normally used only for interactive logons to domain controllers during business hours. The SOC analyst wants to quickly determine whether this is a malicious activity or a false positive. Which of the following is the MOST appropriate next step?

Accepted Answer

Review the Windows Security event log on the workstation for Event ID 4624 and examine the Logon Type and Source Network Address fields.. The most direct way to investigate an anomalous logon is to examine the successful logon event on the target system. Event ID 4624 includes critical details such as logon type and source address, which can quickly differentiate between a legitimate interactive logon and a suspicious remote or network logon. This evidence-based approach avoids premature containment actions and focuses the investigation on the actual behavior observed.

Answer

Run a vulnerability scan against the workstation to check for missing patches that could have allowed credential theft.

Answer

Immediately disable the domain administrator account to prevent further unauthorized access.

Answer

Check the domain controller's security log for Event ID 4768 to see if a Kerberos ticket was issued for the account.

Question 3

A security operations center (SOC) is evaluating a new endpoint detection and response (EDR) tool. The tool reports a suspicious process that is making outbound network connections to a known command-and-control (C2) server. The SOC analyst wants to confirm the process is malicious by examining the process's parent-child relationships and command-line arguments. Which of the following should the analyst use to BEST achieve this?

Accepted Answer

Endpoint process monitoring with Sysmon. The analyst needs endpoint process context, specifically parent-child relationships and command-line arguments, to confirm malicious behavior. Sysmon provides detailed process creation events including parent process ID, command line, and hashes, enabling correlation of the suspicious process with its origin and intent. Network-based tools like NetFlow and packet capture lack endpoint process visibility, while standard Windows Security logs may not capture full command lines. Sysmon is the appropriate tool for this level of endpoint telemetry.

Answer

Full packet capture

Answer

NetFlow analysis

Answer

Windows Event Log subscription for Security events

Question 4

A security engineer is configuring a web application firewall (WAF) to protect a public-facing application from common attacks. The engineer wants to ensure the WAF can detect and block SQL injection and cross-site scripting (XSS) attempts. Which TWO of the following WAF capabilities should the engineer enable? (Choose two.)

Accepted Answer

Signature-based detection for known attack patterns. To detect and block SQL injection and XSS, the WAF should use signature-based detection to recognize known attack patterns and a positive security model to enforce strict input validation. These two capabilities directly address the attack vectors. Rate limiting, SSL termination, and IP reputation are useful but do not specifically target SQL injection or XSS.

Answer

IP reputation blocking based on threat intelligence feeds

Answer

SSL/TLS termination for encrypted traffic inspection

Answer

Rate limiting to prevent brute force attacks

Question 5

An organization is implementing a zero trust architecture (ZTA). The security architect proposes using a software-defined perimeter (SDP) to replace the traditional VPN for remote access. Which of the following best describes the primary security benefit of SDP over VPN in a zero trust model?

Accepted Answer

It prevents unauthorized users from discovering the application infrastructure.. In a zero trust architecture, the primary security benefit of a software-defined perimeter (SDP) over a traditional VPN is that it hides the application infrastructure from unauthorized users. SDP uses a controller-based model where devices must authenticate and be authorized before they can even see the application servers, effectively creating a 'black cloud' that prevents discovery and reduces the attack surface. This aligns with the zero trust principle of 'never trust, always verify' and eliminates the network-level visibility that VPNs inherently provide to any connected client.

Answer

It provides deep packet inspection to detect malicious traffic.

Answer

It enforces multi-factor authentication for every session.

Answer

It reduces latency by establishing direct peer-to-peer connections.

Question 6

A security operations center (SOC) is deploying a new endpoint detection and response (EDR) solution. The team wants to ensure that the EDR can detect advanced threats that use fileless techniques and living-off-the-land binaries (LOLBins). Which two data sources should the SOC prioritize collecting from the EDR to effectively detect such threats? (Choose two.)

Accepted Answer

Windows Event Logs, specifically Sysmon events for process creation and network connections. Detecting fileless threats and LOLBins requires visibility into process execution and script activity. Sysmon events provide detailed process creation and network connection data, while PowerShell script block logging and API tracing capture the actual code and function calls used by attackers. These sources together give the SOC the behavioral context needed to identify advanced techniques that evade traditional file-based detection.

Answer

User login and logout events from the domain controller

Answer

Full packet capture (PCAP) of all network traffic

Answer

Antivirus scan logs showing signature-based detection results

Question 7

A security analyst is investigating a possible insider threat. The analyst has access to endpoint detection and response (EDR) telemetry, network flow logs, and authentication logs. The analyst suspects that a user is exfiltrating data by encoding it into DNS queries to a domain controlled by the attacker. Which data source and analysis technique would best confirm this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scheduled data transfer using a covert channel over HTTPS. The combination of HTTPS (port 443), a fixed daily schedule, and a consistent short duration strongly suggests an automated exfiltration script using a covert channel that mimics legitimate web traffic. This method allows data to leave the network without raising alarms based on port or protocol anomalies. The unfamiliar external IP and the database server as the source further point to a compromised host exfiltrating data via an encrypted channel.

Answer

DNS tunneling

Answer

ICMP exfiltration

Answer

Domain fronting

Question 8

A security administrator is configuring a new endpoint detection and response (EDR) solution. The administrator wants to ensure that the EDR can detect malicious activities such as process injection and credential dumping. Which of the following capabilities is MOST important for the EDR to have?

Accepted Answer

Behavioral monitoring. To detect techniques like process injection and credential dumping, the EDR must monitor system behavior rather than rely solely on signatures. Behavioral monitoring allows the EDR to identify suspicious actions such as unexpected process memory modifications or access to LSASS. Other options are security controls but not detection capabilities for these specific threats.

Answer

Full disk encryption

Answer

Signature-based detection

Answer

Network segmentation

Question 9

A security analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered three days ago and hosts a JavaScript file. The analyst wants to safely analyze the JavaScript file to understand its behavior without risking infection. Which of the following approaches is MOST appropriate?

Accepted Answer

Download the JavaScript file and analyze its code using a text editor and a deobfuscation tool.. Static analysis of the JavaScript file by downloading it and examining its code with deobfuscation tools is the safest and most informative approach. It allows the analyst to understand the script's functionality, extract indicators, and determine its malicious intent without any risk of executing the code. This method is preferred when the goal is to understand behavior without infection.

Answer

Open the link in a sandboxed virtual machine with no network access and execute the JavaScript in a browser.

Answer

Submit the URL to a public online JavaScript sandbox and review the execution trace.

Answer

Use a command-line tool to fetch the JavaScript file and pipe it directly to a JavaScript engine for execution.

Question 10

A security analyst is reviewing a suspicious PowerShell script found on a compromised host. The script contains a long string of base64-encoded text and uses the `-EncodedCommand` parameter. The analyst wants to understand the script's functionality without executing it. Which of the following actions should the analyst take FIRST?

Accepted Answer

Decode the base64 string using a tool like CyberChef or PowerShell's FromBase64String method.. The most efficient and safe first step is to decode the base64-encoded command to reveal the underlying PowerShell code. This static analysis technique requires no execution and often immediately exposes the script's purpose, such as downloading a payload or creating a scheduled task. It allows the analyst to make informed decisions about further investigation or containment without risking the environment.

Answer

Run the script in a sandboxed environment to observe its behavior.

Answer

Submit the script's hash to VirusTotal for threat intelligence.

Answer

Use a debugger to step through the script line by line.

Question 11

A security engineer is configuring a Web Application Firewall (WAF) to protect an e-commerce site against SQL injection attacks. The WAF is deployed in reverse proxy mode. The engineer notices that legitimate search queries containing single quotes are being blocked. Which of the following actions should the engineer take to reduce false positives while maintaining protection?

Accepted Answer

Tune the SQL injection rule to allow single quotes in specific parameter contexts, such as search parameters, while still blocking suspicious patterns.. Tuning the SQL injection rule to allow single quotes in specific contexts, such as search parameters, while still blocking malicious patterns is the most effective way to reduce false positives without compromising security. This approach requires understanding the application's normal input and crafting rules that distinguish between benign and malicious use of special characters.

Answer

Switch the WAF to detection-only mode so that it logs but does not block SQL injection attempts.

Answer

Disable the SQL injection rule set entirely to prevent blocking of legitimate traffic.

Answer

Create a whitelist rule that allows requests containing single quotes from known trusted IP addresses.

Question 12

A security analyst is investigating a possible insider threat. The analyst has access to endpoint detection and response (EDR) telemetry, network flow logs, and authentication logs. The analyst suspects that a user is exfiltrating data by encoding it into DNS queries to a domain controlled by the attacker. Which data source and analysis technique would best confirm this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the DLP alert details, including the file names, sizes, and destination, and compare with the employee's normal behavior.. The first step in investigating a potential insider threat is to review the DLP alert details and compare them with the employee's normal behavior. This triage helps determine whether the activity is anomalous and warrants further investigation. It is non-disruptive and preserves the ability to gather additional evidence before taking any action that could alert the employee or disrupt business.

Answer

Immediately disable the employee's account to prevent further data loss.

Answer

Escalate to the legal department to prepare for potential litigation.

Answer

Interview the employee's manager to ask if the employee is authorized to share documents externally.

Question 13

A multinational manufacturing firm is expanding into the European Union and must demonstrate accountability for personal data processing under GDPR. The Chief Privacy Officer asks the security team to implement a mechanism that proves the organization's compliance posture to supervisory authorities without requiring prior authorization from them. Which of the following should the team implement?

Accepted Answer

Binding Corporate Rules (BCRs). Binding Corporate Rules are a GDPR-approved mechanism for multinational corporations to establish a comprehensive, legally binding framework for intra-group data transfers and accountability. They are approved by supervisory authorities and eliminate the need for separate authorizations, directly addressing the need to demonstrate compliance posture. SCCs are transfer-specific, Privacy Shield is invalid, and consent is a processing basis, not an accountability mechanism.

Answer

Consent from data subjects

Answer

Standard Contractual Clauses (SCCs)

Answer

Privacy Shield certification

Question 14

A multinational retailer is expanding into the European Union and must transfer employee payroll data from its EU subsidiary to its US-based HR platform. Legal counsel recommends relying on the EU-US Data Privacy Framework rather than implementing Standard Contractual Clauses. Which action must the retailer take FIRST to rely on this transfer mechanism?

Accepted Answer

Verify that the US HR platform is listed as an active participant on the Data Privacy Framework List maintained by the US Department of Commerce.. The EU-US Data Privacy Framework permits transfers to US importers that have self-certified and appear on the Department of Commerce's Data Privacy Framework List. Verifying that the HR platform holds active certification is the foundational requirement; without it, the framework cannot be invoked and another transfer tool would be needed.

Answer

Obtain explicit consent from every EU employee before the payroll records are transmitted to the US platform.

Answer

Conduct a Transfer Impact Assessment documenting that US surveillance laws do not undermine the protection of the payroll data.

Answer

Execute a Binding Corporate Rules application with the lead supervisory authority in the EU member state where the subsidiary is established.

Question 15

A security analyst is investigating a security incident where an attacker gained unauthorized access to a server. The analyst reviews the server logs and finds the following entries: 'Accepted password for root from 192.168.1.100 port 22 ssh2' followed by 'session opened for user root by (uid=0)'. The analyst suspects the attacker used stolen credentials. Which of the following log sources would provide the MOST direct evidence of the attacker's activities after the initial access?

Accepted Answer

System call auditing logs (e.g., auditd).. System call auditing logs, such as those from auditd, capture detailed system-level activities including process execution, file access, and network connections. They are tamper-resistant and provide a comprehensive record of the attacker's actions after initial access. Authentication logs only show login events, bash history can be altered, and NetFlow lacks host-based detail.

Answer

Network flow data (NetFlow) from the server's switch.

Answer

Bash history file for the root user.

Answer

Authentication logs from the SSH service.