CAS-004 Practice Test 45 — 15 Questions

Question 1

A security analyst is using Volatility to analyze a memory dump from a compromised Windows system. The analyst suspects that a rootkit is hiding processes. Which Volatility plugin should the analyst use to detect hidden processes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

psxview. The 'psxview' plugin compares process listings from different sources (e.g., EPROCESS list, PspCidTable) to find discrepancies, which can reveal hidden processes.

Answer

pslist

Answer

malfind

Answer

pstree

Question 2

An organization wants to share threat intelligence with industry peers using a standardized format. Which of the following formats is specifically designed for representing structured threat information in a machine-readable way?

Accepted Answer

STIX. STIX (Structured Threat Information Expression) is a standardized language for representing threat intelligence.

Answer

CyboX

Answer

TAXII

Answer

OpenIOC

Question 3

During a penetration test, the tester has obtained a foothold on an internal server. The tester wants to identify other systems on the network and find potential targets for lateral movement. Which type of reconnaissance is MOST appropriate in this scenario?

Accepted Answer

Internal network scanning with Nmap. Active reconnaissance on internal networks (e.g., port scanning, OS fingerprinting) is appropriate after gaining a foothold, as it provides detailed information about adjacent systems. Passive reconnaissance (like sniffing) might be stealthier but active scanning is more effective for mapping.

Answer

OSINT gathering via Shodan

Answer

Social engineering attacks on employees

Answer

Passive sniffing with Wireshark

Question 4

During a threat hunting exercise, a security analyst hypothesizes that an adversary is using PowerShell to execute malicious scripts. Which approach is the analyst employing?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a specific assumption about adversary behavior, unlike IoC-driven (based on known indicators) or TTP-driven (focused on tactics, techniques, procedures).

Answer

TTP-driven hunting

Answer

Machine learning-driven hunting

Answer

IoC-driven hunting

Question 5

A security analyst is using the MITRE ATT&CK framework to map adversarial behaviors. Which THREE of the following are tactics defined by ATT&CK? (Select THREE.)

Accepted Answer

Privilege escalation. Persistence, privilege escalation, and exfiltration are all ATT&CK tactics. Phishing is a technique, not a tactic; incident response is a process, not a tactic.

Answer

Incident response

Answer

Phishing

Question 6

A security operations center (SOC) analyst receives an alert from the SIEM indicating a user has logged into the corporate VPN from an unusual geographic location at 3 AM, which is outside the user's normal working hours. The user has not previously exhibited this behavior. Which advanced SIEM capability is most likely responsible for generating this alert?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) uses machine learning to establish a baseline of normal user activity and detect anomalies such as unusual login times and locations. This is a core feature of advanced SIEM platforms.

Answer

Correlation rule based on static thresholds

Answer

Signature-based detection

Answer

Threat intelligence feed correlation

Question 7

A security team is preparing for a penetration test. Which document defines the scope, rules, and restrictions for the test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) is a formal document that outlines the scope, permissions, and constraints of a penetration test.

Answer

Memorandum of Understanding (MOU)

Answer

Statement of Work (SoW)

Answer

Service Level Agreement (SLA)

Question 8

During a vulnerability assessment, a security analyst discovers a critical vulnerability in a legacy application that cannot be patched due to vendor end-of-life. Which compensating control would best mitigate the risk?

Accepted Answer

Implement network segmentation to isolate the application. Network segmentation isolates the vulnerable system, reducing the attack surface and preventing lateral movement from a compromised system.

Answer

Apply a virtual patch via an intrusion prevention system (IPS)

Answer

Increase logging and monitoring for that application

Answer

Decommission the application immediately

Question 9

A security analyst is investigating a potential malware infection on a user's workstation. The analyst wants to examine the file system for any suspicious files without altering the original data. Which forensic principle is the analyst following?

Accepted Answer

Chain of custody. Preserving the chain of custody ensures that evidence is not tampered with and maintains its integrity for legal proceedings.

Answer

Hashing

Answer

Order of volatility

Answer

Forensic imaging

Question 10

A security analyst is reviewing threat intelligence feeds and notices indicators from a known APT group. Which threat intelligence sharing standard is most commonly used to structure and share such cyber threat information in a machine-readable format?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) are the standard protocols for sharing cyber threat intelligence in a structured, machine-readable format. STIX defines the data model, and TAXII defines the transport mechanism.

Answer

CybOX

Answer

MITRE ATT&CK

Answer

OpenIOC

Question 11

An organization is implementing a threat hunting program. The team plans to use the MITRE ATT&CK framework to structure their hunts. Which THREE of the following are core components of the ATT&CK framework? (Choose THREE.)

Accepted Answer

Procedures. ATT&CK includes tactics (the 'why'), techniques (the 'how'), and procedures (specific implementations). Indicators of compromise and CVSS scores are not part of the framework; they are separate concepts.

Answer

Indicators of compromise (IOCs)

Answer

CVSS scores

Question 12

An organization deploys honeypots to detect attackers. Which type of deception technology is being used?

Accepted Answer

Honeypots. Honeypots are decoy systems designed to lure attackers and detect unauthorized activity.

Answer

Honeytokens

Answer

Bait networks

Answer

Honeynets

Question 13

During a penetration test, the tester gains access to a web server and wants to escalate privileges to root. The tester discovers that the web application runs with a service account that has the SeImpersonatePrivilege enabled. Which attack is most likely to succeed for privilege escalation?

Accepted Answer

JuicyPotato attack. SeImpersonatePrivilege allows a process to impersonate a user token. Tools like JuicyPotato exploit this privilege to impersonate SYSTEM by forcing a higher-privileged process to authenticate and then stealing its token. This is a common technique for local privilege escalation on Windows.

Answer

SQL injection

Answer

Pass-the-hash attack

Answer

DLL hijacking

Question 14

A security analyst is reviewing a CVSS score for a vulnerability that affects a critical server. The base score is 7.5, but the analyst needs to adjust for the environment. Which TWO of the following are valid CVSS environmental metrics that can modify the score? (Choose two.)

Accepted Answer

Modified Attack Vector (MAV). CVSS environmental metrics include Confidentiality Requirement, Integrity Requirement, and Availability Requirement (the CIA requirements), as well as Modified Attack Vector, Modified Attack Complexity, etc. The question asks for metrics that modify the score; Modified Attack Vector and Modified Privileges Required are environmental metrics that adjust the base according to the environment.

Answer

Exploit Code Maturity (ECM)

Answer

Privileges Required (PR)

Answer

Attack Vector (AV)

Question 15

An organization wants to collect threat intelligence from multiple Information Sharing and Analysis Centers (ISACs) relevant to their industry. Which of the following is a primary benefit of participating in an ISAC?

Accepted Answer

Timely and relevant threat data from peers. ISACs provide a trusted community for sharing threat intelligence, early warnings, and best practices, helping members defend against sector-specific threats.

Answer

Free penetration testing services

Answer

Access to proprietary threat intelligence feeds

Answer

Ability to share sensitive information anonymously