CAS-004 Security Operations — 100 Questions

Question 1

A security operations center (SOC) is implementing a SOAR platform to automate responses to phishing incidents. The playbook will include steps to automatically quarantine suspicious emails, delete them from user mailboxes, and block the sender's domain. Which element should the SOAR playbook incorporate to ensure the automated response does not cause unintended disruption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A confirmation step that prompts the analyst to approve the quarantine and deletion actions. A confirmation step that prompts the analyst to approve the quarantine and deletion actions is the correct element because it introduces a human-in-the-loop (HITL) checkpoint specifically for the disruptive actions (quarantine, deletion, domain block) while still allowing the SOAR platform to automate the rest of the playbook. This balances automation speed with the need to prevent unintended disruption, such as quarantining legitimate business emails or blocking a partner domain. The confirmation step is targeted, not a blanket manual approval, so it preserves the efficiency gains of SOAR. It directly addresses the requirement to avoid unintended disruption by ensuring a human validates the high-impact actions before they execute.

Answer

An automatic rollback script that restores quarantined emails after 24 hours if no user complaint

Answer

Integration with threat intelligence to verify the sender domain reputation score before blocking

Answer

A manual approval step before executing any automated response

Question 2

A vulnerability management team is prioritizing patches for a large number of vulnerabilities discovered in a quarterly scan. A critical vulnerability in a widely used application has a CVSS base score of 9.8, but it is not currently being exploited in the wild and the application is not directly exposed to the internet. According to CVSS scoring principles, which factors should the team consider to adjust the priority?

Accepted Answer

Environmental metrics such as collateral damage potential and target distribution. CVSS environmental metrics adjust the base score to reflect the specific organization's context, including collateral damage potential, target distribution, and modified impact sub-scores. Since the vulnerability is not internet-exposed, environmental metrics capture that reduced exposure and lower the effective priority. Temporal metrics address exploit maturity and remediation level, but the question emphasizes organizational context, which is environmental.

Answer

The number of other vulnerabilities in the same software product

Answer

The age of the vulnerability since its disclosure

Answer

Temporal metrics including exploit code maturity and remediation level

Question 3

An organization is deploying deception technology to detect lateral movement by attackers. Which of the following would be the most effective to detect an attacker who has gained access to the internal network and is attempting to move to a sensitive server?

Accepted Answer

A honeytoken in the form of a fake password file on a file server. A honeytoken is a fake credential or file designed to be accessed only by an attacker who has already compromised the network. Placing a fake password file on a file server creates a high-fidelity alert when an attacker attempts to use it for lateral movement, as legitimate users have no reason to access it. This directly detects the attacker's reconnaissance and credential harvesting behavior.

Answer

A network-based intrusion detection system (NIDS) on the segment

Answer

A honeypot configured to mimic a high-value database server

Answer

An endpoint detection and response (EDR) agent on all workstations

Question 4

A security team is conducting a penetration test against a client's web application. During the reconnaissance phase, the tester discovers a subdomain that hosts a development version of the application with debug mode enabled. Which type of reconnaissance does this activity represent?

Accepted Answer

Active reconnaissance because the tester is sending requests to the target network to identify subdomains. Active reconnaissance involves directly interacting with the target's systems — sending DNS queries, port scans, or HTTP requests — to enumerate subdomains and services. Discovering a development subdomain with debug mode enabled required the tester to probe the target's DNS or web infrastructure, making it active reconnaissance.

Answer

Open-source intelligence (OSINT) gathering by examining the target's website source code

Answer

Social engineering because the tester tricked an employee into revealing the subdomain

Answer

Passive reconnaissance because the tester is using publicly available information

Question 5

A penetration tester is planning a test for a client that has a critical web application. The rules of engagement specify that the tester must avoid causing a denial of service (DoS). Which THREE actions are appropriate for the tester to include in the scope? (Select THREE.)

Accepted Answer

Port scanning to identify open services on the web server. Option B is correct because port scanning (e.g., with Nmap TCP SYN or connect scans) is a low-impact reconnaissance technique that identifies open services on the web server without exhausting resources or disrupting availability, so it respects the no-DoS constraint. Option D is correct because brute-forcing directories and files (e.g., with Gobuster, DirBuster, or ffuf using a wordlist) sends ordinary HTTP GET requests that enumerate hidden content and typically do not overwhelm the target if throttled, making it an appropriate discovery action. Option E is correct because testing for SQL injection in input fields (e.g., with sqlmap or manual payloads like ' OR 1=1--) targets application logic flaws and, when done carefully, does not cause a denial of service. Option A is not appropriate because social engineering against employees without prior approval violates the rules of engagement and lacks authorization. Option C is not appropriate because performing a DDoS attack directly contradicts the requirement to avoid causing a denial of service.

Answer

Conducting social engineering attacks against employees without prior approval

Answer

Performing a distributed denial-of-service (DDoS) attack to test resilience

Question 6

A security engineer is configuring a SIEM correlation rule to detect a potential data exfiltration attempt. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address that has never been communicated with before, within a 5-minute window. Additionally, the external IP should not be on any whitelist. Which correlation logic best implements this detection?

Accepted Answer

Alert when a host sends >10 MB to an external IP that is not in the whitelist and not seen in the last 24 hours, aggregated over 5 minutes.. Ly implements the detection rule. It aggregates data transfer per host over 5 minutes, checks that the volume exceeds 10 MB, verifies the external IP is not on any whitelist, and ensures the IP has not been seen in the last 24 hours (i.e., it is a new destination). This matches all the requirements: a single internal host, >10 MB, to an external IP never communicated with before, within 5 minutes, and not whitelisted. Option B adds an unnecessary port 443 condition. Option C omits the requirement that the external IP must be new (unseen before). Option D aggregates over all external IPs without checking newness, which could alert on previously contacted IPs.

Answer

Alert when a host sends >10 MB to an external IP not in the whitelist and the destination port is 443.

Answer

Alert when any host sends >10 MB to an external IP not in the whitelist within 5 minutes.

Answer

Alert when a host sends >10 MB to any external IP aggregated over 5 minutes, then filter out whitelisted IPs.

Question 7

A security analyst is reviewing a suspicious executable file. The analyst performs static analysis by examining the file's strings and imports. Which of the following findings would most strongly suggest the file is packed or obfuscated?

Accepted Answer

The file has very few readable strings. Packed or obfuscated malware typically has its original strings compressed or encrypted, so static analysis reveals very few readable strings. Packers like UPX or custom crypters replace plaintext strings with encoded blobs, leaving the binary with minimal human-readable content. This is a classic indicator that the file's true code is hidden until runtime unpacking occurs.

Answer

The file imports many Windows API functions

Answer

The file has a high entropy score

Answer

The file contains a large number of IP addresses

Question 8

An organization's vulnerability management team discovers a critical vulnerability in a legacy application that cannot be patched because the vendor no longer supports it. The application is essential for business operations. Which of the following compensating controls would best reduce the risk of exploitation while maintaining functionality?

Accepted Answer

Implement network segmentation and restrict access to the application. Network segmentation with restricted access is the best compensating control because it limits the attack surface and prevents lateral movement or remote exploitation of the unpatched legacy application while keeping it operational for authorized users. Since the vendor no longer supports the application, patching is impossible, so reducing exposure through access controls is the most effective risk mitigation. This preserves business functionality while directly addressing the exploitation risk.

Answer

Apply a virtual patch using a web application firewall (WAF) rule

Answer

Disable the application until a replacement is found

Answer

Increase monitoring of the application without any access restrictions

Question 9

A security operations center (SOC) analyst is investigating an alert from an EDR tool indicating that a workstation executed a suspicious PowerShell command that decoded a base64 string. The decoded string contained a command to download a file from an external IP address. Which stage of the cyber kill chain does this activity most likely represent?

Accepted Answer

Actions on Objectives. The activity described—decoding a base64 string to reveal a command that downloads a file from an external IP—is a classic example of a downloader or stager, which is part of the Command and Control (C2) or Actions on Objectives stage. In the Cyber Kill Chain, Actions on Objectives is the final stage where the attacker accomplishes their goal, which can include establishing C2, downloading additional payloads, or exfiltrating data. Since the decoded command initiates communication with an external IP to retrieve a file, it represents the attacker actively pursuing their objective, not just reconnaissance or exploitation.

Answer

Reconnaissance

Answer

Weaponization

Answer

Exploitation

Question 10

During a forensic investigation, an analyst needs to collect volatile data from a compromised Linux server. Which of the following orders of volatility is correct for collecting the listed data?

Accepted Answer

Memory contents, network connections, processes, files on disk. The order of volatility (RFC 3227) dictates collecting the most perishable data first. Memory contents and network connections are highly volatile, followed by running processes, and finally files on disk, which persist. Option C correctly orders these from most to least volatile: memory contents, network connections, processes, files on disk.

Answer

Processes, memory contents, files on disk, network connections

Answer

Files on disk, memory contents, processes, network connections

Answer

Network connections, processes, memory contents, files on disk

Question 11

During a digital forensics investigation, an analyst is examining a Windows system suspected of being compromised. Which THREE of the following artifacts would be most useful for determining the timeline of the attack?

Accepted Answer

Windows Event Logs. Windows Event Logs (B) are correct because they record timestamped security, system, and application events (e.g., Security logon events 4624/4625, service installs 7045) that directly establish when attacker actions occurred. The Master File Table (C) is correct because each MFT entry stores $STANDARD_INFORMATION and $FILE_NAME timestamps (created, modified, accessed, entry modified) for every file, allowing analysts to reconstruct file creation, modification, and deletion activity during the intrusion. Prefetch files (D) are correct because each .pf file in C:\Windows\Prefetch records the first and last execution times of an application plus referenced files, providing concrete evidence of when malicious binaries were run. Registry hives (A) do contain timestamps and persistence keys, but they are primarily used for configuration and persistence analysis rather than building a precise attack timeline. SRUM (E) tracks per-application resource usage and network data over time, which is useful for profiling activity but is not a primary timeline artifact compared to Event Logs, MFT, and Prefetch.

Answer

Registry hives

Answer

System Resource Utilization Monitor (SRUM)

Question 12

A penetration tester is performing an assessment of a web application. During reconnaissance, the tester discovers a publicly accessible Jenkins server with default credentials. The tester gains access and finds a build job that executes arbitrary commands. What is the most effective way for the tester to escalate privileges and move laterally within the network?

Accepted Answer

Use Jenkins to execute a reverse shell and then perform pass-the-hash. With code execution on the Jenkins server, the tester can establish a reverse shell to gain interactive access, then harvest credentials (e.g., from memory or local files) and perform pass-the-hash to authenticate to other Windows systems without cracking passwords. This leverages the compromised host as a pivot for lateral movement, which is the most effective escalation path given the foothold.

Answer

Exploit a SQL injection vulnerability in the web app

Answer

Use a vulnerability scanner to find additional CVEs

Answer

Deploy a ransomware payload to encrypt files

Question 13

A security engineer is implementing deception technology to detect lateral movement by adversaries. Which type of deception resource would be MOST effective for capturing adversary credential harvesting activities on a network segment that contains no real domain controllers?

Accepted Answer

A honeytoken in the form of a fake service account password. A honeytoken in the form of a fake service account password is a deception artifact — a credential that has no legitimate use — so any attempt to authenticate with it is by definition malicious and indicates credential harvesting. Because the segment contains no real domain controllers, an adversary performing credential theft (e.g., dumping LSASS, Kerberoasting, or scanning for credentials) will eventually encounter and attempt to use the fake credential, triggering a high-fidelity alert with near-zero false positives. This makes it the most effective deception resource for capturing credential harvesting specifically.

Answer

A SIEM correlation rule for anomalous logins

Answer

A network-based intrusion detection system (NIDS)

Answer

A honeypot configured as a domain controller

Question 14

A security operations team is designing a threat hunting program. They want to use the MITRE ATT&CK framework to structure their hunts. Which TWO components of the ATT&CK framework should they focus on to develop hypothesis-driven hunts? (Select TWO.)

Accepted Answer

Tactics. ATT&CK tactics represent the adversary's high-level goals (e.g., Initial Access, Persistence, Lateral Movement), which give hunters the 'why' to build hypotheses such as 'an attacker may be attempting credential dumping to enable lateral movement.' Option E (Techniques) is correct because techniques describe the specific 'how' an adversary achieves a tactic (e.g., T1003 OS Credential Dumping, T1059 Command and Scripting Interpreter), providing the concrete behaviors hunters translate into detection hypotheses and data-source queries. Together, tactics and techniques form the core of hypothesis-driven hunting, since a hypothesis pairs an adversary goal with an observable method. Option A (IOCs) is not the right focus because IOCs are atomic, low-fidelity artifacts (hashes, IPs, domains) that support reactive detection rather than structured hypothesis generation. Option C (Procedures) is not selected because procedures are the highly specific, often campaign-unique implementations of techniques and are too granular to serve as the primary framework components for general hunt hypotheses. Option D (Mitigations) is not selected because mitigations are defensive countermeasures mapped to techniques, not adversary behaviors used to formulate hunting hypotheses.

Answer

Indicators of Compromise (IOCs)

Answer

Procedures

Answer

Mitigations

Question 15

An organization discovers a critical vulnerability in a legacy application that cannot be patched due to vendor end-of-life. Which of the following is the BEST compensating control to reduce risk?

Accepted Answer

Implement network segmentation to isolate the application. For a legacy application that cannot be patched due to vendor end-of-life, the best compensating control is to implement network segmentation to isolate the application. This limits the blast radius by preventing lateral movement and restricting access to the application from other systems, thereby reducing the risk of exploitation. While it does not eliminate the vulnerability, it is the most effective compensating control among the options.

Answer

Increase logging and monitoring

Answer

Apply a virtual patch using an intrusion prevention system (IPS)

Answer

Decommission the application immediately

Question 16

A security analyst is analyzing a memory dump using Volatility. The analyst wants to list all running processes and identify any hidden processes. Which Volatility plugin should be used?

Accepted Answer

psscan. The psscan plugin in Volatility scans physical memory for process objects (EPROCESS structures) by pool tag scanning, rather than relying on the active process list maintained by the kernel. This allows it to detect hidden or terminated processes that have been unlinked from the active process list by rootkits or malware. Since the analyst wants to identify hidden processes, psscan is the correct choice because it can reveal processes that pslist or pstree would miss.

Answer

psxview

Answer

pslist

Answer

pstree

Question 17

A security analyst is triaging a suspicious file. The analyst wants to perform static analysis to gather initial information. Which TWO of the following are static analysis techniques?

Accepted Answer

Checking the file hash against known malware databases. Static analysis examines a file without executing it, so option C is correct: computing the file's hash (e.g., MD5/SHA-256) and comparing it against known-malware databases or threat-intelligence feeds like VirusTotal provides initial identification without running the sample. Option E is also correct: extracting human-readable strings from the binary (e.g., using the strings utility) reveals embedded URLs, IP addresses, file paths, registry keys, and error messages without executing the code. Options A and D are dynamic analysis techniques because they require executing the file — sandboxing observes runtime behavior, and monitoring network traffic captures live communications. Option B, disassembling the binary to examine assembly code, is also a static technique, but it is not among the marked correct answers here.

Answer

Running the file in a sandbox

Answer

Disassembling the binary to examine assembly code

Answer

Observing network traffic generated by the file

Question 18

During an incident response, a security analyst identifies a previously unknown malware variant. Which type of threat intelligence feed would provide the most timely and structured information about this threat?

Accepted Answer

STIX/TAXII feed. STIX (Structured Threat Information eXpression) is the standardized language for representing cyber threat intelligence in a structured, machine-readable format, and TAXII (Trusted Automated eXchange of Indicator Information) is the transport protocol used to exchange that STIX data between systems. Together, a STIX/TAXII feed delivers timely, structured, and automatable threat intelligence that can be ingested directly by SIEMs, TIPs, and SOAR platforms. For a previously unknown malware variant, this structured format allows rapid dissemination of indicators (hashes, IOCs, TTPs) across the security stack without manual parsing.

Answer

An ISAC

Answer

Open source intelligence (OSINT)

Answer

A commercial threat feed

Question 19

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect a known attack pattern that involves multiple failed logins followed by a successful login from a different IP address. Which approach best reduces false positives while maintaining detection effectiveness?

Accepted Answer

Use User Behavior Analytics (UBA) to baseline normal login patterns. User Behavior Analytics (UBA) baselines normal login behavior — typical source IPs, times, geographies, and device fingerprints — so the SIEM can flag the failed-logins-then-successful-login pattern only when it deviates from established norms. This contextual awareness dramatically reduces false positives from legitimate users who mistype passwords or log in from new locations. It maintains detection effectiveness because the attack pattern itself (credential stuffing or password spraying followed by success) still surfaces as an anomaly.

Answer

Create a rule that alerts on any failed login

Answer

Correlate only with known malicious IP addresses

Answer

Set a threshold of 10 failed logins within 5 minutes

Question 20

Which phase of the incident response lifecycle involves removing the threat from the environment and restoring systems to normal operations?

Accepted Answer

Eradication. Eradication is the incident response phase where the root cause and malicious artifacts (malware, compromised accounts, backdoors) are removed from the environment, and systems are cleaned and restored to a trusted state. It follows containment and precedes recovery/lessons learned. This matches the question's description of removing the threat and restoring normal operations.

Answer

Lessons Learned

Answer

Containment

Answer

Detection