CAS-004 Security Operations Practice Test 2 — 15 Questions

Question 1

A penetration tester is planning a test for a client that has a critical web application. The rules of engagement specify that the tester must avoid causing a denial of service (DoS). Which THREE actions are appropriate for the tester to include in the scope? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Port scanning to identify open services on the web server. Port scanning, SQL injection testing, and directory brute-forcing are common penetration testing activities that do not inherently cause DoS. DoS attacks and social engineering without approval are typically out of scope.

Answer

Conducting social engineering attacks against employees without prior approval

Answer

Performing a distributed denial-of-service (DDoS) attack to test resilience

Question 2

During a security incident, the incident response team has identified the root cause and removed the threat from all affected systems. Which phase of the incident response lifecycle involves returning systems to normal operation and monitoring for any signs of recurrence?

Accepted Answer

Recovery. The incident response lifecycle includes preparation, detection, containment, eradication, recovery, and lessons learned. Recovery is the phase where systems are restored to normal operation and monitoring is implemented to ensure the threat does not return.

Answer

Eradication

Answer

Containment

Answer

Lessons Learned

Question 3

A security analyst is using the MITRE ATT&CK framework to categorize adversary behavior observed in recent incidents. The analyst notes that the adversary used spearphishing with a malicious attachment to gain initial access, then executed a PowerShell script to download additional tools. Which ATT&CK tactic is the PowerShell execution associated with?

Accepted Answer

Execution. Execution is the tactic that covers techniques that result in adversary-controlled code running on a system. PowerShell execution is a common technique under the Execution tactic.

Answer

Defense Evasion

Answer

Initial Access

Answer

Command and Control

Question 4

A security engineer is configuring a SIEM correlation rule to detect a potential data exfiltration attempt. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address that has never been communicated with before, within a 5-minute window. Additionally, the external IP should not be on any whitelist. Which correlation logic best implements this detection?

Accepted Answer

Alert when a host sends >10 MB to an external IP that is not in the whitelist and not seen in the last 24 hours, aggregated over 5 minutes.. Ly implements the detection rule. It aggregates data transfer per host over 5 minutes, checks that the volume exceeds 10 MB, verifies the external IP is not on any whitelist, and ensures the IP has not been seen in the last 24 hours (i.e., it is a new destination). This matches all the requirements: a single internal host, >10 MB, to an external IP never communicated with before, within 5 minutes, and not whitelisted. Option B adds an unnecessary port 443 condition. Option C omits the requirement that the external IP must be new (unseen before). Option D aggregates over all external IPs without checking newness, which could alert on previously contacted IPs.

Answer

Alert when a host sends >10 MB to an external IP not in the whitelist and the destination port is 443.

Answer

Alert when any host sends >10 MB to an external IP not in the whitelist within 5 minutes.

Answer

Alert when a host sends >10 MB to any external IP aggregated over 5 minutes, then filter out whitelisted IPs.

Question 5

During a penetration test, the tester has gained initial access to a web server and wants to move laterally to a database server. Which of the following techniques would be most effective for identifying valid credentials that could be reused on the database server?

Accepted Answer

Using Mimikatz to dump credentials from memory. Mimikatz is a tool that extracts plaintext passwords, hashes, and Kerberos tickets from memory. It is commonly used for credential dumping to enable lateral movement.

Answer

Running a port scan on the internal network

Answer

Deploying a web shell for persistent access

Answer

Conducting a SQL injection on the database server

Question 6

A security analyst is reviewing a suspicious executable file. The analyst performs static analysis by examining the file's strings and imports. Which of the following findings would most strongly suggest the file is packed or obfuscated?

Accepted Answer

The file has very few readable strings. Packed executables often have very few readable strings because the original code is compressed or encrypted. A small number of strings relative to file size is a strong indicator of packing.

Answer

The file imports many Windows API functions

Answer

The file has a high entropy score

Answer

The file contains a large number of IP addresses

Question 7

An organization's vulnerability management team discovers a critical vulnerability in a legacy application that cannot be patched because the vendor no longer supports it. The application is essential for business operations. Which of the following compensating controls would best reduce the risk of exploitation while maintaining functionality?

Accepted Answer

Implement network segmentation and restrict access to the application. Network segmentation with strict firewall rules isolating the legacy application limits the attack surface and prevents lateral movement from compromised hosts. This is an effective compensating control when patching is not possible.

Answer

Apply a virtual patch using a web application firewall (WAF) rule

Answer

Disable the application until a replacement is found

Answer

Increase monitoring of the application without any access restrictions

Question 8

A security operations center (SOC) analyst is investigating an alert from an EDR tool indicating that a workstation executed a suspicious PowerShell command that decoded a base64 string. The decoded string contained a command to download a file from an external IP address. Which stage of the cyber kill chain does this activity most likely represent?

Accepted Answer

Actions on Objectives. The described activity—executing a PowerShell command that decodes a base64 string and downloads a file from an external IP—occurs after the attacker has already gained initial access. This is characteristic of the Actions on Objectives stage, where the attacker performs actions to achieve their goals, such as downloading additional tools for lateral movement, data exfiltration, or persistence. It is not Exploitation, which involves triggering the initial vulnerability to gain access; here, that access has already been established and the attacker is now taking further action.

Answer

Reconnaissance

Answer

Weaponization

Answer

Exploitation

Question 9

Which of the following is the primary purpose of a honeypot in a security operations environment?

Accepted Answer

To provide early detection of unauthorized activity. Honeypots are decoy systems designed to attract attackers, allowing security teams to observe their tactics, techniques, and procedures without risking real assets.

Answer

To encrypt sensitive data at rest

Answer

To replace the need for traditional firewalls

Answer

To block malicious traffic at the network perimeter

Question 10

During a forensic investigation, an analyst needs to collect volatile data from a compromised Linux server. Which of the following orders of volatility is correct for collecting the listed data?

Accepted Answer

Memory contents, network connections, processes, files on disk. The order of volatility starts with the most volatile data: memory contents, then network connections, then processes, and finally files on disk. Network connections and processes are both highly volatile but memory is the most volatile.

Answer

Processes, memory contents, files on disk, network connections

Answer

Files on disk, memory contents, processes, network connections

Answer

Network connections, processes, memory contents, files on disk

Question 11

A security analyst is using a SOAR platform to automate response to phishing emails reported by users. The playbook should perform the following actions in order: (1) extract indicators from the email, (2) query threat intelligence feeds for reputation, (3) if malicious, block the sender's domain at the email gateway and delete the email from all user inboxes. Which type of playbook step is most appropriate for step 3?

Accepted Answer

Action step. In SOAR, an action step performs a specific operation like blocking a domain or deleting emails. Conditional steps would check conditions, but the playbook already determined the email is malicious, so an action is needed.

Answer

Playbook trigger

Answer

Output step

Answer

Conditional step

Question 12

An organization is implementing a threat hunting program. The team decides to use a hypothesis-driven approach. Which of the following best describes this methodology?

Accepted Answer

Developing a theory about potential adversary behavior and actively looking for signs. Hypothesis-driven threat hunting starts with a hypothesis based on threat intelligence or risk assessments, then searches for evidence of that hypothesis in the environment.

Answer

Searching for known indicators of compromise from threat feeds

Answer

Automated scanning of all systems for vulnerabilities

Answer

Analyzing historical alerts for patterns

Question 13

Which of the following is the primary advantage of using STIX and TAXII for threat intelligence sharing?

Accepted Answer

They allow automated sharing of threat intelligence in a standardized format. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) provide a standardized framework for representing and exchanging threat intelligence, enabling interoperability between different tools and organizations.

Answer

They replace the need for a SIEM system

Answer

They perform dynamic analysis of malware samples

Answer

They provide real-time blocking of malicious IPs

Question 14

A security analyst is conducting a penetration test for a client. The rules of engagement specify that no social engineering is allowed. Which TWO of the following reconnaissance techniques are permitted under these rules?

Accepted Answer

Scanning the client's external network for open ports. Passive reconnaissance (OSINT) does not interact with the target and is allowed. Active reconnaissance without social engineering is also typically allowed if specified. Social engineering involves human interaction, which is prohibited.

Answer

Calling the help desk to obtain credentials

Answer

Sending phishing emails to employees

Answer

Tailgating into the building

Question 15

During a digital forensics investigation, an analyst is examining a Windows system suspected of being compromised. Which THREE of the following artifacts would be most useful for determining the timeline of the attack?

Accepted Answer

Windows Event Logs. Timestamps from the MFT (Master File Table), prefetch files, and event logs are key to establishing a timeline. Prefetch shows program execution, MFT shows file access/modification, and event logs record system events. The registry contains configuration data but not as reliable for timeline; SRUM is for resource usage but less direct.

Answer

Registry hives

Answer

System Resource Utilization Monitor (SRUM)