CAS-004 Security Operations Practice Test 3 — 15 Questions

Question 1

A security operations center (SOC) is implementing User Behavior Analytics (UBA) to detect insider threats. Which TWO of the following data sources are most critical for establishing a baseline of normal user behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication logs from Active Directory. UBA relies on authentication logs to understand login patterns and network traffic logs to understand communication patterns. HR records and email content are less relevant for technical baselines; threat feeds are external.

Answer

Threat intelligence feeds

Answer

HR records of employee performance reviews

Answer

Email content and subject lines

Question 2

A security analyst is investigating a phishing campaign targeting the organization. The threat intelligence team has provided indicators such as email subject lines, sender domains, and attachment hashes. However, the analyst notices that these IOCs change rapidly and are only effective for a short period. Which type of threat intelligence would provide more durable and actionable information for defending against this campaign?

Accepted Answer

TTP-based threat intelligence. TTP-based intelligence focuses on the adversary's behavior, such as tactics, techniques, and procedures, which are more stable over time compared to fast-changing IOCs like hashes and domains. This aligns with the ATT&CK framework.

Answer

STIX/TAXII feeds

Answer

IoC-based threat intelligence

Answer

Strategic threat intelligence

Question 3

During an incident response, a forensic analyst captures the memory of a compromised Windows system. Using Volatility, the analyst runs the 'pslist' command and sees a suspicious process 'svchost.exe' with a parent process 'explorer.exe'. Which Volatility plugin should the analyst use next to detect potential process hollowing?

Accepted Answer

malfind. Process hollowing occurs when a legitimate process is created in a suspended state, its memory is unmapped, and malicious code is written. The 'malfind' plugin identifies processes with suspicious memory characteristics (e.g., executable memory not mapped to a file).

Answer

netscan

Answer

psxview

Answer

dlllist

Question 4

A vulnerability management team is prioritizing patches for a set of critical vulnerabilities. Vulnerability A has a CVSS base score of 9.8, vulnerability B has a CVSS base score of 7.5, and vulnerability C has a CVSS base score of 8.2. However, vulnerability B is actively being exploited in the wild, while the others are not. Which vulnerability should be patched first according to best practices?

Accepted Answer

Vulnerability B because it is actively exploited. While CVSS base score is important, temporal factors like active exploitation increase risk. Vulnerability B, despite a lower base score, is being exploited and thus poses a more immediate threat. Patching should prioritize actively exploited vulnerabilities.

Answer

All three should be patched simultaneously

Answer

Vulnerability C because it has a higher base score than B

Answer

Vulnerability A because it has the highest base score

Question 5

An organization needs to ensure that evidence collected during a forensic investigation remains intact and admissible in court. Which process is most critical for maintaining the integrity of digital evidence?

Accepted Answer

Maintaining an unbroken chain of custody. Chain of custody documents every person who handled the evidence, from collection to presentation in court, ensuring that evidence has not been tampered with. This is essential for admissibility.

Answer

Storing evidence in a secure locker

Answer

Using write-blockers when imaging drives

Answer

Hashing the evidence with SHA-256

Question 6

A security operations center (SOC) analyst receives an alert from the SIEM indicating a user has logged into the corporate VPN from an unusual geographic location at 3 AM, which is outside the user's normal working hours. The user has not previously exhibited this behavior. Which advanced SIEM capability is most likely responsible for generating this alert?

Accepted Answer

User Behavior Analytics (UBA). User Behavior Analytics (UBA) uses machine learning to establish a baseline of normal user activity and detect anomalies such as unusual login times and locations. This is a core feature of advanced SIEM platforms.

Answer

Correlation rule based on static thresholds

Answer

Signature-based detection

Answer

Threat intelligence feed correlation

Question 7

A penetration tester is performing an assessment of a web application. During reconnaissance, the tester discovers a publicly accessible Jenkins server with default credentials. The tester gains access and finds a build job that executes arbitrary commands. What is the most effective way for the tester to escalate privileges and move laterally within the network?

Accepted Answer

Use Jenkins to execute a reverse shell and then perform pass-the-hash. Jenkins can be configured as a Windows service, often running with high privileges (e.g., SYSTEM). Using the Jenkins script console or a build job, the tester can execute commands to extract credentials, install backdoors, or move laterally. This is a common attack path.

Answer

Exploit a SQL injection vulnerability in the web app

Answer

Use a vulnerability scanner to find additional CVEs

Answer

Deploy a ransomware payload to encrypt files

Question 8

An organization wants to detect and respond to advanced threats that may evade traditional endpoint security solutions. They deploy an EDR solution that provides real-time visibility into endpoint activities. However, the security team is overwhelmed by alerts. Which technology can be integrated with EDR to automate response actions and reduce alert fatigue?

Accepted Answer

SOAR platform. SOAR platforms ingest alerts from various sources (including EDR) and use playbooks to automate incident response actions, such as isolating a host or blocking an IP. This reduces manual effort and alert fatigue.

Answer

SIEM with correlation rules

Answer

Network traffic analysis (NTA)

Answer

Deception technology

Question 9

A security analyst is investigating a malware sample found on a workstation. The analyst wants to determine the malware's capabilities without executing it. Which type of malware analysis involves examining the binary's strings, headers, and structure?

Accepted Answer

Static analysis. Static analysis involves examining the malware's code and structure without running it. This includes looking at strings (e.g., IP addresses, registry keys), PE headers, and imports/exports to understand functionality.

Answer

Dynamic analysis

Answer

Reverse engineering

Answer

Memory forensics

Question 10

During a penetration test, the tester has obtained a foothold on an internal server. The tester wants to identify other systems on the network and find potential targets for lateral movement. Which type of reconnaissance is MOST appropriate in this scenario?

Accepted Answer

Internal network scanning with Nmap. Active reconnaissance on internal networks (e.g., port scanning, OS fingerprinting) is appropriate after gaining a foothold, as it provides detailed information about adjacent systems. Passive reconnaissance (like sniffing) might be stealthier but active scanning is more effective for mapping.

Answer

OSINT gathering via Shodan

Answer

Social engineering attacks on employees

Answer

Passive sniffing with Wireshark

Question 11

A security engineer is implementing deception technology to detect lateral movement by adversaries. Which type of deception resource would be MOST effective for capturing adversary credential harvesting activities on a network segment that contains no real domain controllers?

Accepted Answer

A honeytoken in the form of a fake service account password. A honeytoken (e.g., a fake credential file or a service account password) planted on a system can trigger an alert when an adversary attempts to use it. A fake domain controller honeypot is also effective but may require more resources. However, a honeytoken is specifically designed to be used by attackers and is simple to deploy.

Answer

A SIEM correlation rule for anomalous logins

Answer

A network-based intrusion detection system (NIDS)

Answer

A honeypot configured as a domain controller

Question 12

An organization is unable to patch a critical vulnerability in a legacy application due to vendor limitations. The risk assessment indicates a high likelihood of exploitation. Which compensating control should the organization implement to reduce the risk?

Accepted Answer

Implement network segmentation to isolate the application. When patching is not possible, compensating controls such as network segmentation, application whitelisting, or strict access controls can mitigate the risk. Network segmentation limits the attack surface by isolating the vulnerable system.

Answer

Deploy an additional firewall in front of the application

Answer

Disable the application until a patch is available

Answer

Increase the frequency of vulnerability scanning

Question 13

A security analyst is reviewing a SIEM alert that indicates a user's credentials were used to log in from two different countries within a span of 10 minutes. This is likely an indicator of what type of attack?

Accepted Answer

Credential theft and reuse. A login from two distant locations in a short time suggests credential theft and reuse, which is characteristic of a credential stuffing or account takeover attack. The attacker likely obtained the credentials and is using them from a different location.

Answer

Brute-force attack

Answer

Man-in-the-middle attack

Answer

Pass-the-hash attack

Question 14

A security operations team is designing a threat hunting program. They want to use the MITRE ATT&CK framework to structure their hunts. Which TWO components of the ATT&CK framework should they focus on to develop hypothesis-driven hunts? (Select TWO.)

Accepted Answer

Tactics. Hypothesis-driven hunts are based on tactics (why) and techniques (how). Procedures are specific implementations but too granular for initial hypotheses. IOCs are not part of ATT&CK framework components.

Answer

Indicators of Compromise (IOCs)

Answer

Procedures

Answer

Mitigations

Question 15

A security engineer is reviewing the results of a penetration test. The tester successfully exploited a vulnerability in a web application and escalated privileges to domain admin. Which THREE of the following findings should be included in the technical report to provide actionable remediation steps? (Select THREE.)

Accepted Answer

The recommendation to patch the web application. The technical report should include specific recommendations (patch, input validation), evidence (command used), and impact (privilege escalation path). The business impact belongs in the executive summary.

Answer

The estimated financial loss from the exploit

Answer

The name and contact of the penetration tester