CAS-004 Security Operations Practice Test 4 — 15 Questions

Question 1

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an attacker used DNS tunneling to exfiltrate data. Which THREE network traffic indicators would support this hypothesis? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Large DNS response packets (greater than 512 bytes). DNS tunneling uses DNS queries to exfiltrate data, often characterized by high volume of queries, unusual domain names, and abnormally large DNS packets. Data sent in clear text (unencrypted) over HTTP is not typical of DNS tunneling.

Answer

A sudden increase in failed login attempts

Answer

Unencrypted HTTP traffic to external IPs

Question 2

During a threat hunting exercise, a security analyst hypothesizes that an adversary is using PowerShell to execute malicious scripts. Which approach is the analyst employing?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a specific assumption about adversary behavior, unlike IoC-driven (based on known indicators) or TTP-driven (focused on tactics, techniques, procedures).

Answer

TTP-driven hunting

Answer

Machine learning-driven hunting

Answer

IoC-driven hunting

Question 3

An organization uses a SIEM to collect logs from multiple sources. The security team wants to identify users who are accessing resources outside of normal business hours and exhibiting unusual data transfer patterns. Which advanced SIEM capability would be most effective?

Accepted Answer

User and Entity Behavior Analytics (UEBA). User and Entity Behavior Analytics (UEBA) establishes baselines for user activity and detects anomalies, such as unusual access times and data transfer patterns.

Answer

Threat intelligence feed integration

Answer

Log normalization and aggregation

Answer

Correlation rules with threshold-based alerts

Question 4

A security analyst is performing incident response and needs to collect evidence from a live system. Which of the following should be collected first to preserve volatile data?

Accepted Answer

Memory (RAM). The order of volatility dictates that memory (RAM) is the most volatile and must be captured before any other evidence.

Answer

Network connections

Answer

Hard drive contents

Answer

System logs

Question 5

During a penetration test, the tester has gained initial access to a network and now aims to move laterally to a sensitive database server. Which phase of the penetration testing lifecycle does this activity represent?

Accepted Answer

Post-exploitation. Lateral movement occurs after initial access is gained, which is the defining characteristic of the post-exploitation phase. In the penetration testing lifecycle, post-exploitation encompasses activities such as lateral movement, privilege escalation, and data exfiltration, whereas exploitation focuses on gaining the initial foothold through vulnerabilities.

Answer

Exploitation

Answer

Reporting

Answer

Reconnaissance

Question 6

An organization discovers a critical vulnerability in a legacy application that cannot be patched due to vendor end-of-life. Which of the following is the BEST compensating control to reduce risk?

Accepted Answer

Implement network segmentation to isolate the application. Network segmentation isolates the vulnerable system, reducing the attack surface and limiting potential damage.

Answer

Increase logging and monitoring

Answer

Apply a virtual patch using an intrusion prevention system (IPS)

Answer

Decommission the application immediately

Question 7

A security analyst is investigating a malware sample and wants to determine its capabilities without executing it. The analyst examines the binary's imports, strings, and structure. What type of analysis is being performed?

Accepted Answer

Static analysis. Static analysis examines the malware without executing it, focusing on file metadata, strings, imports, and other characteristics.

Answer

Memory analysis

Answer

Reverse engineering

Answer

Dynamic analysis

Question 8

Which component of the MITRE ATT&CK framework categorizes the 'why' of an adversary's action, such as initial access or credential access?

Accepted Answer

Tactics. Tactics represent the adversary's goal or reason for performing an action, such as gaining initial access.

Answer

Mitigations

Answer

Procedures

Answer

Techniques

Question 9

A SOC team receives an alert from a SOAR platform indicating a potential phishing email. The SOAR playbook automatically quarantines the email, blocks the sender, and opens a ticket. This is an example of which SOAR capability?

Accepted Answer

Automation. Automation is the ability to execute predefined actions without human intervention, as in automatically quarantining and blocking.

Answer

Response

Answer

Orchestration

Answer

Correlation

Question 10

An organization wants to detect attackers who have already breached the network by deploying decoy credentials and data files. Which type of deception technology should they use?

Accepted Answer

Honeytoken. Honeytokens are decoy data objects, such as fake credentials or files, used to detect unauthorized access.

Answer

Sandbox

Answer

Honeypot

Answer

Honeynet

Question 11

A security analyst is analyzing a memory dump using Volatility. The analyst wants to list all running processes and identify any hidden processes. Which Volatility plugin should be used?

Accepted Answer

psscan. The pslist plugin lists processes from the doubly linked list, while psscan uses pool tag scanning to find hidden processes that are not in the linked list.

Answer

psxview

Answer

pslist

Answer

pstree

Question 12

A security team is preparing for a penetration test. Which document defines the scope, rules, and restrictions for the test?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) is a formal document that outlines the scope, permissions, and constraints of a penetration test.

Answer

Memorandum of Understanding (MOU)

Answer

Statement of Work (SoW)

Answer

Service Level Agreement (SLA)

Question 13

A vulnerability has a CVSS base score of 9.8. The vulnerability is present on a server that is not exposed to the internet but is accessible to internal users with valid credentials. Which CVSS metric should be adjusted to reflect the reduced risk?

Accepted Answer

Environmental score. The Environmental Score allows customization based on specific organizational context, such as modified access requirements.

Answer

None, the base score should be used as-is

Answer

Temporal score

Answer

Base score

Question 14

A security analyst is triaging a suspicious file. The analyst wants to perform static analysis to gather initial information. Which TWO of the following are static analysis techniques?

Accepted Answer

Checking the file hash against known malware databases. Static analysis examines the file without executing it. Checking file hashes against known malware databases and extracting strings from the binary are static techniques. Running in a sandbox is dynamic, and disassembly is more advanced reverse engineering.

Answer

Running the file in a sandbox

Answer

Disassembling the binary to examine assembly code

Answer

Observing network traffic generated by the file

Question 15

During an incident response, a team is prioritizing containment actions. Which THREE of the following actions should be taken to contain the incident effectively?

Accepted Answer

Blocking malicious IP addresses at the firewall. Containment focuses on stopping the spread and limiting damage. Blocking malicious IPs at the firewall, isolating affected systems from the network, and disabling compromised user accounts are key containment steps. Collecting forensic images is part of evidence preservation, not containment, and notifying law enforcement is optional and not a containment action.

Answer

Notifying law enforcement

Answer

Collecting forensic images of affected systems