CAS-004 Security Operations Practice Test 5 — 15 Questions

Question 1

A security analyst is reviewing CVSS scores for vulnerability prioritization. Which TWO of the following are component metric groups in CVSS v3?

Accepted Answer

Temporal. CVSS v3 consists of Base, Temporal, and Environmental metric groups. Exploitability and Impact are sub-scores within the Base group, not separate groups.

Answer

Impact

Answer

Exploitability

Answer

Attack Vector

Question 2

A security analyst is reviewing a suspicious file. Which static analysis technique would the analyst use to examine the file without executing it?

Accepted Answer

Use strings to extract readable text. Static analysis examines the file without running it. Running strings extracts readable text, which can reveal clues like IP addresses or commands.

Answer

Submit the file to VirusTotal

Answer

Execute the file in a debugger

Answer

Run the file in a sandbox

Question 3

During an incident response, a security analyst identifies a previously unknown malware variant. Which type of threat intelligence feed would provide the most timely and structured information about this threat?

Accepted Answer

STIX/TAXII feed. STIX/TAXII enables sharing of structured threat intelligence in a standardized format, allowing for automated consumption and immediate updates.

Answer

An ISAC

Answer

Open source intelligence (OSINT)

Answer

A commercial threat feed

Question 4

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect a known attack pattern that involves multiple failed logins followed by a successful login from a different IP address. Which approach best reduces false positives while maintaining detection effectiveness?

Accepted Answer

Use User Behavior Analytics (UBA) to baseline normal login patterns. UBA establishes a baseline of user behavior and flags deviations, reducing false positives from legitimate multiple failed logins (e.g., forgotten passwords) while still detecting anomalous patterns.

Answer

Create a rule that alerts on any failed login

Answer

Correlate only with known malicious IP addresses

Answer

Set a threshold of 10 failed logins within 5 minutes

Question 5

A security analyst is conducting a threat hunt based on the hypothesis that an adversary may have used PowerShell to execute malicious scripts. Which threat hunting methodology is being employed?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a hypothesis about potential adversary behavior, then searches for evidence. The analyst is hypothesizing that PowerShell was abused.

Answer

IoC-driven hunting

Answer

TTP-driven hunting

Answer

Baseline-driven hunting

Question 6

Which phase of the incident response lifecycle involves removing the threat from the environment and restoring systems to normal operations?

Accepted Answer

Eradication. Eradication removes the threat; recovery restores normal operations. The question combines both, but typically 'eradication' is the removal phase.

Answer

Lessons Learned

Answer

Containment

Answer

Detection

Question 7

An organization uses an EDR solution and wants to detect ransomware that encrypts files and then deletes volume shadow copies. Which EDR detection technique would be most effective for this behavior?

Accepted Answer

Behavioral detection for mass file modifications and vssadmin.exe execution. Behavioral detection monitors runtime behavior like file encryption and shadow copy deletion, which are indicative of ransomware.

Answer

Signature-based detection using file hashes

Answer

Allowlisting of trusted applications

Answer

Network traffic analysis to detect C2 communication

Question 8

During a vulnerability assessment, a security analyst discovers a critical vulnerability in a legacy application that cannot be patched due to vendor end-of-life. Which compensating control would best mitigate the risk?

Accepted Answer

Implement network segmentation to isolate the application. Network segmentation isolates the vulnerable system, reducing the attack surface and preventing lateral movement from a compromised system.

Answer

Apply a virtual patch via an intrusion prevention system (IPS)

Answer

Increase logging and monitoring for that application

Answer

Decommission the application immediately

Question 9

A security analyst is collecting evidence from a compromised workstation. Which of the following should be collected first to preserve volatile data?

Accepted Answer

Memory dump. Volatile data includes memory contents, network connections, and running processes. Memory is the most volatile and should be captured first.

Answer

Hard drive image

Answer

Network capture

Answer

Event logs

Question 10

A SOC team is implementing a SOAR playbook to automate response to phishing emails reported by users. Which step should be included in the playbook to prevent other users from accessing the malicious link?

Accepted Answer

Block the malicious URL in the web proxy. URL blocking in a web proxy prevents other users from accessing the malicious link, which is a common automated response in phishing playbooks.

Answer

Isolate the reporter's workstation

Answer

Reset the reporter's password

Answer

Delete the email from all mailboxes

Question 11

An analyst is examining a memory dump with Volatility and finds a suspicious process that has no parent process (parent PID 0). Which technique is the malware likely using to hide?

Accepted Answer

Process hollowing. Process hollowing replaces the memory of a legitimate process with malicious code. The parent PID 0 indicates that the process was spawned by the kernel, which can occur after hollowing.

Answer

Rootkit

Answer

DLL injection

Answer

WMI persistence

Question 12

Which CVSS metric component is used to reflect the impact of a vulnerability based on the specific environment of an organization?

Accepted Answer

Environmental metric. The environmental metric allows customization of CVSS score based on the organization's environment, including security requirements and modified base metrics.

Answer

Attack vector metric

Answer

Temporal metric

Answer

Base metric

Question 13

A security operations team is implementing deception technology to detect lateral movement. Which TWO of the following are examples of deception technologies? (Select TWO.)

Accepted Answer

Honeytoken. Honeypots are decoy systems, and honeytokens are fake credentials or data used to trigger alerts when accessed.

Answer

Intrusion prevention system

Answer

Endpoint detection and response (EDR)

Answer

Security information and event management (SIEM)

Question 14

A penetration tester is performing reconnaissance against a target. Which TWO of the following are examples of active reconnaissance? (Select TWO.)

Accepted Answer

Banner grabbing. Active reconnaissance involves direct interaction with the target. Port scanning and banner grabbing are active; OSINT and WHOIS lookups are passive (no direct interaction).

Answer

Social media profiling

Answer

WHOIS lookup

Answer

Searching job postings for technology details

Question 15

A security analyst is using the MITRE ATT&CK framework to map adversarial behaviors. Which THREE of the following are tactics defined by ATT&CK? (Select THREE.)

Accepted Answer

Privilege escalation. Persistence, privilege escalation, and exfiltration are all ATT&CK tactics. Phishing is a technique, not a tactic; incident response is a process, not a tactic.

Answer

Incident response

Answer

Phishing