CAS-004 Security Operations Practice Test 6 — 15 Questions

Question 1

A security analyst is reviewing a suspicious process that has been identified on an endpoint. The analyst wants to determine if the process has any network connections and what data it might be sending. Which tool is most appropriate for analyzing the memory of the affected system to identify network connections and potential data exfiltration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Volatility. Volatility is a memory forensics tool that can analyze RAM dumps to extract network connections, processes, and other artifacts. It is the best choice for this task.

Answer

Wireshark

Answer

Autopsy

Answer

Nmap

Question 2

During an incident response, the team identifies that an attacker gained initial access via a phishing email containing a malicious macro. The macro downloaded a payload from a remote server. Which phase of the incident response lifecycle is currently being executed when the team identifies the phishing email as the attack vector?

Accepted Answer

Detection and analysis. Detection and analysis involves identifying the attack and determining its nature. The team has identified the vector, so they are in this phase.

Answer

Containment, eradication, and recovery

Answer

Preparation

Answer

Lessons learned

Question 3

An organization wants to share threat intelligence with industry peers using a standardized format. Which of the following formats is specifically designed for representing structured threat information in a machine-readable way?

Accepted Answer

STIX. STIX (Structured Threat Information Expression) is a standardized language for representing threat intelligence.

Answer

CyboX

Answer

TAXII

Answer

OpenIOC

Question 4

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect lateral movement using pass-the-hash attacks. The analyst wants to minimize false positives while ensuring detection of true positives. Which approach is most effective for reducing false positives in this scenario?

Accepted Answer

Compare authentication events against a baseline of normal user behavior and alert on anomalies. Baselining normal authentication behavior and alerting on deviations helps reduce false positives because legitimate pass-the-hash activity is rare.

Answer

Alert on any use of NTLM authentication

Answer

Alert on multiple failed logins followed by a successful login from a different workstation

Answer

Disable NTLM authentication across the network

Question 5

During a penetration test, the tester successfully gains access to a web server and wants to escalate privileges to domain administrator. The tester discovers that the web server has a service account that is a member of the local administrators group. Which technique would the tester most likely use to move laterally to a domain controller?

Accepted Answer

Pass-the-hash. Pass-the-hash allows the tester to use the hash of the service account to authenticate to other systems without the plaintext password, enabling lateral movement.

Answer

DNS poisoning

Answer

ARP spoofing

Answer

SQL injection

Question 6

A security analyst is investigating a potential malware infection on a user's workstation. The analyst wants to examine the file system for any suspicious files without altering the original data. Which forensic principle is the analyst following?

Accepted Answer

Chain of custody. Preserving the chain of custody ensures that evidence is not tampered with and maintains its integrity for legal proceedings.

Answer

Hashing

Answer

Order of volatility

Answer

Forensic imaging

Question 7

A SOC team is implementing a SOAR platform to automate responses to phishing emails. The team wants to create a playbook that, upon detection of a phishing email, automatically quarantines the email from all mailboxes and blocks the sender's domain. Which type of playbook action is being described?

Accepted Answer

Automated action. Automated response actions are executed by the SOAR platform without human intervention, such as quarantining and blocking.

Answer

Advisory action

Answer

Manual action

Answer

Semi-automated action

Question 8

An organization has a critical vulnerability in a legacy application that cannot be patched due to vendor end-of-life. The application is required for business operations and is accessible only from the internal network. Which compensating control would best reduce the risk of exploitation while maintaining availability?

Accepted Answer

Implement network segmentation and strict ACLs to limit access to the application. Network segmentation and strict ACLs limit access to the vulnerable application, reducing the attack surface without patching.

Answer

Deploy a host-based intrusion prevention system (HIPS) on the server

Answer

Apply a vendor-supplied patch

Answer

Uninstall the application

Question 9

A threat hunter is looking for signs of a ransomware attack that encrypts files and drops a ransom note. The hunter decides to search for processes that have modified many files in a short period. Which threat hunting methodology is being used?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a hypothesis about a threat and then searches for evidence. The hunter is hypothesizing about ransomware behavior.

Answer

TTP-driven hunting

Answer

Machine learning-driven hunting

Answer

IoC-driven hunting

Question 10

An organization wants to deploy a technology that lures attackers into a controlled environment to observe their tactics, techniques, and procedures (TTPs). Which deception technology should the organization implement?

Accepted Answer

Honeypot. A honeypot is a decoy system designed to attract attackers and gather intelligence.

Answer

Honeytoken

Answer

EDR

Answer

SIEM

Question 11

During a malware analysis, an analyst runs a suspicious binary in a sandbox and observes that it attempts to communicate with a known malicious IP address, modifies registry keys, and creates a service. The analyst then extracts strings from the binary and finds references to a specific C2 server. Which analysis phase does the extraction of strings represent?

Accepted Answer

Static analysis. Static analysis involves examining the binary without executing it, such as extracting strings and PE headers.

Answer

Dynamic analysis

Answer

Reverse engineering

Answer

Memory analysis

Question 12

A security analyst is reviewing CVSS scores for vulnerabilities in the environment. A vulnerability has a base score of 9.0, but the organization has a compensating control that reduces the likelihood of exploitation. The analyst adjusts the score to 6.0 for prioritization. Which CVSS metric group did the analyst modify?

Accepted Answer

Environmental. The environmental score allows customization based on the organization's environment, including compensating controls.

Answer

Base

Answer

Vector

Answer

Temporal

Question 13

A security team is implementing a threat intelligence program and wants to consume intelligence from various sources. Which TWO of the following are commonly used threat intelligence feeds or sharing mechanisms? (Select TWO.)

Accepted Answer

ISACs. STIX/TAXII is a standard for sharing threat intelligence, and ISACs are industry-specific sharing groups.

Answer

DNS

Answer

SMTP

Answer

HTTP

Question 14

An incident response team is handling a ransomware incident. The team has successfully contained the threat and is now in the eradication phase. Which THREE actions are appropriate for the eradication phase? (Select THREE.)

Accepted Answer

Apply security patches to the vulnerability that allowed initial access. Eradication involves removing the threat completely: deleting malware, revoking compromised credentials, and patching vulnerabilities.

Answer

Restore systems from clean backups

Answer

Conduct a lessons learned meeting

Question 15

A penetration tester is planning a test against a web application. The rules of engagement specify that the tester must not disrupt production services. Which TWO reconnaissance techniques are considered passive and would be appropriate for initial information gathering without impacting the target? (Select TWO.)

Accepted Answer

WHOIS lookup on the domain. OSINT uses publicly available information and WHOIS queries are passive, as they do not interact with the target system directly.

Answer

Port scanning the target network

Answer

Vulnerability scanning

Answer

Social engineering attacks