CAS-004 Security Operations Practice Test 7 — 15 Questions

Question 1

A security analyst is reviewing threat intelligence feeds and notices indicators from a known APT group. Which threat intelligence sharing standard is most commonly used to structure and share such cyber threat information in a machine-readable format?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) and TAXII (Trusted Automated Exchange of Intelligence Information) are the standard protocols for sharing cyber threat intelligence in a structured, machine-readable format. STIX defines the data model, and TAXII defines the transport mechanism.

Answer

CybOX

Answer

MITRE ATT&CK

Answer

OpenIOC

Question 2

During a security incident, a forensic investigator needs to acquire volatile data from a compromised server. Which of the following is the correct order for collecting volatile data according to the standard digital forensics process?

Accepted Answer

Memory, network connections, processes, disk. The standard order of volatility (RFC 3227) recommends collecting data in order of decreasing volatility: memory (RAM) first, then network connections, then process information, then disk. This ensures that the most volatile data is preserved before it changes.

Answer

Processes, memory, disk, network connections

Answer

Disk, memory, network connections, processes

Answer

Network connections, memory, disk, processes

Question 3

A security operations center (SOC) analyst is investigating a potential malware infection on a workstation. The analyst wants to perform static analysis on a suspicious executable. Which tool or technique is most appropriate for examining the executable without executing it?

Accepted Answer

Use the strings command to extract readable ASCII and Unicode strings. Static analysis involves examining the file without running it. Using a disassembler like IDA Pro or a tool to view strings and PE headers is typical. Strings utility extracts readable text from the binary, which can reveal clues about its functionality.

Answer

Run the executable in a sandbox

Answer

Use a memory forensics tool like Volatility

Answer

Perform a network traffic capture

Question 4

A SOC analyst is tuning a SIEM correlation rule to detect lateral movement. The rule currently triggers on a single failed authentication followed by a successful authentication from a new IP address within 5 minutes. Which improvement would best reduce false positives while maintaining detection of pass-the-hash attacks?

Accepted Answer

Require two failed authentications before the success. Pass-the-hash attacks often involve a single failed authentication (due to incorrect hash) followed by a success. However, requiring two failures before the success would reduce false positives from accidental typos while still catching many pass-the-hash attempts. Adding source IP whitelisting can also cut false positives from admins.

Answer

Increase the time window to 30 minutes

Answer

Add a condition that the source IP is not in the company's IP range

Answer

Remove the failed authentication requirement and only trigger on successful authentication from a new IP

Question 5

A penetration tester is performing a test against a web application. During active reconnaissance, the tester discovers that the application discloses version numbers in HTTP headers. Which phase of the penetration testing lifecycle does this activity belong to?

Accepted Answer

Reconnaissance. Active reconnaissance involves directly interacting with the target to gather information, such as by sending probes and analyzing responses. Discovering version numbers via HTTP headers is a form of active reconnaissance because the tester is making requests and inferring information from the responses.

Answer

Post-exploitation

Answer

Exploitation

Answer

Reporting

Question 6

A security team is implementing deception technology to detect attackers inside the network. They plan to deploy fake systems that appear vulnerable and attract attackers. Which of the following is an example of a honeytoken?

Accepted Answer

A fake database credential file that triggers an alert when opened. A honeytoken is a decoy object such as a fake credential, file, or database record that is used to detect unauthorized access. A fake database credential file that triggers an alert when accessed is a typical honeytoken.

Answer

A network segment with multiple decoy systems

Answer

A fake DNS entry for a non-existent domain

Answer

A virtual machine running a vulnerable web server

Question 7

A vulnerability management team is prioritizing patches for a large enterprise. They have identified a critical vulnerability in a widely used software with a CVSS base score of 9.8. However, the exploit requires local access and authentication. Which CVSS metric should the team use to adjust the score to reflect the actual risk in their environment?

Accepted Answer

Environmental score. The question asks for a metric to adjust the CVSS base score to reflect actual risk in the organization's specific environment. The Environmental score is designed for this purpose, allowing customization based on factors such as security controls, asset criticality, and compensating measures. In contrast, the Temporal score adjusts for factors that change over time (e.g., exploit maturity), but it does not account for organization-specific context. Therefore, the Environmental score is the correct metric to use.

Answer

Privileges required metric

Answer

Temporal score

Answer

Attack vector metric

Question 8

During a threat hunting exercise, a hunter uses the MITRE ATT&CK framework to identify a series of behaviors: an attacker used PowerShell to download a payload, then created a scheduled task for persistence, and finally performed credential dumping via LSASS. Which ATT&CK tactic is associated with the credential dumping technique?

Accepted Answer

Credential Access. Credential dumping, specifically from LSASS, is a technique under the Credential Access tactic in the MITRE ATT&CK framework. The tactic describes the adversary's goal of stealing credentials.

Answer

Defense Evasion

Answer

Execution

Answer

Persistence

Question 9

A security analyst is analyzing a memory dump from a compromised host using Volatility. Which Volatility plugin would be most useful to identify a malicious process that is hidden from the standard process listing?

Accepted Answer

psxview. Volatility's psxview plugin uses cross-view techniques to detect hidden processes by comparing process lists from multiple sources (e.g., PsActiveProcessHead, EPROCESS pools, etc.). A process that appears in some lists but not others is likely hidden.

Answer

pstree

Answer

malfind

Answer

pslist

Question 10

An organization is developing a SOAR playbook to handle phishing emails reported by users. Which of the following actions is most appropriate to automate in the first step of the playbook?

Accepted Answer

Remove the email from all user mailboxes. The first step in a phishing response playbook should isolate the potentially malicious email to prevent further exposure. Automating the removal of the email from all user mailboxes is a common initial containment action.

Answer

Block the sender's email address at the gateway

Answer

Scan the attachment in a sandbox

Answer

Send an alert to the SOC analyst for manual analysis

Question 11

During a penetration test, the tester gains access to a web server and wants to escalate privileges to root. The tester discovers that the web application runs with a service account that has the SeImpersonatePrivilege enabled. Which attack is most likely to succeed for privilege escalation?

Accepted Answer

JuicyPotato attack. SeImpersonatePrivilege allows a process to impersonate a user token. Tools like JuicyPotato exploit this privilege to impersonate SYSTEM by forcing a higher-privileged process to authenticate and then stealing its token. This is a common technique for local privilege escalation on Windows.

Answer

SQL injection

Answer

Pass-the-hash attack

Answer

DLL hijacking

Question 12

A security team is evaluating an EDR solution. Which of the following capabilities is a primary differentiator between EDR and traditional antivirus?

Accepted Answer

Behavioral analysis and detection. EDR focuses on continuous monitoring and recording of endpoint activities, enabling detection of suspicious behaviors that may indicate an attack, even if no known signature exists. Traditional antivirus relies on signature-based detection. Behavior-based detection is a core EDR capability.

Answer

Centralized policy management

Answer

File integrity monitoring

Answer

Signature-based detection of known malware

Question 13

A SOC analyst is investigating a potential data exfiltration incident. The analyst suspects that an insider is using encrypted tunnels to transfer data. Which TWO of the following network traffic analysis (NTA) indicators are most likely to suggest encrypted exfiltration? (Choose two.)

Accepted Answer

Large data transfers to an external IP address during non-business hours. Unusual volumes of traffic to a single external IP, especially during off-hours, can indicate data exfiltration. Repeated connections to an external host using non-standard ports, even if encrypted, are suspicious because they may bypass security controls. DNS tunneling is detectable by high volumes of DNS queries to a single domain, but that is separate.

Answer

Multiple HTTP GET requests to a known content delivery network

Answer

A single large file upload to a cloud storage provider during work hours

Answer

High volumes of DNS queries to a single external domain

Question 14

A senior security architect is designing a detection strategy for advanced persistent threats (APTs) that employ living-off-the-land (LotL) techniques. Which THREE of the following approaches are most effective for detecting LotL activities? (Choose three.)

Accepted Answer

User and Entity Behavior Analytics (UEBA). LotL attackers use legitimate tools to avoid detection. Behavioral analytics can detect unusual usage patterns of native tools. Deception technologies can lure attackers into revealing themselves. Endpoint detection and response (EDR) that monitors process behavior can detect anomalies like PowerShell executing scripts from unusual locations.

Answer

Signature-based detection on malicious file hashes

Answer

Blocking all scripts and macros by default

Question 15

A security analyst is reviewing a CVSS score for a vulnerability that affects a critical server. The base score is 7.5, but the analyst needs to adjust for the environment. Which TWO of the following are valid CVSS environmental metrics that can modify the score? (Choose two.)

Accepted Answer

Modified Attack Vector (MAV). CVSS environmental metrics include Confidentiality Requirement, Integrity Requirement, and Availability Requirement (the CIA requirements), as well as Modified Attack Vector, Modified Attack Complexity, etc. The question asks for metrics that modify the score; Modified Attack Vector and Modified Privileges Required are environmental metrics that adjust the base according to the environment.

Answer

Exploit Code Maturity (ECM)

Answer

Privileges Required (PR)

Answer

Attack Vector (AV)