CAS-004 Security Operations Practice Test 8 — 15 Questions

Question 1

A security analyst is reviewing threat intelligence feeds and notices that a known Advanced Persistent Threat (APT) group has been using a specific technique to move laterally within networks. The analyst wants to map this technique to the MITRE ATT&CK framework. Which resource would the analyst use to find the corresponding ATT&CK technique ID?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MITRE ATT&CK Navigator or website. The MITRE ATT&CK framework provides a structured taxonomy of adversary behaviors, including techniques and procedures. The ATT&CK website or database allows mapping observed behaviors to specific technique IDs.

Answer

NIST SP 800-61

Answer

STIX/TAXII feeds

Answer

CVE database

Question 2

During an incident response engagement, the team has completed containment and eradication. What is the next phase in the incident response lifecycle according to NIST SP 800-61?

Accepted Answer

Recovery. The NIST incident response lifecycle includes Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity (lessons learned). After eradication, recovery follows.

Answer

Preparation

Answer

Detection

Answer

Lessons Learned

Question 3

A SOC analyst is investigating a suspicious process that is making outbound connections to an unknown IP address. The analyst wants to examine the process memory for injected code. Which Volatility plugin is most appropriate for detecting code injection by listing all Virtual Address Descriptors (VADs) that are mapped as executable and writable?

Accepted Answer

malfind. Volatility's 'malfind' plugin scans VADs and looks for executable and writable pages that may indicate injected code. It is commonly used for detecting code injection.

Answer

netscan

Answer

pslist

Answer

dlllist

Question 4

An organization is implementing a SOAR solution to automate responses to common incidents. They want to create a playbook for phishing email handling. Which of the following actions should be automated in the playbook after a user reports a suspicious email?

Accepted Answer

Extract URLs and attachments, query threat intel feeds, and if malicious, block indicators and isolate the affected endpoint. A SOAR playbook for phishing should automate initial triage actions such as extracting indicators and checking against threat intelligence, then isolating the user's system if malicious.

Answer

Call the user to confirm they clicked the link

Answer

Send a warning email to all users

Answer

Immediately delete the email from all user inboxes

Question 5

A vulnerability scanner reports a critical vulnerability on a critical server with a CVSS v3.1 base score of 9.8. The server cannot be patched immediately due to vendor constraints. Which of the following should the security team implement as a compensating control?

Accepted Answer

Isolate the server on a separate network segment with strict firewall rules. When a patch cannot be applied, compensating controls such as network segmentation, firewall rules, or WAF can reduce risk. Network isolation is a common compensating control.

Answer

Disable the server until a patch is available

Answer

Increase monitoring of the server

Answer

Apply a workaround provided by the vendor

Question 6

A penetration tester is in the post-exploitation phase and wants to maintain access to a compromised system. Which of the following techniques is most effective for establishing persistent access while evading detection?

Accepted Answer

Creating a scheduled task that executes a reverse shell. Creating a scheduled task that executes a backdoor is a common persistence mechanism. It can be disguised and runs at system startup or on a schedule, making it harder to detect.

Answer

Uploading a web shell to a publicly accessible directory

Answer

Creating a new local user account with administrative privileges

Answer

Installing a rogue certificate authority

Question 7

An incident responder is analyzing a malware sample obtained from an infected host. The responder wants to perform dynamic analysis to observe the malware's behavior in a safe environment. Which of the following is the best approach?

Accepted Answer

Execute the malware in a virtual machine with network monitoring tools. Dynamic analysis involves running the malware in a controlled environment like a sandbox to observe its behavior, including network traffic, file system changes, and registry modifications.

Answer

Check the PE header for imported functions

Answer

Disassemble the malware using IDA Pro

Answer

Run strings on the malware binary

Question 8

A security analyst is tuning the SIEM and wants to create a correlation rule that detects potential lateral movement using pass-the-hash attacks. Which log sources are most essential for detecting this technique?

Accepted Answer

Windows Security Event Logs (4624) and network flow logs. Pass-the-hash attacks often use Windows authentication logs (Event ID 4624) and network logs for unusual remote connections. Windows Security Event Logs and network logs are key.

Answer

DNS logs and web proxy logs

Answer

Application logs and antivirus logs

Answer

DHCP logs and VPN logs

Question 9

An organization wants to collect threat intelligence from multiple Information Sharing and Analysis Centers (ISACs) relevant to their industry. Which of the following is a primary benefit of participating in an ISAC?

Accepted Answer

Timely and relevant threat data from peers. ISACs provide a trusted community for sharing threat intelligence, early warnings, and best practices, helping members defend against sector-specific threats.

Answer

Free penetration testing services

Answer

Access to proprietary threat intelligence feeds

Answer

Ability to share sensitive information anonymously

Question 10

A digital forensics investigator is called to the scene of a potential data breach. The investigator must collect evidence from a live Windows system. Which of the following represents the correct order of volatility when collecting volatile data?

Accepted Answer

Memory, network connections, running processes, disk. The order of volatility dictates that the most volatile data (memory, network connections) should be collected first. The standard order: registers/cache, routing table, ARP cache, process table, kernel statistics, memory, temporary file systems, disk.

Answer

Network connections, memory, disk, running processes

Answer

Disk, memory, network connections, running processes

Answer

Running processes, memory, network connections, disk

Question 11

A SOC analyst is investigating an alert from the EDR system indicating that a user's workstation made multiple failed login attempts to a sensitive server, followed by a successful login from an unusual IP address. The analyst suspects a brute force attack. Which type of threat hunting methodology is being used?

Accepted Answer

Hypothesis-driven hunting. This is hypothesis-driven threat hunting, as the analyst starts with a hypothesis (brute force attack) and then searches for evidence to confirm or deny it based on the alert.

Answer

TTP-driven hunting

Answer

IoC-driven hunting

Answer

Baseline-driven hunting

Question 12

During a penetration test, the tester has gained initial access to a system and wants to escalate privileges. Which of the following techniques is most likely to be effective for privilege escalation on a Windows system?

Accepted Answer

Exploiting a local privilege escalation vulnerability like CVE-2023-xxxx. Exploiting a kernel vulnerability or a misconfigured service is a common privilege escalation technique. Token manipulation and DLL hijacking are also methods, but kernel exploits are direct.

Answer

Using Mimikatz to extract plaintext passwords from memory

Answer

Scanning for open ports on the network

Answer

Performing a phishing attack on the domain administrator

Question 13

A security architect is designing deception technologies to detect and delay attackers. Which TWO of the following are examples of deception technologies that can be deployed? Select TWO.

Accepted Answer

Honeytokens. Honeypots and honeytokens are classic deception technologies. Honeypots mimic real systems, and honeytokens are fake data objects.

Answer

Security Information and Event Management (SIEM)

Answer

Vulnerability scanner

Answer

Intrusion Prevention System (IPS)

Question 14

A threat intelligence analyst is profiling a threat actor that has been targeting the energy sector. Which THREE of the following attributes are most important to include in a threat actor profile? Select THREE.

Accepted Answer

Motivations and objectives. Key attributes include motivations (e.g., espionage), TTPs (tactics, techniques, procedures), and targeted sectors. IOCs and CVEs are important but may change frequently; motivations, TTPs, and sectors are more stable.

Answer

Vulnerabilities exploited (CVEs)

Answer

List of known indicators of compromise (IOCs)

Question 15

A penetration tester is preparing for an engagement and must define the rules of engagement (ROE) with the client. Which TWO of the following should be included in the ROE? Select TWO.

Accepted Answer

Time window for testing (e.g., after hours). Rules of engagement should include scope (IP ranges, systems), limitations (what is off-limits), and authorization. Testing credentials and vulnerability details are not part of ROE.

Answer

List of vulnerabilities to be tested

Answer

Testing credentials provided by the client

Answer

Vendor contact information