CAS-004 Security Operations Practice Test 9 — 15 Questions

Question 1

During a threat hunting exercise, a security analyst hypothesizes that adversaries may be using PowerShell to execute commands in memory. Which threat hunting methodology is being employed?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a hypothesis about potential adversary behavior, then searches for evidence. IoC-driven uses indicators of compromise, and TTP-driven focuses on tactics, techniques, and procedures.

Answer

Signature-based hunting

Answer

TTP-driven hunting

Answer

IoC-driven hunting

Question 2

A security analyst receives an alert from the SIEM indicating multiple failed logon attempts from an external IP address followed by a successful logon for a domain admin account. Which phase of the incident response lifecycle is the analyst currently in?

Accepted Answer

Detection. The detection phase involves identifying potential incidents through alerts and analysis. The analyst has received an alert and is likely investigating, which is part of detection.

Answer

Lessons learned

Answer

Containment

Answer

Preparation

Question 3

During a digital forensics investigation, an analyst needs to acquire the contents of RAM from a compromised server. Which order of volatility should the analyst follow?

Accepted Answer

Capture RAM first, then the hard drive. The order of volatility dictates collecting the most volatile data first. RAM is highly volatile and should be captured before less volatile data like disks.

Answer

Capture the swap file first, then RAM

Answer

Capture network connections first, then RAM

Answer

Capture the hard drive image first, then RAM

Question 4

A security team is analyzing a suspicious binary using static analysis. They run the strings command and observe references to 'CreateRemoteThread' and 'WriteProcessMemory'. Which technique is the binary likely employing?

Accepted Answer

Process injection. CreateRemoteThread and WriteProcessMemory are commonly used for process injection, allowing code execution in another process's address space.

Answer

DLL sideloading

Answer

Reflective DLL loading

Answer

API hooking

Question 5

A company uses a SIEM with User Behavior Analytics (UBA). The UBA generates an alert when a user accesses sensitive data at unusual hours. Which type of correlation rule is being applied?

Accepted Answer

Anomaly-based correlation. UBA establishes baselines of normal user behavior and alerts on deviations, which is an anomaly-based detection method.

Answer

Threshold-based correlation

Answer

Signature-based correlation

Answer

Trend-based correlation

Question 6

A security analyst receives an alert from the SIEM indicating a potential phishing email with a malicious attachment. The analyst wants to automatically isolate the affected endpoint and block the sender. Which technology should be used to automate this response?

Accepted Answer

SOAR. SOAR (Security Orchestration, Automation, and Response) platforms enable automated response playbooks to handle incidents like phishing.

Answer

EDR

Answer

XDR

Answer

SIEM

Question 7

A vulnerability scanner reports a critical vulnerability with a CVSS base score of 9.8 on a public-facing web server. However, the server has a compensating control: a Web Application Firewall (WAF) that blocks exploit attempts. How should the security team prioritize patching this vulnerability?

Accepted Answer

Immediately patch the vulnerability as soon as possible. Compensating controls can reduce risk, but patching should still be prioritized for critical vulnerabilities even if compensating controls are in place, as controls can be bypassed.

Answer

Schedule patching during the next maintenance window

Answer

Defer patching indefinitely since the WAF mitigates the risk

Answer

Increase the WAF rule strictness and delay patching

Question 8

During a penetration test, the tester successfully gains initial access to a web server and wants to move laterally to a database server. The web server uses a service account that has local admin rights on the database server. What is the most effective technique for lateral movement in this scenario?

Accepted Answer

Pass-the-Hash. Pass-the-Hash uses NTLM hashes to authenticate without the plaintext password, effective when the same account hash is reused across systems.

Answer

Exploit a SQL injection vulnerability in the database server

Answer

Brute-force the database server administrator password

Answer

Use a keylogger to capture credentials on the web server

Question 9

An organization deploys honeypots to detect attackers. Which type of deception technology is being used?

Accepted Answer

Honeypots. Honeypots are decoy systems designed to lure attackers and detect unauthorized activity.

Answer

Honeytokens

Answer

Bait networks

Answer

Honeynets

Question 10

A security analyst is reviewing a suspicious email reported by a user. The email contains an attachment named 'invoice.pdf.exe'. Which type of malware analysis technique should the analyst perform first to determine if the file is malicious?

Accepted Answer

Static analysis. Static analysis (e.g., checking file extensions, strings, and hashes) is non-executing and safe to perform first to gather initial indicators.

Answer

Reverse engineering

Answer

Dynamic analysis in a sandbox

Answer

Memory forensics

Question 11

During a red team exercise, the team gains access to a workstation and needs to maintain persistence. They modify a registry run key to execute a payload. However, the organization uses EDR that monitors registry changes. Which technique could the red team use to avoid detection?

Accepted Answer

Use a LOLBin to execute the payload via a scheduled task. Living-off-the-land binaries (LOLBins) use legitimate system tools to execute code, which can blend in with normal activity and avoid EDR detection.

Answer

Delete the registry key after execution

Answer

Change the registry key to a less suspicious name

Answer

Encrypt the registry key value

Question 12

A company's incident response team is conducting a post-incident review. They identify that the intrusion was not detected for 72 hours due to insufficient logging on critical servers. Which phase of the incident response lifecycle should be improved to address this gap?

Accepted Answer

Preparation. The preparation phase includes establishing logging and monitoring capabilities. Improving logging is part of preparation for future incidents.

Answer

Lessons learned

Answer

Containment

Answer

Detection

Question 13

A security analyst is investigating a potential data exfiltration incident. The analyst needs to preserve evidence for legal proceedings. Which two actions must the analyst take to maintain the chain of custody? (Select TWO).

Accepted Answer

Document every person who accesses the evidence and the time of access. Documenting who handled evidence and when, and using forensic imaging with write-blockers ensures integrity and admissibility.

Answer

Encrypt the evidence with a personal key

Answer

Share the evidence with all team members for analysis

Answer

Run antivirus scans on the evidence to ensure it is safe

Question 14

A penetration tester is conducting a black-box test on a web application. The tester wants to gather information about the target without directly interacting with the target systems. Which three techniques are considered passive reconnaissance? (Select THREE).

Accepted Answer

Searching public social media profiles. Passive reconnaissance involves collecting information from public sources without engaging the target.

Answer

Port scanning with Nmap

Answer

DNS zone transfers

Question 15

A security operations center (SOC) is evaluating a new EDR solution. Which three capabilities are essential for effective endpoint detection and response? (Select THREE).

Accepted Answer

Behavioral analysis to detect anomalies. EDR essentials include real-time monitoring, behavioral analysis, and automated response to contain threats.

Answer

Network firewall management

Answer

Vulnerability scanning of endpoints