CAS-004 Security Operations — Timed 20 Questions

Question 1

A penetration tester is performing a test against a web application. The rules of engagement prohibit any denial of service (DoS) attacks. Which of the following actions is most likely prohibited by this restriction?

20 minute time limit — choose an answer to begin.

Accepted Answer

Using a tool to send thousands of requests to overwhelm the server. Using a tool to send thousands of requests to overwhelm the server is a classic denial of service (DoS) attack, which is explicitly prohibited by the rules of engagement. The other options, such as SQL injection, file upload exploitation, and directory brute-forcing, are typical penetration testing techniques that do not inherently cause a DoS.

Answer

Performing a SQL injection that deletes a table

Answer

Exploiting a file upload vulnerability to upload a web shell

Answer

Running a directory brute-force tool

Question 2

During an incident response engagement, the security team identifies that a compromised host has been communicating with multiple external IP addresses using encrypted channels. The team needs to determine which processes initiated the connections. Which type of evidence collection should be performed first to preserve the most volatile data?

Accepted Answer

Perform a memory capture using a tool like DumpIt or winpmem. In digital forensics, the order of volatility dictates that volatile data (e.g., running processes, network connections) should be collected first because it is lost when the system is powered down. Memory capture preserves this data, including process information and active network connections.

Answer

Export the Windows event logs related to network activity

Answer

Execute a network scan from the compromised host to identify active connections

Answer

Capture a full disk image using FTK Imager

Question 3

A security analyst is investigating a potential advanced persistent threat (APT) that has evaded traditional signature-based defenses. The analyst hypothesizes that the attacker is using a specific technique from the MITRE ATT&CK framework: process injection. Which threat hunting methodology is most appropriate for this scenario?

Accepted Answer

Hypothesis-driven hunting based on a specific technique (process injection) and searching for evidence in memory and process activity. Hypothesis-driven hunting starts with a specific hypothesis based on threat intelligence or a known TTP, such as process injection. This approach is proactive and focuses on detecting behaviors consistent with the hypothesis, unlike IoC-driven hunting which relies on known indicators.

Answer

TTP-driven hunting by analyzing adversary behaviors mapped to the ATT&CK framework

Answer

Automated hunting using SIEM correlation rules that trigger on known malicious file hashes

Answer

IoC-driven hunting using known indicators of compromise from open-source feeds

Question 4

A security operations center (SOC) is implementing a SOAR platform to automate responses to phishing incidents. The playbook will include steps to automatically quarantine suspicious emails, delete them from user mailboxes, and block the sender's domain. Which element should the SOAR playbook incorporate to ensure the automated response does not cause unintended disruption?

Accepted Answer

A confirmation step that prompts the analyst to approve the quarantine and deletion actions. Automated actions can have negative consequences if not validated. Incorporating user confirmation before destructive actions reduces risk, especially in cases of false positives.

Answer

An automatic rollback script that restores quarantined emails after 24 hours if no user complaint

Answer

Integration with threat intelligence to verify the sender domain reputation score before blocking

Answer

A manual approval step before executing any automated response

Question 5

A vulnerability management team is prioritizing patches for a large number of vulnerabilities discovered in a quarterly scan. A critical vulnerability in a widely used application has a CVSS base score of 9.8, but it is not currently being exploited in the wild and the application is not directly exposed to the internet. According to CVSS scoring principles, which factors should the team consider to adjust the priority?

Accepted Answer

Environmental metrics such as collateral damage potential and target distribution. CVSS environmental metrics allow organizations to modify the base score based on the specific context, such as the asset's value and exposure. This helps prioritize vulnerabilities that pose the greatest risk to the organization.

Answer

The number of other vulnerabilities in the same software product

Answer

The age of the vulnerability since its disclosure

Answer

Temporal metrics including exploit code maturity and remediation level

Question 6

During a penetration test, the tester has gained initial access to a web server and wants to move laterally to a database server. Which technique is most commonly used for lateral movement in a Windows environment?

Accepted Answer

Pass-the-Hash. Pass-the-Hash allows an attacker to authenticate to other systems using NTLM hashes without knowing the plaintext password, enabling lateral movement.

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Answer

ARP spoofing

Question 7

An organization is deploying deception technology to detect lateral movement by attackers. Which of the following would be the most effective to detect an attacker who has gained access to the internal network and is attempting to move to a sensitive server?

Accepted Answer

A honeytoken in the form of a fake password file on a file server. Honeytokens are deceptive data (e.g., fake credentials) placed on systems; if an attacker uses them, it triggers an alert. This is effective for detecting lateral movement without requiring interaction with a full honeypot.

Answer

A network-based intrusion detection system (NIDS) on the segment

Answer

A honeypot configured to mimic a high-value database server

Answer

An endpoint detection and response (EDR) agent on all workstations

Question 8

A security analyst is reviewing logs from a SIEM and notices that a user account has been successfully authenticated from two different geographic locations within a short time span, which is impossible. The SIEM uses user behavior analytics (UBA). What type of anomaly is this most likely to detect?

Accepted Answer

A credential theft and reuse incident. UBA establishes a baseline of normal user behavior, such as typical login locations and times. An impossible travel event (e.g., logging in from two distant locations within minutes) is a common anomaly that triggers an alert.

Answer

A misconfigured VPN that routes traffic through multiple gateways

Answer

A brute-force attack on the user account

Answer

A man-in-the-middle attack intercepting the authentication

Question 9

Which of the following best describes the purpose of the STIX and TAXII standards in threat intelligence sharing?

Accepted Answer

They standardize the format and exchange of cyber threat intelligence. STIX (Structured Threat Information Expression) is a language for describing threat intelligence, and TAXII (Trusted Automated Exchange of Intelligence Information) is a protocol for exchanging that intelligence. Together they enable automated sharing of threat data.

Answer

They are tools for analyzing malware behavior in a sandbox environment

Answer

They are used to automatically patch vulnerabilities based on threat feeds

Answer

They provide a framework for conducting incident response exercises

Question 10

A security team is conducting a penetration test against a client's web application. During the reconnaissance phase, the tester discovers a subdomain that hosts a development version of the application with debug mode enabled. Which type of reconnaissance does this activity represent?

Accepted Answer

Active reconnaissance because the tester is sending requests to the target network to identify subdomains. Active reconnaissance involves directly interacting with the target, such as probing subdomains or services. Discovering a subdomain by scanning or querying DNS is active, as it sends traffic to the target's infrastructure.

Answer

Open-source intelligence (OSINT) gathering by examining the target's website source code

Answer

Social engineering because the tester tricked an employee into revealing the subdomain

Answer

Passive reconnaissance because the tester is using publicly available information

Question 11

During a digital forensics investigation of a compromised Linux server, the investigator needs to preserve the evidence in a forensically sound manner. The server is still running. Which of the following should the investigator do first?

Accepted Answer

Capture the contents of RAM using a tool like LiME or fmem. According to the order of volatility, volatile data like memory should be captured first. On a running system, capturing memory preserves data that would be lost on shutdown.

Answer

Pull the power cord to preserve the disk state

Answer

Create a forensic image of the hard drive using dd over a network connection

Answer

Run the 'history' command to see recent user commands

Question 12

Which of the following is a key benefit of using an Extended Detection and Response (XDR) solution over traditional Endpoint Detection and Response (EDR)?

Accepted Answer

XDR provides centralized visibility across multiple security layers including endpoints, network, and cloud. XDR extends detection beyond endpoints to include network, email, cloud, and other data sources, providing broader visibility and correlation across the entire environment.

Answer

XDR only works with a single vendor's products

Answer

XDR eliminates the need for SIEM and SOAR systems

Answer

XDR only focuses on network traffic analysis

Question 13

A security analyst is using Volatility to analyze a memory dump from a compromised Windows system. The analyst suspects that a rootkit is hiding processes. Which Volatility plugin should the analyst use to detect hidden processes?

Accepted Answer

psxview. The 'psxview' plugin compares process listings from different sources (e.g., EPROCESS list, PspCidTable) to find discrepancies, which can reveal hidden processes.

Answer

pslist

Answer

malfind

Answer

pstree

Question 14

A security operations team is developing a SOAR playbook to automate response to a detected ransomware outbreak. The team wants to ensure the playbook can contain the threat quickly while minimizing business disruption. Which TWO actions should the playbook include as automated responses? (Select TWO.)

Accepted Answer

Block outbound traffic to known malicious IP addresses and domains. Isolating affected systems and blocking communication to known command-and-control (C2) servers are effective containment actions. Isolating prevents lateral movement, and blocking C2 disrupts the ransomware's ability to receive instructions or exfiltrate data.

Answer

Run a full antivirus scan on all systems

Answer

Restore all systems from the latest backup automatically

Answer

Power off all affected servers immediately

Question 15

A security analyst is reviewing a malware sample in a sandbox environment. The analyst notes that the malware attempts to check for the presence of a debugger and modifies its behavior if one is detected. Additionally, the malware uses encrypted strings and resolves API calls dynamically. Which THREE analysis techniques would be most effective for understanding this malware's capabilities? (Select THREE.)

Accepted Answer

Static analysis using a disassembler like IDA Pro to examine the code for anti-debugging and obfuscation techniques. Static analysis can reveal encrypted strings and dynamic API resolution. Dynamic analysis in a sandbox shows runtime behavior. Debugging or reverse engineering (e.g., using a disassembler) helps understand anti-debugging tricks. Memory analysis (e.g., with Volatility) can capture the malware in action.

Answer

Network analysis using Wireshark to capture packets from the sandbox

Answer

Hash analysis by submitting the malware to VirusTotal

Question 16

A penetration tester is planning a test for a client that has a critical web application. The rules of engagement specify that the tester must avoid causing a denial of service (DoS). Which THREE actions are appropriate for the tester to include in the scope? (Select THREE.)

Accepted Answer

Port scanning to identify open services on the web server. Port scanning, SQL injection testing, and directory brute-forcing are common penetration testing activities that do not inherently cause DoS. DoS attacks and social engineering without approval are typically out of scope.

Answer

Conducting social engineering attacks against employees without prior approval

Answer

Performing a distributed denial-of-service (DDoS) attack to test resilience

Question 17

During a security incident, the incident response team has identified the root cause and removed the threat from all affected systems. Which phase of the incident response lifecycle involves returning systems to normal operation and monitoring for any signs of recurrence?

Accepted Answer

Recovery. The incident response lifecycle includes preparation, detection, containment, eradication, recovery, and lessons learned. Recovery is the phase where systems are restored to normal operation and monitoring is implemented to ensure the threat does not return.

Answer

Eradication

Answer

Containment

Answer

Lessons Learned

Question 18

A security analyst is using the MITRE ATT&CK framework to categorize adversary behavior observed in recent incidents. The analyst notes that the adversary used spearphishing with a malicious attachment to gain initial access, then executed a PowerShell script to download additional tools. Which ATT&CK tactic is the PowerShell execution associated with?

Accepted Answer

Execution. Execution is the tactic that covers techniques that result in adversary-controlled code running on a system. PowerShell execution is a common technique under the Execution tactic.

Answer

Defense Evasion

Answer

Initial Access

Answer

Command and Control

Question 19

A security engineer is configuring a SIEM correlation rule to detect a potential data exfiltration attempt. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address that has never been communicated with before, within a 5-minute window. Additionally, the external IP should not be on any whitelist. Which correlation logic best implements this detection?

Accepted Answer

Alert when a host sends >10 MB to an external IP that is not in the whitelist and not seen in the last 24 hours, aggregated over 5 minutes.. Ly implements the detection rule. It aggregates data transfer per host over 5 minutes, checks that the volume exceeds 10 MB, verifies the external IP is not on any whitelist, and ensures the IP has not been seen in the last 24 hours (i.e., it is a new destination). This matches all the requirements: a single internal host, >10 MB, to an external IP never communicated with before, within 5 minutes, and not whitelisted. Option B adds an unnecessary port 443 condition. Option C omits the requirement that the external IP must be new (unseen before). Option D aggregates over all external IPs without checking newness, which could alert on previously contacted IPs.

Answer

Alert when a host sends >10 MB to an external IP not in the whitelist and the destination port is 443.

Answer

Alert when any host sends >10 MB to an external IP not in the whitelist within 5 minutes.

Answer

Alert when a host sends >10 MB to any external IP aggregated over 5 minutes, then filter out whitelisted IPs.

Question 20

During a penetration test, the tester has gained initial access to a web server and wants to move laterally to a database server. Which of the following techniques would be most effective for identifying valid credentials that could be reused on the database server?

Accepted Answer

Using Mimikatz to dump credentials from memory. Mimikatz is a tool that extracts plaintext passwords, hashes, and Kerberos tickets from memory. It is commonly used for credential dumping to enable lateral movement.

Answer

Running a port scan on the internal network

Answer

Deploying a web shell for persistent access

Answer

Conducting a SQL injection on the database server