CAS-004 Security Operations Practice Test 2 — 15 Questions

Question 1

A small business runs its critical line-of-business application on a single Windows server located in a local data center. The server is accessed by employees remotely via RDP over a VPN. Recently, the server has been experiencing slow performance, and the administrator notices high CPU usage from a process named 'svchost.exe'. The administrator suspects malware but is not sure. The business has no security tools beyond Windows Defender. Management wants to minimize downtime and ensure the server is back to full operation as soon as possible. Which of the following is the BEST course of action for the administrator to take first?

Accepted Answer

Run a full offline scan using Microsoft Defender (Windows Defender Offline) from a bootable media.. A full offline scan using Microsoft Defender Offline boots the server from a clean environment, bypassing the running operating system where malware can hide or resist detection. This approach directly addresses the suspected malware without relying on the compromised OS, minimizes downtime by avoiding unnecessary restoration or network changes, and uses the only security tool available (Windows Defender) effectively.

Answer

Restore the server from the most recent backup taken before the performance issues started.

Answer

Install a third-party antivirus solution and perform a full system scan.

Answer

Disconnect the server from the network immediately to contain any potential threat.

Question 2

Which TWO of the following are key components of a successful incident response plan according to NIST SP 800-61?

Accepted Answer

Preparation. NIST SP 800-61 defines the incident response lifecycle as having four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation (Option B) is the foundational phase that ensures the organization has the tools, policies, and trained personnel ready before an incident occurs. Detection and Analysis (Option E) is the second phase, focusing on identifying and validating security incidents through monitoring, alerting, and forensic analysis.

Answer

Vulnerability scanning

Answer

Patch management

Answer

User training

Question 3

Based on the exhibit, which type of attack is most likely occurring?

Accepted Answer

Brute force password guessing. The exhibit shows a high number of failed authentication attempts (e.g., Event ID 4625) from a single source IP against multiple user accounts over a short period. This pattern is characteristic of a brute force password guessing attack, where an attacker systematically tries common passwords against many accounts to gain unauthorized access. The absence of successful logins or account lockouts further supports this conclusion.

Answer

Pass-the-hash attack

Answer

Account lockout attack

Answer

Replay attack

Question 4

A security analyst at a financial institution is investigating a potential data exfiltration incident. The organization uses a zero-trust network architecture with micro-segmentation. The analyst notices that a database server with sensitive customer financial data has been communicating with an external IP address (198.51.100.45) over port 443 during non-business hours. The database server is not supposed to initiate outbound connections; all outbound traffic is logged and blocked by default except for specific allowlisted IPs and ports. The analyst reviews the firewall logs and finds that the outbound connection to 198.51.100.45 was allowed because the source port was 443, which is an allowed port for inbound HTTPS traffic. The database server is not a web server and does not run any HTTPS services. Which of the following is the best course of action for the analyst to take first?

Accepted Answer

Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes. Option D is correct because the database server is not supposed to initiate outbound connections, yet a connection to an external IP over port 443 was allowed due to source port 443 matching an inbound allow rule. This strongly suggests the server may be compromised, with malware or an unauthorized process using source port 443 to bypass firewall restrictions. Checking EDR logs is the best first step to identify malicious processes or indicators of compromise without prematurely destroying evidence.

Answer

Immediately block the external IP address at the perimeter firewall

Answer

Disable the database server's network interface

Answer

Review the database server's recent application logs for any anomalies

Question 5

Drag and drop the steps to set up a SIEM alert for a failed login threshold into the correct order.

Question 6

Match each security tier or model to its description.

Question 7

A security analyst observes anomalous outbound network traffic from a server that normally only performs internal functions. According to the incident response plan, what should the analyst do first?

Accepted Answer

Follow the incident response plan. Option A is correct because the first step in incident response is to follow the established plan to ensure proper handling and minimize damage. Option B is wrong because containment should follow identification and reporting. Option C is wrong because shutting down may destroy evidence. Option D is wrong because ignoring is risky.

Answer

Contain the server by disconnecting it from the network

Answer

Immediately shut down the server

Answer

Ignore the traffic as it might be a false positive

Question 8

A company wants to reduce the mean time to detect (MTTD) for security incidents. Which technology is most effective for this purpose?

Accepted Answer

Security information and event management (SIEM) with behavior analytics. Option C is correct because SIEM with User and Entity Behavior Analytics (UEBA) baseline normal behavior and detect anomalies quickly. Option A is wrong because IDS only matches signatures. Option B is wrong because DLP focuses on data loss. Option D is wrong because encryption is for data protection.

Answer

Full disk encryption software

Answer

Data loss prevention (DLP) system

Answer

Network-based intrusion detection system (NIDS)

Question 9

During a ransomware incident, the organization discovers that all production backups have been encrypted by the attacker. What is the most effective recovery approach?

Accepted Answer

Restore from offline immutable backups. Option D is correct because offline immutable backups are not accessible to the ransomware and provide a clean restore point. Option A is wrong because paying ransom does not guarantee decryption. Option B is wrong because system restore points may also be encrypted. Option C is wrong because decryption tools often fail against modern ransomware.

Answer

Restore from system restore points

Answer

Use a decryption tool from security vendors

Answer

Pay the ransom to obtain the decryption key

Question 10

A forensic analyst needs to collect volatile data from a live Windows system. In which order should the analyst collect the following data? (Order of volatility)

Accepted Answer

Memory dump, network connections, running processes, disk image. Option B is correct because memory is the most volatile and should be collected first, followed by network connections, then processes, and finally disk data. Option A is wrong because disk is less volatile. Option C is wrong because processes should be after memory. Option D is wrong because network state is more volatile than disk.

Answer

Disk image, memory dump, network connections, running processes

Answer

Network connections, running processes, memory dump, disk image

Answer

Running processes, memory dump, network connections, disk image

Question 11

A SOC manager is considering implementing a SOAR platform. Which is the primary benefit of SOAR in day-to-day operations?

Accepted Answer

Automated playbook execution and orchestration of response actions. Option A is correct because SOAR automates repetitive tasks and orchestrates workflows, enabling faster and consistent incident response. Option B is wrong because SOAR does not directly reduce false positives; that's SIEM tuning. Option C is wrong because SOAR does not replace people. Option D is wrong because SOAR is not primarily for log storage.

Answer

Centralized storage of all security logs

Answer

Elimination of the need for human analysts

Answer

Reduction in false positive alerts from the SIEM

Question 12

After containing a confirmed security incident, the incident response team must plan for eradication. What must be done before eradication begins?

Accepted Answer

Determine the root cause of the incident. Option C is correct because understanding the root cause ensures complete removal of the threat and prevents re-infection. Option A is wrong that eradication is the next step after containment; root cause analysis is critical. Option B is wrong because forensics can be done during or after eradication. Option D is wrong because notifying law enforcement is optional and not a prerequisite.

Answer

Conduct a full forensic analysis of all systems

Answer

Begin eradication immediately to minimize dwell time

Answer

Notify law enforcement agencies

Question 13

A SOC analyst is investigating a potential lateral movement within the network. Which log source is most critical for detecting lateral movement using pass-the-hash or pass-the-ticket attacks?

Accepted Answer

Authentication logs (e.g., Windows Event ID 4624). Option D is correct because authentication logs, especially from domain controllers, record logon events that indicate lateral movement. Option A is wrong because firewall logs show network flows but not authentication. Option B is wrong because antivirus logs show malware detections, not lateral movement directly. Option C is wrong because DNS logs show name resolution.

Answer

Antivirus logs

Answer

DNS logs

Answer

Firewall logs

Question 14

A threat hunter hypothesizes that a sophisticated attacker is using DNS tunneling for command and control. Which data source would most likely confirm this activity?

Accepted Answer

DNS query logs from authoritative/internal DNS servers. Option B is correct because DNS logs contain queries and responses; anomalous patterns like large TXT records or high frequency indicate tunneling. Option A is wrong because firewall logs may show traffic but not DNS content. Option C is wrong because antivirus may not detect tunneling. Option D is wrong because web proxy logs show HTTP traffic.

Answer

Network flow data (NetFlow)

Answer

Endpoint antivirus alerts

Answer

Web proxy logs

Question 15

During a forensic investigation, the examiner discovers that the chain of custody documentation was not properly maintained for a critical hard drive. What is the most likely consequence?

Accepted Answer

The evidence may be ruled inadmissible in legal proceedings. Option A is correct because without chain of custody, evidence could be tampered, making it inadmissible in court. Option B is wrong that investigators are still admissible if procedure is followed, but chain of custody is vital. Option C is wrong that analysis is still valid but legally challenged. Option D is wrong because return to operations is not primary concern.

Answer

The investigation can continue without any impact

Answer

The data on the drive is automatically deleted

Answer

The drive must be returned to the owner immediately