CAS-004 Security Operations — Timed 20 Questions

Question 1

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

Accepted Answer

Check if the host is configured as a mail server in the organization's asset database.. Option B is correct because the first step in investigating potential data exfiltration over TCP port 25 (SMTP) is to verify whether the host is authorized to send email. If the host is a legitimate mail server, the traffic may be normal; if not, it could indicate malware or a misconfigured application exfiltrating data via SMTP. This aligns with the CAS-004 objective of validating asset roles before escalating to containment.

Answer

Submit a change request to implement an email content filter.

Answer

Block the outbound traffic on the firewall to prevent potential data exfiltration.

Answer

Run a full antivirus scan on the host to detect any malware.

Question 2

A SOC analyst is reviewing a large volume of failed login attempts across multiple user accounts from a single external IP address. The attempts use common usernames and passwords over SSH (port 22). Which security control would be most effective at preventing this type of attack?

Accepted Answer

Add the external IP address to the firewall deny list and implement an IP allowlist for SSH access.. Option D is correct because the attack is a brute-force or password-spraying attempt from a single external IP. Adding that IP to a firewall deny list immediately blocks all traffic from that source, while implementing an IP allowlist for SSH access ensures only trusted IPs can reach the service. This directly prevents the attack at the network layer, regardless of password strength or authentication method.

Answer

Enforce a minimum password complexity policy for all users.

Answer

Require multi-factor authentication for all SSH logins.

Answer

Implement rate limiting on SSH connections per source IP.

Question 3

An organization deploys a new web application that stores sensitive data in a backend database. During a penetration test, the tester discovers that the application is vulnerable to SQL injection via a search field. Which of the following design changes would best mitigate this vulnerability without significantly impacting functionality?

Accepted Answer

Rewrite the database query to use parameterized prepared statements.. Option B is correct because parameterized prepared statements separate SQL logic from user input, ensuring that any input supplied via the search field is treated strictly as data, not executable code. This directly prevents SQL injection by eliminating the possibility of an attacker altering the query structure, regardless of the input content.

Answer

Deploy a web application firewall (WAF) to filter malicious payloads.

Answer

Move all database queries to stored procedures.

Answer

Implement client-side input validation to block special characters.

Question 4

A security engineer is configuring a SIEM and wants to reduce false positives while ensuring that real attacks are detected. Which of the following approaches would best achieve this balance?

Accepted Answer

Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.. Option D is correct because tuning correlation rules to the organization's specific asset inventory, network architecture, and threat intelligence directly reduces false positives by filtering out irrelevant events while ensuring that real attacks against known assets are detected. This approach leverages contextual knowledge to adjust thresholds, exclude noise, and prioritize alerts that match the actual attack surface, achieving the desired balance between sensitivity and specificity.

Answer

Aggregate all logs from all sources and create a single correlation rule for each attack type.

Answer

Use the default correlation rules provided by the SIEM vendor without modification.

Answer

Block all traffic from external IP addresses that are not on the organization's whitelist.

Question 5

During a security incident, a forensic investigator needs to capture the contents of volatile memory on a compromised server. Which of the following tools should the investigator use?

Accepted Answer

FTK Imager (with memory capture). FTK Imager with memory capture is the correct tool because it is specifically designed to acquire a bit-for-bit copy of volatile memory (RAM) from a live system while preserving forensic integrity. Unlike disk imaging tools, FTK Imager can capture the contents of physical memory, including running processes, network connections, and encryption keys, which are critical for incident response. This tool also generates a hash of the captured memory to ensure data integrity during analysis.

Answer

dd

Answer

Wireshark

Answer

Nmap

Question 6

Which TWO of the following are best practices for securing a cloud-based identity and access management (IAM) system? (Select exactly 2.)

Accepted Answer

Implement the principle of least privilege for all user roles.. The principle of least privilege (C) ensures that users and roles are granted only the permissions necessary to perform their job functions, reducing the attack surface and limiting potential damage from compromised accounts. Enabling multi-factor authentication (D) for administrative accounts adds a critical layer of security beyond passwords, mitigating risks from credential theft or brute-force attacks. Both are foundational controls in cloud IAM frameworks like AWS IAM, Azure AD, or GCP IAM.

Answer

Require users to change passwords every 30 days.

Answer

Use single sign-on (SSO) for all applications.

Answer

Create default admin accounts for each department.

Question 7

Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)

Accepted Answer

Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.. Behavioral analysis (option B) is effective against APTs because it establishes a baseline of normal activity and flags deviations, such as unusual lateral movement or data exfiltration patterns, which APTs often exhibit. Unlike signature-based methods, behavioral analysis can detect novel or zero-day attack techniques that do not match known signatures, making it a critical component of an advanced threat detection strategy.

Answer

Using signature-based intrusion detection systems (IDS) to match known attack patterns.

Answer

Deploying honeypots to attract and analyze attacker behavior.

Question 8

A security analyst reviews the above Windows security events from a domain controller. What is the most likely conclusion about the activity?

Accepted Answer

An attacker has compromised the jsmith account and used it to perform lateral movement and access sensitive data.. Event ID 4624 with Logon Type 3 (network logon) from jsmith to the domain controller, followed by Event ID 4670 (permissions on an object changed) on a sensitive file share, indicates lateral movement and privilege escalation. The combination of network authentication and subsequent access to sensitive data is a classic indicator of an attacker using compromised credentials to move laterally within the network.

Answer

The jsmith account is performing routine administrative tasks with standard user privileges.

Answer

The Administrator account is locked out due to repeated failed logon attempts.

Answer

A user named jsmith is attempting to reset the Administrator password via network logon.

Question 9

A cloud security engineer reviews the above S3 bucket policy. Which of the following is the most significant security concern?

Accepted Answer

The bucket policy allows any user to upload objects to the bucket.. Option D is correct because the bucket policy statement includes a Principal of '*' and an Action of 's3:PutObject' without any condition restricting who can upload, meaning any unauthenticated user on the internet can write objects to the bucket. This creates a severe data integrity and malware-upload risk, as attackers can place arbitrary content into the bucket, potentially leading to data corruption, storage cost abuse, or serving malicious files.

Answer

The bucket policy grants unnecessary permissions for s3:GetObject.

Answer

The IP address restriction uses an incorrect format for the condition key.

Answer

The bucket policy allows public read access to all objects.

Question 10

A security analyst notices repeated failed login attempts from a single IP address across multiple user accounts. Which of the following is the BEST immediate action to mitigate this attack?

Accepted Answer

Implement a rate-limiting rule on the network firewall for the source IP.. Option D is correct because rate-limiting the source IP at the network firewall immediately throttles the number of authentication attempts from that address, mitigating the brute-force attack without disrupting legitimate user access. This is the best immediate action as it directly blocks the attack vector at the network layer, preventing further failed logins while preserving user productivity.

Answer

Disable the affected user accounts until the source IP is blocked.

Answer

Reset the passwords for all affected accounts.

Answer

Enable multi-factor authentication for all accounts.

Question 11

A SOC analyst is reviewing an alert about a suspicious process execution on a critical server. The alert shows that cmd.exe spawned from Microsoft Word. Which of the following is the BEST next step for the analyst?

Accepted Answer

Isolate the host from the network and collect a memory dump.. Option C is correct because the alert indicates a classic living-off-the-land (LotL) attack where Microsoft Word (likely via a malicious macro) spawns cmd.exe, suggesting code execution. Isolating the host prevents lateral movement and data exfiltration, while collecting a memory dump preserves volatile evidence (e.g., process memory, network connections, injected code) for forensic analysis. Immediate termination (Option D) or reimaging (Option B) would destroy critical evidence, and doing nothing (Option A) risks further compromise.

Answer

Collect a memory dump from the host without any immediate action.

Answer

Reimage the server to ensure it is clean.

Answer

Terminate the cmd.exe process immediately.

Question 12

An organization wants to implement a solution that automatically detects and blocks malicious traffic based on known signatures and behavioral anomalies. Which of the following should be deployed?

Accepted Answer

Network-based IDS/IPS. A network-based IDS/IPS (Intrusion Detection/Prevention System) is designed to inspect network traffic in real time, using a combination of signature-based detection (matching known attack patterns) and behavioral/anomaly-based detection (identifying deviations from normal traffic baselines). This dual approach allows it to both detect and automatically block malicious traffic, fulfilling the organization's requirement directly.

Answer

Next-generation firewall with application control

Answer

Web application firewall (WAF)

Answer

Security information and event management (SIEM) system

Question 13

A security engineer needs to design a solution to detect and respond to insider threats involving unauthorized data exfiltration via USB devices. Which of the following is the MOST effective approach?

Accepted Answer

Implement a data loss prevention (DLP) solution with device control and content inspection.. Option D is the most effective because a DLP solution with device control and content inspection can monitor, block, or alert on unauthorized data transfers to USB devices by inspecting the content being written (e.g., file types, keywords, patterns) and enforcing policies at the endpoint or network level. This directly addresses the specific threat of data exfiltration via USB, unlike other options that either lack detection or are too restrictive.

Answer

Conduct regular security awareness training on data handling policies.

Answer

Deploy endpoint detection and response (EDR) agents on all workstations.

Answer

Disable all USB ports via group policy.

Question 14

A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)

Accepted Answer

Reset the service account password and revoke any active tokens.. Resetting the service account password and revoking active tokens (C) immediately invalidates the attacker's current authentication credentials, preventing further unauthorized access via that compromised account. This is a critical containment step because service accounts often have persistent access and may use long-lived tokens or cached credentials that remain valid until explicitly revoked.

Answer

Check the workstation logs for signs of malware.

Answer

Notify law enforcement and the organization's legal department.

Answer

Restore the affected files from a known good backup.

Question 15

A large enterprise has deployed a security information and event management (SIEM) system that ingests logs from all critical servers, network devices, and endpoints. The SIEM is configured to correlate events and generate alerts for suspicious activities. Recently, the SOC team has been overwhelmed by a high volume of false positive alerts, particularly from the web server farm. The false positives are mainly triggered by legitimate web crawling and scanning activities from partners and internal tools. The SOC manager wants to reduce false positives without missing real threats. As the security architect, you are asked to recommend a solution. Which of the following is the BEST course of action?

Accepted Answer

Create allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules.. Option D is correct because creating allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules directly addresses the root cause: false positives from trusted entities. This approach preserves detection sensitivity for unknown or malicious sources while suppressing alerts from pre-vetted IPs, reducing alert fatigue without compromising security coverage.

Answer

Increase the event threshold for web server alerts to reduce sensitivity.

Answer

Disable logging of successful requests on the web servers to reduce log volume.

Answer

Tune the SIEM to use more aggressive deduplication and aggregation globally.

Question 16

A small business runs its critical line-of-business application on a single Windows server located in a local data center. The server is accessed by employees remotely via RDP over a VPN. Recently, the server has been experiencing slow performance, and the administrator notices high CPU usage from a process named 'svchost.exe'. The administrator suspects malware but is not sure. The business has no security tools beyond Windows Defender. Management wants to minimize downtime and ensure the server is back to full operation as soon as possible. Which of the following is the BEST course of action for the administrator to take first?

Accepted Answer

Run a full offline scan using Microsoft Defender (Windows Defender Offline) from a bootable media.. A full offline scan using Microsoft Defender Offline boots the server from a clean environment, bypassing the running operating system where malware can hide or resist detection. This approach directly addresses the suspected malware without relying on the compromised OS, minimizes downtime by avoiding unnecessary restoration or network changes, and uses the only security tool available (Windows Defender) effectively.

Answer

Restore the server from the most recent backup taken before the performance issues started.

Answer

Install a third-party antivirus solution and perform a full system scan.

Answer

Disconnect the server from the network immediately to contain any potential threat.

Question 17

Which TWO of the following are key components of a successful incident response plan according to NIST SP 800-61?

Accepted Answer

Preparation. NIST SP 800-61 defines the incident response lifecycle as having four phases: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Preparation (Option B) is the foundational phase that ensures the organization has the tools, policies, and trained personnel ready before an incident occurs. Detection and Analysis (Option E) is the second phase, focusing on identifying and validating security incidents through monitoring, alerting, and forensic analysis.

Answer

Vulnerability scanning

Answer

Patch management

Answer

User training

Question 18

Based on the exhibit, which type of attack is most likely occurring?

Accepted Answer

Brute force password guessing. The exhibit shows a high number of failed authentication attempts (e.g., Event ID 4625) from a single source IP against multiple user accounts over a short period. This pattern is characteristic of a brute force password guessing attack, where an attacker systematically tries common passwords against many accounts to gain unauthorized access. The absence of successful logins or account lockouts further supports this conclusion.

Answer

Pass-the-hash attack

Answer

Account lockout attack

Answer

Replay attack

Question 19

A security analyst at a financial institution is investigating a potential data exfiltration incident. The organization uses a zero-trust network architecture with micro-segmentation. The analyst notices that a database server with sensitive customer financial data has been communicating with an external IP address (198.51.100.45) over port 443 during non-business hours. The database server is not supposed to initiate outbound connections; all outbound traffic is logged and blocked by default except for specific allowlisted IPs and ports. The analyst reviews the firewall logs and finds that the outbound connection to 198.51.100.45 was allowed because the source port was 443, which is an allowed port for inbound HTTPS traffic. The database server is not a web server and does not run any HTTPS services. Which of the following is the best course of action for the analyst to take first?

Accepted Answer

Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes. Option D is correct because the database server is not supposed to initiate outbound connections, yet a connection to an external IP over port 443 was allowed due to source port 443 matching an inbound allow rule. This strongly suggests the server may be compromised, with malware or an unauthorized process using source port 443 to bypass firewall restrictions. Checking EDR logs is the best first step to identify malicious processes or indicators of compromise without prematurely destroying evidence.

Answer

Immediately block the external IP address at the perimeter firewall

Answer

Disable the database server's network interface

Answer

Review the database server's recent application logs for any anomalies

Question 20

Drag and drop the steps to set up a SIEM alert for a failed login threshold into the correct order.