CAS-004 Timed Practice Test 5 — 10 Questions

Question 1

A security engineer is configuring a SIEM and wants to reduce false positives while ensuring that real attacks are detected. Which of the following approaches would best achieve this balance?

Accepted Answer

Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.. Option D is correct because tuning correlation rules to the organization's specific asset inventory, network architecture, and threat intelligence directly reduces false positives by filtering out irrelevant events while ensuring that real attacks against known assets are detected. This approach leverages contextual knowledge to adjust thresholds, exclude noise, and prioritize alerts that match the actual attack surface, achieving the desired balance between sensitivity and specificity.

Answer

Aggregate all logs from all sources and create a single correlation rule for each attack type.

Answer

Use the default correlation rules provided by the SIEM vendor without modification.

Answer

Block all traffic from external IP addresses that are not on the organization's whitelist.

Question 2

A SOC analyst is reviewing an alert about a suspicious process execution on a critical server. The alert shows that cmd.exe spawned from Microsoft Word. Which of the following is the BEST next step for the analyst?

Accepted Answer

Isolate the host from the network and collect a memory dump.. Option C is correct because the alert indicates a classic living-off-the-land (LotL) attack where Microsoft Word (likely via a malicious macro) spawns cmd.exe, suggesting code execution. Isolating the host prevents lateral movement and data exfiltration, while collecting a memory dump preserves volatile evidence (e.g., process memory, network connections, injected code) for forensic analysis. Immediate termination (Option D) or reimaging (Option B) would destroy critical evidence, and doing nothing (Option A) risks further compromise.

Answer

Collect a memory dump from the host without any immediate action.

Answer

Reimage the server to ensure it is clean.

Answer

Terminate the cmd.exe process immediately.

Question 3

Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)

Accepted Answer

Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.. Behavioral analysis (option B) is effective against APTs because it establishes a baseline of normal activity and flags deviations, such as unusual lateral movement or data exfiltration patterns, which APTs often exhibit. Unlike signature-based methods, behavioral analysis can detect novel or zero-day attack techniques that do not match known signatures, making it a critical component of an advanced threat detection strategy.

Answer

Using signature-based intrusion detection systems (IDS) to match known attack patterns.

Answer

Deploying honeypots to attract and analyze attacker behavior.

Question 4

A security analyst reviews the above Windows security events from a domain controller. What is the most likely conclusion about the activity?

Accepted Answer

An attacker has compromised the jsmith account and used it to perform lateral movement and access sensitive data.. Event ID 4624 with Logon Type 3 (network logon) from jsmith to the domain controller, followed by Event ID 4670 (permissions on an object changed) on a sensitive file share, indicates lateral movement and privilege escalation. The combination of network authentication and subsequent access to sensitive data is a classic indicator of an attacker using compromised credentials to move laterally within the network.

Answer

The jsmith account is performing routine administrative tasks with standard user privileges.

Answer

The Administrator account is locked out due to repeated failed logon attempts.

Answer

A user named jsmith is attempting to reset the Administrator password via network logon.

Question 5

A security analyst reviews the ACL rules above. A host at 10.0.1.5 attempts to SSH (port 22) to a server at 10.0.2.10. What is the result?

Accepted Answer

The connection is denied by Rule 1.. Rule 1 denies all traffic from 10.0.1.0/24 to 10.0.2.0/24. Since the source (10.0.1.5) and destination (10.0.2.10) fall within these subnets, the SSH attempt is denied by Rule 1, regardless of any later rules. ACLs are processed top-down, and the first matching rule determines the action.

Answer

The connection is denied by Rule 3.

Answer

The connection is permitted by Rule 4.

Answer

The connection is permitted by the implicit permit.

Question 6

A security engineer is reviewing the configuration of a web application firewall (WAF) that protects a critical e-commerce site. Which TWO settings should be enabled to defend against SQL injection attacks? (Select TWO.)

Accepted Answer

Enable SQL injection signature rules.. Option A is correct because enabling SQL injection signature rules allows the WAF to inspect HTTP requests for known SQL injection patterns, such as UNION, OR 1=1, or comment sequences like '--', using a predefined rule set. Option B is correct because input validation for all query parameters ensures that user-supplied data is sanitized or rejected before reaching the application, preventing malicious SQL syntax from being interpreted by the database. Together, these controls provide both signature-based detection and behavioral prevention against SQL injection attacks.

Answer

Enable rate limiting on login endpoints.

Answer

Enable IP reputation blocking.

Answer

Enable SSL/TLS inspection for all traffic.

Question 7

During a compliance audit, an organization discovers that its backup data for a critical database is stored in an unencrypted format on a tape that is kept offsite. The organization's data protection policy requires encryption of all data at rest. Which of the following is the BEST remediation action?

Accepted Answer

Re-encrypt the existing tape and implement encryption for all future backups. Option C is the best remediation because it directly addresses the compliance violation by re-encrypting the existing unencrypted tape and ensuring all future backups are encrypted before being written to tape. This aligns with the data protection policy requiring encryption of data at rest, as the tape is a storage medium that holds data at rest. Simply encrypting future backups (Option D) would leave the existing unencrypted data in violation, while the other options do not address the at-rest encryption requirement.

Answer

Change the offsite storage provider to one with better physical security

Answer

Implement TLS for data transmission to offsite storage

Answer

Encrypt all future backups before writing to tape

Question 8

A security analyst observes that SSH connections to the server are failing, but HTTP and HTTPS traffic works. Based on the exhibit, what is the most likely cause?

Accepted Answer

The SSH service is being blocked by a firewall rule that drops TCP port 22 traffic.. The exhibit shows a firewall rule that explicitly drops TCP port 22 traffic, which is the default port for SSH. Since HTTP (port 80) and HTTPS (port 443) are unaffected, the issue is isolated to SSH. This rule is the most direct cause of the connection failures, as it blocks all SSH traffic regardless of source or destination.

Answer

The HTTPS rule is overriding the SSH rule.

Answer

The SSH service is only allowed from the 10.0.0.0/8 subnet.

Answer

The SSH service is misconfigured and not listening on the correct interface.

Question 9

A security engineer is writing a Python script to automate the revocation of compromised credentials across multiple cloud services. Which of the following is the most critical security consideration when implementing this script?

Accepted Answer

Use a secrets management service to store API keys.. Option B is correct because storing API keys in a secrets management service (e.g., HashiCorp Vault, AWS Secrets Manager) prevents hardcoding credentials in the script, which is a critical security practice for automation. Even with least privilege, if the API key is exposed in plaintext (e.g., in source code or logs), an attacker can reuse it across services. Secrets management also enables rotation, auditing, and dynamic access control, directly addressing the risk of credential compromise in multi-cloud revocation scripts.

Answer

Ensure the script runs with the least privilege necessary.

Answer

Log all actions performed by the script.

Answer

Run the script from a hardened bastion host.

Question 10

Which of the following is the primary security benefit of using immutable infrastructure in automated deployments?

Accepted Answer

Eliminates configuration drift and unauthorized changes. Immutable infrastructure ensures that servers are never modified after deployment; instead, updates are made by replacing the entire instance with a new, pre-configured image. This eliminates configuration drift because any unauthorized or unintended changes are wiped out on the next deployment cycle, enforcing a consistent, known-good state across all environments.

Answer

Reduces operational costs by reusing existing servers

Answer

Increases system performance through hardware acceleration

Answer

Simplifies monitoring by reducing the number of servers