hardMultiple SelectObjective-mapped
CAS-004 Practice Question: A CSIRT is developing a threat hunting hypothesis…
A CSIRT is developing a threat hunting hypothesis based on the MITRE ATT&CK framework. Which THREE of the following are techniques that threat hunters would commonly investigate for initial access? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploit public-facing application
Options A, B, and C are correct. Exploiting a public-facing application (A), spear-phishing attachment (B), and valid accounts (C) are all common techniques for initial access according to the MITRE ATT&CK framework. Option D (remote services) is typically associated with lateral movement, not initial access. Option E (boot or logon autostart execution) is a persistence technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Exploit public-facing application
Why this is correct
Exploiting vulnerabilities in internet-facing applications is another common technique.
- ✓
Spear-phishing attachment
Why this is correct
Spear-phishing is a common initial access vector.
- ✓
Valid accounts
Why this is correct
Using valid credentials to gain initial access is a common technique.
- ✗
Remote services
Why it's wrong here
Remote services are often used for lateral movement, not initial access.
- ✗
Boot or logon autostart execution
Why it's wrong here
This is a persistence technique, not initial access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.