CAS-004 Security Operations Practice Question
A penetration tester is conducting a test against a web application. The client has defined rules of engagement that prohibit any denial of service attacks. The tester discovers an endpoint that is vulnerable to command injection. Which THREE of the following actions should the tester take to validate the vulnerability while staying within scope? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the echo command to write a file on the server
Option A is correct because using the echo command to write a benign file on the server safely demonstrates command injection without causing damage or service disruption, which respects the no-DoS rules of engagement. Option B is correct because running whoami is a non-destructive command that confirms code execution and reveals the privilege context of the injected commands, providing clear validation evidence. Option E is correct because pinging a controlled server (e.g., via the ping command to an IP the tester owns) verifies outbound code execution and network reachability without harming the target or violating the no-DoS constraint. Option C is not appropriate because deleting a system file is destructive and could cause an outage or data loss, violating the rules of engagement. Option D is not appropriate because flooding the endpoint with multiple requests constitutes a denial-of-service style test, which the client explicitly prohibited.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the echo command to write a file on the server
Why this is correct
Writing a file with echo proves command injection executed without launching floods, crashes or resource exhaustion. This validates the vulnerability while honouring the rules of engagement prohibiting denial of service, satisfying the stem's in-scope constraint.
- ✓
Run a whoami command to confirm the user context
Why this is correct
Running whoami returns the executing user context, confirming command injection succeeded and revealing the privilege level of the compromised process. It is a lightweight, non-destructive check that respects the rules of engagement banning denial of service, satisfying the stem's validation requirement.
- ✗
Delete a random system file to observe impact
Why it's wrong here
Deleting a system file causes destructive impact beyond the authorised proof of concept, breaching scope and potentially disrupting the client's service. It is tempting because it definitively demonstrates command execution, yet safe validation uses non-destructive commands like whoami or id, reserving destructive payloads for explicitly permitted tests.
- ✗
Flood the endpoint with multiple requests to test resilience
Why it's wrong here
Flooding the endpoint constitutes a denial-of-service test, directly violating the rules of engagement; command injection is validated by injecting benign commands that prove execution, such as reading a harmless file. Flooding is tempting because it demonstrates resilience limits, and it would be valid only when DoS testing is explicitly authorised.
- ✓
Execute a ping command to a controlled server to verify code execution
Why this is correct
Pinging a controlled server confirms outbound code execution and network reachability without flooding the target. Because the tester owns the destination, traffic volume stays minimal, honouring the rules of engagement prohibiting denial of service while satisfying the stem's validation requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.