CAS-004 Security Operations Practice Question
A penetration tester is performing a test against a web application. The rules of engagement prohibit any denial of service (DoS) attacks. Which of the following actions is most likely prohibited by this restriction?
⚠ Common exam trap
CAS-005 often tests the interpretation of rules of engagement, and candidates may confuse other malicious actions (like SQL injection) with DoS, failing to recognize that DoS specifically targets availability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using a tool to send thousands of requests to overwhelm the server
Using a tool to send thousands of requests to overwhelm the server is a denial-of-service (DoS) attack, which is explicitly prohibited by the rules of engagement. This action aims to exhaust server resources, causing service unavailability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performing a SQL injection that deletes a table
Why it's wrong here
Deleting a table via SQL injection destroys data and can render the application unavailable, which the DoS prohibition covers. SQL injection itself is permitted; the destructive payload is the prohibited element. It is tempting because SQL injection is an injection flaw, not a volumetric attack, yet data destruction still constitutes denial of service.
- ✗
Exploiting a file upload vulnerability to upload a web shell
Why it's wrong here
Uploading a web shell grants persistent remote code execution, not service disruption, so it falls outside a DoS prohibition. It is tempting because file upload flaws are high-impact findings, and they would be the correct focus where the rules of engagement permit post-exploitation persistence but forbid availability attacks.
- ✓
Using a tool to send thousands of requests to overwhelm the server
Why this is correct
Flooding the server with thousands of requests is a volumetric denial-of-service technique, consuming resources until legitimate users are denied service. The rules of engagement explicitly prohibit DoS, so this action falls squarely within the restriction, unlike enumeration or injection testing which do not deny availability.
- ✗
Running a directory brute-force tool
Why it's wrong here
Directory brute-forcing sends many rapid requests but does not aim to exhaust resources or deny service; it enumerates paths. It is tempting because high request volume can resemble DoS traffic, yet the tool's purpose is discovery, and throttling keeps it within non-disruptive bounds.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.