mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security analyst at a financial institution is…
A security analyst at a financial institution is investigating a potential data exfiltration incident. The organization uses a zero-trust network architecture with micro-segmentation. The analyst notices that a database server with sensitive customer financial data has been communicating with an external IP address (198.51.100.45) over port 443 during non-business hours. The database server is not supposed to initiate outbound connections; all outbound traffic is logged and blocked by default except for specific allowlisted IPs and ports. The analyst reviews the firewall logs and finds that the outbound connection to 198.51.100.45 was allowed because the source port was 443, which is an allowed port for inbound HTTPS traffic. The database server is not a web server and does not run any HTTPS services. Which of the following is the best course of action for the analyst to take first?
⚠ Common exam trap
Watch out — candidates often assume the firewall allowed the connection because port 443 is legitimate for HTTPS, but the key insight is that the source port (not destination port) was used to bypass egress rules, requiring endpoint-level investigation rather than network-level blocking or application log review.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes
The database server is not supposed to initiate outbound connections, yet a connection to an external IP over port 443 was allowed due to source port 443 matching an inbound allow rule. This strongly suggests the server may be compromised, with malware or an unauthorized process using source port 443 to bypass firewall restrictions. Checking EDR logs is the best first step to identify malicious processes or indicators of compromise without prematurely destroying evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Immediately block the external IP address at the perimeter firewall
Why it's wrong here
Blocking the IP may disrupt evidence collection and does not address potential internal compromise.
- ✗
Disable the database server's network interface
Why it's wrong here
This is too drastic and may cause business disruption without first confirming compromise.
- ✗
Review the database server's recent application logs for any anomalies
Why it's wrong here
While useful, this step is secondary to determining if the server is actively compromised.
- ✓
Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes
Why this is correct
Checking EDR logs can quickly indicate whether the server is compromised, guiding further actions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.