CAS-004 Security Operations Practice Question
A security analyst is reviewing a suspicious email reported by a user. The email contains an attachment named 'invoice.pdf.exe'. Which type of malware analysis technique should the analyst perform first to determine if the file is malicious?
⚠ Common exam trap
CAS-005 often tests the confusion between static and dynamic analysis — candidates may think 'sandbox' is always first, but the safest and fastest initial triage for an unknown file is static analysis, not execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Static analysis
Static analysis examines the file without executing it, inspecting headers, strings, hashes, and embedded indicators (e.g., PE headers, suspicious imports) to quickly determine if it is malicious. For a double-extension file like 'invoice.pdf.exe', static analysis is the safest first step because it avoids any risk of execution and can often reveal known malware signatures or obfuscation. It is faster and less resource-intensive than dynamic analysis or reverse engineering, making it the standard initial triage technique.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reverse engineering
Why it's wrong here
Reverse engineering disassembles or decompiles the binary to reconstruct its logic, which is labour-intensive and premature before basic static triage. It suits deep-diving a confirmed, obfuscated sample once hashes and strings have already indicated malicious intent.
- ✓
Static analysis
Why this is correct
Static analysis examines the file's structure, strings and headers without executing it, safely revealing the double extension and embedded indicators. This satisfies the stem's need to determine maliciousness first, before risking execution in a sandbox.
- ✗
Dynamic analysis in a sandbox
Why it's wrong here
Sandbox detonation executes the sample to observe behaviour, but it is not the first triage step; static inspection of the double extension and file metadata is quicker and safer. Dynamic analysis suits confirming behaviour after static analysis flags the file as suspicious.
- ✗
Memory forensics
Why it's wrong here
Memory forensics examines volatile RAM from a running infected host, but the analyst holds only a quarantined email attachment with no executing process to capture. It suits investigating an active compromise on a live endpoint, not triaging a file at rest.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.