CAS-004 Security Operations Practice Question
A security analyst is reviewing a suspicious file. Which static analysis technique would the analyst use to examine the file without executing it?
⚠ Common exam trap
CAS-005 often tests the static vs. dynamic analysis distinction, and the trap is that VirusTotal and sandboxes feel like 'analysis' but both involve execution or external submission, not static inspection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use strings to extract readable text
Using the 'strings' utility extracts readable ASCII/Unicode text from a binary without executing it, which is a classic static analysis technique for examining suspicious files. It reveals embedded URLs, file paths, error messages, and other indicators of compromise without any runtime risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Submit the file to VirusTotal
Why it's wrong here
VirusTotal runs the sample through antivirus engines and sandboxes, so the file is executed remotely — dynamic, not static. It is tempting because it quickly aggregates multi-engine verdicts and reputation, which suits rapid triage of a known hash, not examining code without execution.
- ✗
Execute the file in a debugger
Why it's wrong here
Debugging executes the file under a debugger, so code runs and can detonate — the opposite of static analysis. It is tempting because debuggers inspect instructions and memory step by step, which suits controlled dynamic analysis of trusted binaries, not examining a suspicious file without execution.
- ✗
Run the file in a sandbox
Why it's wrong here
A sandbox deliberately executes the file in an isolated environment to observe behaviour, which is dynamic analysis, not static. It is tempting because sandboxing safely contains malicious payloads while revealing runtime actions, making it the right choice when behavioural indicators are needed rather than code inspection.
- ✓
Use strings to extract readable text
Why this is correct
Running strings extracts embedded ASCII and Unicode sequences from the binary without loading or executing it, satisfying the requirement for non-execution. Readable artefacts such as URLs, file paths, registry keys and command fragments reveal functionality and indicators, making this a core static analysis technique.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.