easyMultiple SelectObjective-mapped
CAS-004 Practice Question: A security analyst is reviewing web server logs…
A security analyst is reviewing web server logs and notices repeated requests to URLs containing sequences like '/../../../etc/shadow' and '/../../../etc/passwd'. Which TWO actions should the analyst take as part of the immediate incident response process?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check for successful exploitation by reviewing file access logs
The correct immediate actions are A and B. Checking for successful exploitation (A) is crucial to determine if the attacker accessed sensitive files like /etc/shadow or /etc/passwd, which would indicate a breach requiring further response. Blocking the source IP at the firewall (B) stops further exploitation attempts from that address. Running a full antivirus scan (C) is not directly relevant to a directory traversal attack, which exploits application logic rather than malware. Rebuilding the web server from backup (D) is premature before confirming compromise, and disabling the server (E) is too disruptive when containment via IP blocking suffices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check for successful exploitation by reviewing file access logs
Why this is correct
Determines if sensitive files were actually accessed.
- ✓
Block the source IP address at the firewall
Why this is correct
Prevents further exploitation attempts from the same source.
- ✗
Run a full antivirus scan on the web server
Why it's wrong here
Not relevant; this is a web application attack, not malware.
- ✗
Rebuild the web server from a known good backup
Why it's wrong here
Premature; need to assess impact first.
- ✗
Disable the web server until a patch is applied
Why it's wrong here
Too drastic; immediate blocking of the source is sufficient.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.