easyMultiple Select
CAS-004 Practice Question: A security analyst is reviewing web server logs…
A security analyst is reviewing web server logs and notices repeated requests to URLs containing sequences like '/../../../etc/shadow' and '/../../../etc/passwd'. Which TWO actions should the analyst take as part of the immediate incident response process?
⚠ Common exam trap
CAS-005 often tests the balance between validation and containment—candidates pick drastic actions like rebuilding the server or disabling it, but the immediate response requires confirming exploitation and blocking the source, not full remediation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check for successful exploitation by reviewing file access logs
Option A is correct because the log entries show directory traversal attempts targeting sensitive files like /etc/shadow and /etc/passwd, so the analyst must determine whether any request actually succeeded by correlating web server logs with file access logs (e.g., auditd or file integrity monitoring) to confirm compromise. Option B is correct because blocking the attacking source IP at the firewall is a standard immediate containment step that stops ongoing exploitation attempts while investigation continues. Option C is not appropriate as an immediate response since antivirus scanning targets malware, not directory traversal exploitation of a web application. Option D is premature because rebuilding from backup is a recovery action that should only follow confirmed compromise and root-cause analysis. Option E is overly disruptive; disabling the web server is not warranted unless exploitation is confirmed and no other containment is feasible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check for successful exploitation by reviewing file access logs
Why this is correct
Reviewing file access logs confirms whether the directory traversal attempts actually reached /etc/shadow or /etc/passwd, distinguishing reconnaissance from compromise. This satisfies the immediate response requirement to establish exploitation status before containment, since the URL patterns alone only evidence attempted traversal, not successful reads of those credential files.
- ✓
Block the source IP address at the firewall
Why this is correct
Blocking the source IP at the firewall immediately stops the ongoing traversal attempts, containing the attack while investigation proceeds. This satisfies the immediate response requirement by cutting off the hostile source without disrupting legitimate traffic.
- ✗
Run a full antivirus scan on the web server
Why it's wrong here
Antivirus scans filesystem malware, but path traversal exploits web application input handling, leaving no malicious binary to detect. Scanning suits suspected trojan or rootkit infections, not HTTP requests that never executed code on the host.
- ✗
Rebuild the web server from a known good backup
Why it's wrong here
Rebuilding from backup addresses recovery, not the active path-traversal attempts in the logs; the server is not yet confirmed compromised, so restoration is premature and would not stop ongoing requests. It is tempting because rebuilding is the standard containment step after confirmed compromise, and would be correct once evidence shows files such as /etc/shadow were actually read.
- ✗
Disable the web server until a patch is applied
Why it's wrong here
Taking the server offline halts the business service entirely, whereas the traversal attempts were blocked and only warrant log analysis plus input validation. Stopping a host suits confirmed active compromise requiring containment, not reconnaissance-style probes that failed.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.