CAS-004 Security Operations Practice Question
A security engineer is configuring a SIEM correlation rule to detect a potential data exfiltration attempt. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address that has never been communicated with before, within a 5-minute window. Additionally, the external IP should not be on any whitelist. Which correlation logic best implements this detection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Alert when a host sends >10 MB to an external IP that is not in the whitelist and not seen in the last 24 hours, aggregated over 5 minutes.
Ly implements the detection rule. It aggregates data transfer per host over 5 minutes, checks that the volume exceeds 10 MB, verifies the external IP is not on any whitelist, and ensures the IP has not been seen in the last 24 hours (i.e., it is a new destination). This matches all the requirements: a single internal host, >10 MB, to an external IP never communicated with before, within 5 minutes, and not whitelisted. Option B adds an unnecessary port 443 condition. Option C omits the requirement that the external IP must be new (unseen before). Option D aggregates over all external IPs without checking newness, which could alert on previously contacted IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Alert when a host sends >10 MB to an external IP that is not in the whitelist and not seen in the last 24 hours, aggregated over 5 minutes.
Why this is correct
Correctly aggregates volume and checks for new destination and whitelist.
- ✗
Alert when a host sends >10 MB to an external IP not in the whitelist and the destination port is 443.
Why it's wrong here
Unnecessarily restricts to port 443; may miss exfiltration over other ports.
- ✗
Alert when any host sends >10 MB to an external IP not in the whitelist within 5 minutes.
Why it's wrong here
Does not check if the destination IP is new.
- ✗
Alert when a host sends >10 MB to any external IP aggregated over 5 minutes, then filter out whitelisted IPs.
Why it's wrong here
Does not check if the IP is new.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.