CAS-004 Security Operations Practice Question
A security engineer is implementing deception technology to detect lateral movement by adversaries. Which type of deception resource would be MOST effective for capturing adversary credential harvesting activities on a network segment that contains no real domain controllers?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A honeytoken in the form of a fake service account password
A honeytoken (e.g., a fake credential file or a service account password) planted on a system can trigger an alert when an adversary attempts to use it. A fake domain controller honeypot is also effective but may require more resources. However, a honeytoken is specifically designed to be used by attackers and is simple to deploy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A SIEM correlation rule for anomalous logins
Why it's wrong here
Correlation rules detect anomalies but do not actively deceive attackers.
- ✗
A network-based intrusion detection system (NIDS)
Why it's wrong here
NIDS detects network traffic, not credential usage specifically.
- ✗
A honeypot configured as a domain controller
Why it's wrong here
A honeypot configured as a domain controller fails this scenario because the network segment contains no real domain controllers. An adversary operating within such a segment would likely not expect to find a domain controller and would therefore not target it for credential harvesting, making it an ineffective lure. This option is tempting because domain controllers are critical targets for credential harvesting in environments with Active Directory or Microsoft Entra ID Domain Services, and a honeypot DC is highly effective for detecting such attacks when real domain controllers are present.
- ✓
A honeytoken in the form of a fake service account password
Why this is correct
Honeytokens are lightweight and trigger alerts when used.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.