CAS-004 Security Operations Practice Question
A security operations center (SOC) analyst is investigating an alert indicating potential credential dumping on a Windows server. The analyst reviews the process execution logs and sees that a process named 'lsass.exe' was accessed by an unsigned binary. Which of the following techniques is the attacker MOST likely using?
⚠ Common exam trap
The trap here is assuming that any credential-related attack involves lsass.exe, but techniques like Kerberoasting and DCSync do not access lsass.exe directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LSASS memory dumping
The scenario describes an unsigned binary accessing lsass.exe, which is a strong indicator of credential dumping. LSASS stores credentials in memory, and attackers use tools like Mimikatz to extract them. This allows the attacker to obtain password hashes or plaintext passwords for lateral movement. The other techniques do not involve direct access to lsass.exe.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
LSASS memory dumping
Why this is correct
LSASS (Local Security Authority Subsystem Service) stores credential material in memory, including password hashes and Kerberos tickets. Attackers often target lsass.exe to dump these credentials using tools like Mimikatz, ProcDump, or Task Manager. The scenario describes an unsigned binary accessing lsass.exe, which is a common indicator of credential dumping. This technique allows the attacker to obtain credentials for lateral movement and privilege escalation.
- ✗
Pass-the-hash
Why it's wrong here
Pass-the-hash is a technique where an attacker uses the NTLM hash of a user's password to authenticate without knowing the plaintext password. It does not involve accessing the lsass.exe process. Instead, it typically involves using tools like Mimikatz to extract hashes from memory, but the access to lsass.exe is part of the credential dumping phase, not the pass-the-hash technique itself.
- ✗
Kerberoasting
Why it's wrong here
Kerberoasting is an attack that targets service accounts by requesting Kerberos service tickets and then cracking them offline. It does not require accessing the lsass.exe process. Kerberoasting involves interacting with the domain controller and does not typically generate alerts related to lsass.exe access. The scenario describes direct access to lsass.exe, which is unrelated to Kerberoasting.
- ✗
DCSync
Why it's wrong here
DCSync is a technique where an attacker simulates the behavior of a domain controller to replicate credentials from Active Directory. It does not involve accessing lsass.exe on a member server. DCSync requires domain administrator privileges or replication rights and targets the domain controller directly. The scenario describes access to lsass.exe on a server, which is not consistent with DCSync.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.