CAS-004 Security Operations Practice Question
A security operations center (SOC) is evaluating a new endpoint detection and response (EDR) tool. The tool reports a suspicious process that is making outbound network connections to a known command-and-control (C2) server. The SOC analyst wants to confirm the process is malicious by examining the process's parent-child relationships and command-line arguments. Which of the following should the analyst use to BEST achieve this?
⚠ Common exam trap
The trap here is assuming that network flow data or packet captures can reveal endpoint process details, when they only show network-level information.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Endpoint process monitoring with Sysmon
The analyst needs endpoint process context, specifically parent-child relationships and command-line arguments, to confirm malicious behavior. Sysmon provides detailed process creation events including parent process ID, command line, and hashes, enabling correlation of the suspicious process with its origin and intent. Network-based tools like NetFlow and packet capture lack endpoint process visibility, while standard Windows Security logs may not capture full command lines. Sysmon is the appropriate tool for this level of endpoint telemetry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Endpoint process monitoring with Sysmon
Why this is correct
Sysmon, when configured with appropriate rules, logs process creation events including parent process ID, command-line arguments, and hashes. This data allows the analyst to trace the suspicious process's lineage and inspect its command line for malicious indicators. It directly answers the need to examine parent-child relationships and arguments, making it the best choice.
- ✗
Full packet capture
Why it's wrong here
Full packet capture records network traffic payloads, which could reveal C2 communication patterns, but it does not provide endpoint process context such as parent-child relationships or command-line arguments. The analyst would see the network conversation but not which process generated it. Therefore, it does not meet the requirement.
- ✗
NetFlow analysis
Why it's wrong here
NetFlow provides metadata about network flows such as source/destination IP, ports, and byte counts, but it does not include process-level details like parent-child relationships or command-line arguments. While NetFlow can show the outbound connection to the C2 server, it cannot confirm which process initiated it or its lineage. Thus, it is insufficient for the analyst's goal.
- ✗
Windows Event Log subscription for Security events
Why it's wrong here
Windows Security event logs can include process creation events (e.g., event ID 4688) if audit policies are enabled, but they often lack command-line arguments unless explicitly configured, and they do not provide the same depth as Sysmon. They may show process creation but not the rich parent-child relationships and command lines that Sysmon captures by default. Hence, it is less effective for this scenario.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.