hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A SOC analyst discovers unusual outbound traffic…
A SOC analyst discovers unusual outbound traffic from a host in the production DMZ to an unknown IP address on the internet. The traffic consists of encrypted connections (HTTPS) to a domain that was registered three days ago. The host is a web server that has been fully patched and is configured with a default deny egress firewall policy, but this particular traffic is being allowed because a recently added rule permits outbound HTTPS to any destination for a specific application's updates. The security architect is called in to investigate and must determine the best course of action to identify the scope of the potential compromise and prevent further data exfiltration. The architect has access to network flow data, endpoint detection and response (EDR) telemetry, and firewall logs. What should the security architect do FIRST?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use EDR to identify the process or service generating the outbound connections on the web server.
The best first step because using EDR to identify the process or service generating the outbound connections provides immediate visibility into the source of the unusual traffic without disrupting the potential evidence. This allows the architect to determine if the traffic is malicious (e.g., a compromised process) or benign (e.g., a legitimate update). Once the process is identified, further steps like SSL inspection, isolation, or rule modification can be taken based on the findings. Option A (SSL inspection) is resource-intensive and premature without first understanding the process. Option C (isolation) may destroy forensic evidence and is a containment step that should follow identification. Option D (removing the rule) could disrupt legitimate applications and does not help identify the scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable full SSL inspection on the firewall to decrypt the traffic and analyze the contents.
Why it's wrong here
SSL inspection is heavy and may not be immediately feasible; also, it might alert the attacker.
- ✓
Use EDR to identify the process or service generating the outbound connections on the web server.
Why this is correct
EDR can pinpoint the root cause (e.g., a webshell or backdoor) for further investigation.
- ✗
Isolate the web server from the network to prevent further data exfiltration.
Why it's wrong here
Isolation is a strong containment step but should be done after gathering initial evidence to preserve forensic data.
- ✗
Immediately remove the outbound HTTPS rule to block the traffic.
Why it's wrong here
This may disrupt legitimate application updates and does not provide forensic insight.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.