hardMultiple SelectObjective-mapped
CAS-004 Practice Question: An incident responder is analyzing a compromised…
An incident responder is analyzing a compromised server. Which THREE indicators are MOST likely to confirm a successful attack?
⚠ Common exam trap
The CASP+ exam often tests the distinction between indicators of an ongoing attack (like failed logins) and indicators of a successful compromise (like corrupted files or new accounts), tricking candidates into selecting multiple failed login attempts as a confirmation of success.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Corrupted system files
Corrupted system files (A) are a strong indicator of a successful attack because many malware variants, such as ransomware or rootkits, intentionally modify or encrypt critical system files (e.g., DLLs, executables) to maintain persistence or cause damage. The incident responder would detect this via file integrity monitoring (FIM) tools like Tripwire or by comparing file hashes against known-good baselines, revealing unauthorized changes that confirm compromise.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Corrupted system files
Why this is correct
Corrupted files can result from malware or unauthorized modification.
- ✓
Unusual outbound network connections
Why this is correct
Unexpected connections to external IPs may indicate data exfiltration or C2 traffic.
- ✗
Multiple failed login attempts
Why it's wrong here
Failed logins indicate attempts, not successful compromise.
- ✗
High CPU usage due to legitimate processes
Why it's wrong here
High CPU could be from normal operations or mining malware, but it is not a definitive indicator.
- ✓
New unauthorized administrative accounts
Why this is correct
Adversaries often create accounts to maintain access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.