mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: An incident responder notices that a compromised…
An incident responder notices that a compromised host is sending encrypted C2 traffic over TCP port 443. The existing firewall rule allows outbound HTTPS (443) to any destination. Which change to the security architecture would best detect this behavior while minimizing impact on legitimate traffic?
⚠ Common exam trap
A common mix-up: candidates assume a network-based IDS can detect malicious traffic in encrypted streams, but without decryption (as in a forward proxy with SSL inspection), the IDS sees only ciphertext and cannot analyze the payload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a forward proxy with SSL/TLS inspection
A forward proxy with SSL/TLS inspection decrypts outbound HTTPS traffic, allowing the security team to inspect the payload of connections over TCP 443. This reveals encrypted C2 traffic that would otherwise be hidden within legitimate HTTPS flows, while still permitting authorized business traffic to pass through after inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy a forward proxy with SSL/TLS inspection
Why this is correct
A proxy can decrypt, inspect, and re-encrypt traffic to detect malicious payloads.
- ✗
Block outbound TCP 443 and require users to use a VPN
Why it's wrong here
This disrupts all HTTPS traffic and may not be feasible.
- ✗
Enable logging on the firewall for all outbound 443 traffic
Why it's wrong here
Logging alone does not reveal the content of encrypted traffic.
- ✗
Install a network-based IDS on the internal side of the firewall
Why it's wrong here
An IDS cannot inspect encrypted traffic without decryption keys.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.