CAS-004 Security Operations Practice Question
An organization is implementing a threat hunting program. The team decides to use a hypothesis-driven approach. Which of the following best describes this methodology?
⚠ Common exam trap
CAS-005 often tests the distinction between proactive hypothesis-driven hunting and reactive indicator-based or alert-driven approaches, so candidates must recognize that 'searching for known IOCs' and 'analyzing historical alerts' are not true threat hunting even though they sound security-related.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Developing a theory about potential adversary behavior and actively looking for signs
Hypothesis-driven threat hunting starts with an analyst forming a testable theory about how an adversary might operate in the environment — for example, 'attackers may be using PowerShell for lateral movement' — and then proactively searching telemetry for evidence that confirms or refutes that theory. This differs from reactive or feed-driven approaches because the hunt is guided by the analyst's hypothesis rather than by pre-existing alerts or indicators. The goal is to discover threats that have evaded automated detection, not to validate known badness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Developing a theory about potential adversary behavior and actively looking for signs
Why this is correct
Hypothesis-driven hunting starts from an informed theory about attacker tactics, techniques or targets, then queries telemetry for evidence confirming or refuting it. This differs from indicator-led hunting, which searches for known IoCs rather than testing a reasoned proposition about adversary behaviour.
- ✗
Searching for known indicators of compromise from threat feeds
Why it's wrong here
Threat-feed indicators are reactive lookups of already-known compromise, not hypothesis-driven hunting, which starts from an untested idea about attacker behaviour and searches telemetry for evidence. It is tempting because feed matching is a legitimate detection-engineering task, and would be the right choice when the goal is to operationalise known IOCs rather than discover unknown activity.
- ✗
Automated scanning of all systems for vulnerabilities
Why it's wrong here
Vulnerability scanning enumerates known weaknesses on hosts; it does not test a hypothesis about adversary behaviour against collected telemetry. It is tempting because scanning is proactive and systematic, and would be the right choice when the requirement is to identify unpatched software and misconfigurations rather than to hunt for active threats.
- ✗
Analyzing historical alerts for patterns
Why it's wrong here
Reviewing historical alerts is retrospective triage, not hypothesis-driven hunting, which begins with a formulated hypothesis and proactively queries data to confirm or refute it. It is tempting because alert-pattern analysis genuinely improves detection tuning, and would be correct when the objective is to reduce false positives or identify gaps in existing alerting.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.