CAS-004 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Signature-based detection using file hashes

  Why it's wrong here

  Hashes match known malware files, so novel ransomware binaries and the shadow-copy deletion command evade them. Behavioural detection of process and file-system sequences is needed. Signatures suit identifying previously catalogued samples, not observing encryption followed by vssadmin activity.

• ✓

  Behavioral detection for mass file modifications and vssadmin.exe execution

  Why this is correct

  Ransomware's destructive sequence — rapid mass file encryption followed by vssadmin.exe deleting shadow copies — is a behavioural pattern, not a signature. Detecting that combination of mass modification and shadow-copy deletion catches the attack regardless of malware family, satisfying the requirement to detect this specific behaviour.

• ✗

  Allowlisting of trusted applications

  Why it's wrong here

  Allowlisting permits trusted executables to run; it does not inspect what those processes do, so a signed or abused binary encrypting files and deleting shadow copies passes. Behavioural monitoring catches that sequence. Allowlisting is correct for blocking unauthorised executables on fixed-function endpoints.

• ✗

  Network traffic analysis to detect C2 communication

  Why it's wrong here

  C2 traffic analysis detects command-and-control channels, not local file encryption or shadow-copy deletion, which generate no distinctive network signature. Host-level behavioural detection is required. Network analysis is correct when the threat indicator is beaconing or exfiltration to an external server.