CAS-004 Security Operations Practice Question
During a threat hunting exercise, a hunter uses the MITRE ATT&CK framework to identify a series of behaviors: an attacker used PowerShell to download a payload, then created a scheduled task for persistence, and finally performed credential dumping via LSASS. Which ATT&CK tactic is associated with the credential dumping technique?
⚠ Common exam trap
CAS-005 often tests the overlap between tactics — candidates see 'PowerShell' or 'scheduled task' in the scenario and pick Execution or Persistence, ignoring that the question specifically asks about the credential dumping step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Credential Access
Credential dumping via LSASS (e.g., Mimikatz reading lsass.exe memory) is classified under the Credential Access tactic in MITRE ATT&CK, specifically technique T1003 OS Credential Dumping. The tactic describes the adversary's goal of stealing account names and passwords to use for lateral movement and privilege escalation. LSASS holds cached credentials and Kerberos tickets, making it a prime target for this tactic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense Evasion
Why it's wrong here
Defense Evasion covers hiding activity or disabling controls, not reading credential material from memory. OS Credential Dumping via LSASS belongs to Credential Access, the tactic the question asks for. Defense Evasion would be correct if the question asked which tactic obfuscation or log clearing represents.
- ✓
Credential Access
Why this is correct
Credential dumping via LSASS maps to the Credential Access tactic in MITRE ATT&CK, which covers techniques for stealing account credentials such as hashes and plaintext passwords. This directly answers the stem's question about the tactic associated with the LSASS dumping behaviour.
- ✗
Execution
Why it's wrong here
Execution covers running malicious code, such as the PowerShell payload download, not harvesting credentials from memory. OS Credential Dumping via LSASS sits under Credential Access, the tactic the question asks for. Execution would be correct if the question instead asked which tactic the PowerShell command represents.
- ✗
Persistence
Why it's wrong here
Persistence covers maintaining footholds across restarts, such as the scheduled task, not extracting credentials. LSASS credential dumping maps to Credential Access, which is the tactic the question asks for. Persistence would be correct if the question asked which tactic the scheduled task illustrates.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.