hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Given the exhibit, what is the MOST likely…
Exhibit
Refer to the exhibit. ``` [timestamp] firewall: Deny TCP 10.0.1.100:54321 -> 203.0.113.5:80 (Drop) [timestamp] firewall: Allow TCP 10.0.1.100:54322 -> 203.0.113.5:443 (Allow) [timestamp] IDS: Alert - SQL Injection attempt detected from 10.0.1.100 to 203.0.113.5:443 [timestamp] web_server: HTTP POST /login.php with sql_injection_pattern ```
Given the exhibit, what is the MOST likely scenario?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An internal host is compromised and attacking an external web server.
The internal host 10.0.1.100 initially tried to connect to port 80 (HTTP) but was denied, then used port 443 (HTTPS) which was allowed, and then performed SQL injection on the web server. This suggests the host is compromised and attempting to attack an external server via HTTPS to bypass firewall rules. Option A is wrong because the traffic is outward, not inbound. Option B is wrong because SQL injection is detected, and the pattern is deliberate. Option D is wrong because host is active.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A misconfigured application is sending malformed data to a server.
Why it's wrong here
The pattern of SQL injection is intentional, not misconfiguration.
- ✗
An external attacker is scanning the internal network.
Why it's wrong here
All source IPs are internal 10.0.1.100.
- ✓
An internal host is compromised and attacking an external web server.
Why this is correct
The host adapts to firewall rules and launches SQL injection attack.
- ✗
A web vulnerability scanner is performing authorized tests.
Why it's wrong here
The SQL injection alert suggests malicious intent, and there's no authorization indication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.