How many Troubleshooting Scenario Questions questions are on this page?

This page has 10 Troubleshooting Scenario Questions scenario questions for the CAS-004 exam, each with detailed explanations and wrong-answer analysis.

How should I approach CAS-004 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to CompTIA SecurityX CAS-004 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise CompTIA SecurityX CAS-004 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CAS-004

exam code

CompTIA

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A security engineer is troubleshooting a web application that uses OAuth 2.0 for authorization. Users report that after authenticating, they are unable to access resources that require a specific scope. The engineer inspects the authorization request and finds that the scope parameter is missing. Which OAuth flow is most likely being used?

A
Client credentials grant
Why wrong: Client credentials grant includes scope; scope is required for resource access.
B
Authorization code grant
Why wrong: Authorization code grant includes scope in the request; missing scope would cause error.
C
Resource owner password credentials grant
Why wrong: This grant type includes scope parameter; missing scope would prevent proper authorization.
D
Implicit grant
Implicit grant does not support scope parameter; scopes are typically fixed in client configuration.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

Exhibit

Refer to the exhibit.

```
# iptables -L FORWARD -v -n
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth0   eth1    10.0.1.0/24          0.0.0.0/0            state NEW,ESTABLISHED
    0     0 ACCEPT     all  --  eth1   eth0    0.0.0.0/0            10.0.1.0/24          state ESTABLISHED
```

A
New connections from the internet to 10.0.1.0/24 are allowed.
Why wrong: Only established connections from internet to 10.0.1.0/24 are allowed; new connections are dropped.
B
All traffic is allowed by default because the policy is ACCEPT.
Why wrong: The policy is DROP, not ACCEPT.
C
Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.
The first rule matches new and established traffic from 10.0.1.0/24; the second matches only established traffic back.
D
The rules apply to incoming traffic on the firewall itself.
Why wrong: The FORWARD chain applies to traffic passing through the firewall, not traffic destined to the firewall.

Full breakdown with real-world context →

Question 3easymultiple choice

Full question →

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

A
Submit a change request to implement an email content filter.
Why wrong: This is a long-term control, not an immediate investigation step.
B
Check if the host is configured as a mail server in the organization's asset database.
This step quickly confirms if the traffic is expected, avoiding unnecessary escalation.
C
Block the outbound traffic on the firewall to prevent potential data exfiltration.
Why wrong: Blocking first may cause service disruption without proper investigation.
D
Run a full antivirus scan on the host to detect any malware.
Why wrong: This is a later step; initial verification of the host's role is faster and less disruptive.

Full breakdown with real-world context →

Question 4mediummulti select

Study the full ACL explanation →

A network administrator is troubleshooting connectivity to a server at 192.168.1.100. The ACL shown is applied inbound on GigabitEthernet0/0. Which THREE statements are true regarding this ACL configuration? (Choose three.)

Exhibit

Refer to the exhibit.

```
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip access-group ACL-IN in
!
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.0
!
access-list 100 deny tcp any host 192.168.1.100 eq 22
access-list 100 deny tcp any host 192.168.1.100 eq 3389
access-list 100 permit ip any any
```

A
The ACL will block all traffic from the 192.168.1.0/24 network to 10.0.0.0/24
Why wrong: The ACL permits all traffic; it does not block to 10.0.0.0/24. Also, it filters inbound on G0/0, not outbound.
B
Traffic sourced from 192.168.1.100 going to the 10.0.0.0/24 network will be permitted
The ACL does not filter traffic sourced from 192.168.1.100; it filters based on destination.
C
Traffic from the 10.0.0.0/24 network to 192.168.1.100 is not affected by this ACL
The ACL is applied inbound on G0/0; traffic from 10.0.0.0/24 enters via G0/1.
D
The implicit deny at the end of the ACL will block all other traffic not explicitly permitted
Why wrong: The explicit permit ip any any overrides the implicit deny for all traffic.
E
The ACL blocks SSH and RDP access to 192.168.1.100 from any source
The deny entries for port 22 and 3389 block these protocols.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A SOC analyst notices that a containerized application is making unexpected outbound connections. The container runs with minimal privileges. Which step should the analyst take first to investigate without compromising the environment?

A
Restore the container from a trusted image and re-deploy.
Why wrong: Re-deploying without investigation misses the opportunity to understand the incident.
B
Use `docker exec` to attach a shell and run network diagnostic commands.
Why wrong: Attaching a shell could alter the container state and alert an attacker.
C
Immediately kill the container and analyze its filesystem from a backup.
Why wrong: Killing the container may destroy volatile evidence.
D
Capture a network packet dump from the host and correlate with container logs.
This approach gathers evidence without interfering with the container.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Exhibit

type=AVC msg=audit(1234567890.123:456): avc:  denied  { connectto } for  pid=1234 comm="httpd" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:unconfined_t:s0 tclass=unix_stream_socket

A
Disable SELinux entirely
Why wrong: Disabling SELinux removes all protections, which is insecure.
B
Restart the httpd service
Why wrong: Restarting does not change SELinux policy; the denial will persist.
C
Change the SELinux enforcing mode to permissive
Why wrong: Permissive mode disables enforcement but is a temporary workaround, not a proper resolution.
D
Add an SELinux policy module to allow httpd_t to connectto unconfined_t
This creates a targeted policy rule to allow the specific connection while maintaining enforcement.

Full breakdown with real-world context →

Question 7hardmulti select

Full question →

A CSIRT is developing a threat hunting hypothesis based on the MITRE ATT&CK framework. Which THREE of the following are techniques that threat hunters would commonly investigate for initial access? (Choose three.)

A
Exploit public-facing application
Exploiting vulnerabilities in internet-facing applications is another common technique.
B
Spear-phishing attachment
Spear-phishing is a common initial access vector.
C
Valid accounts
Using valid credentials to gain initial access is a common technique.
D
Remote services
Why wrong: Remote services are often used for lateral movement, not initial access.
E
Boot or logon autostart execution
Why wrong: This is a persistence technique, not initial access.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

Refer to the exhibit. A security analyst notices that users from the internet can reach the web server at 10.0.1.100 on port 443, but they cannot reach it on port 8443. What is the most likely cause?

Exhibit

access-list extended OUTSIDE-IN
 permit tcp any host 10.0.1.100 eq 443
 permit tcp any host 10.0.1.100 eq 8443
 deny ip any any

A
The ACL only permits traffic from specific source IPs
Why wrong: The ACL permits 'any' source.
B
The firewall rule order is incorrect
Why wrong: The permit rules are before the deny, so order is correct.
C
The web server is not listening on port 8443
If the server is not configured for port 8443, it will not respond.
D
The firewall is blocking all traffic on port 8443
Why wrong: The ACL explicitly permits port 8443.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full network assurance explanation →

A SOC analyst discovers unusual outbound traffic from a host in the production DMZ to an unknown IP address on the internet. The traffic consists of encrypted connections (HTTPS) to a domain that was registered three days ago. The host is a web server that has been fully patched and is configured with a default deny egress firewall policy, but this particular traffic is being allowed because a recently added rule permits outbound HTTPS to any destination for a specific application's updates. The security architect is called in to investigate and must determine the best course of action to identify the scope of the potential compromise and prevent further data exfiltration. The architect has access to network flow data, endpoint detection and response (EDR) telemetry, and firewall logs. What should the security architect do FIRST?

A
Enable full SSL inspection on the firewall to decrypt the traffic and analyze the contents.
Why wrong: SSL inspection is heavy and may not be immediately feasible; also, it might alert the attacker.
B
Use EDR to identify the process or service generating the outbound connections on the web server.
EDR can pinpoint the root cause (e.g., a webshell or backdoor) for further investigation.
C
Isolate the web server from the network to prevent further data exfiltration.
Why wrong: Isolation is a strong containment step but should be done after gathering initial evidence to preserve forensic data.
D
Immediately remove the outbound HTTPS rule to block the traffic.
Why wrong: This may disrupt legitimate application updates and does not provide forensic insight.

Full breakdown with real-world context →

Question 10easymultiple choice

Full question →

A company is deploying a new cloud-based application that processes sensitive customer data. The security architect has proposed a zero-trust architecture to secure remote access. The architecture includes identity-aware proxies, microsegmentation, and continuous monitoring. During the transition, several remote users report being unable to access the application. The security architect verifies that the identity-aware proxy is correctly configured and that users are authenticated via SSO. However, access attempts are still failing. The architect suspects that the issue may be related to the microsegmentation rules. What should the security architect do FIRST to resolve the problem?

A
Deploy a VPN to provide a secure tunnel for remote users.
Why wrong: VPNs conflict with zero-trust architecture and do not address the microsegmentation issue.
B
Reset the affected users' credentials and force them to re-authenticate.
Why wrong: Authentication is working; credential reset would not resolve the access issue.
C
Review the microsegmentation firewall rules to ensure that traffic to the application's subnet is permitted.
The architect suspects microsegmentation; reviewing rules is the logical first step.
D
Increase logging verbosity on the identity-aware proxy to capture more details.
Why wrong: While logging helps, it is secondary to directly checking the suspected firewall rules.

Full breakdown with real-world context →

These CAS-004 practice questions are part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style CAS-004 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related CAS-004 topic practice pages

Scripting, Containers and Automation practice questions

Application Environment, Configuration and Security practice questions

Governance, Risk and Compliance practice questions

Security Engineering practice questions

Security Architecture practice questions

Security Operations practice questions

CAS-004 fundamentals practice questions

CAS-004 scenario practice questions

CAS-004 troubleshooting practice questions

Practice scenarios

A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?

Exhibit

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

A network administrator is troubleshooting connectivity to a server at 192.168.1.100. The ACL shown is applied inbound on GigabitEthernet0/0. Which THREE statements are true regarding this ACL configuration? (Choose three.)

Exhibit

A SOC analyst notices that a containerized application is making unexpected outbound connections. The container runs with minimal privileges. Which step should the analyst take first to investigate without compromising the environment?

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Exhibit

A CSIRT is developing a threat hunting hypothesis based on the MITRE ATT&CK framework. Which THREE of the following are techniques that threat hunters would commonly investigate for initial access? (Choose three.)

Refer to the exhibit. A security analyst notices that users from the internet can reach the web server at 10.0.1.100 on port 443, but they cannot reach it on port 8443. What is the most likely cause?

Exhibit