How should I use these Security Operations practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security Operations questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Operations domain.

CAS-005 · topic practice

Security Operations practice questions

Security Operations covers threat hunting, incident response, digital forensics, and malware analysis on the CompTIA SecurityX exam. Questions present realistic scenarios—memory-resident PowerShell, volatile evidence collection order, phishing macro payload delivery, static binary inspection—and ask you to select the correct methodology, phase, or analysis technique rather than recall definitions.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Security Operations

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Operations

A candidate must apply the correct methodology, evidence order, or incident phase to a scenario. The single most important thing: preserve volatile data first and never execute a sample when static analysis is requested.

Threat hunting hypothesis-driven methodology, including MITRE ATT&CK mapping and PowerShell in-memory execution detection

Volatile evidence collection order: memory, network connections, running processes, then disk artifacts

Incident response phases: identification, containment, eradication, recovery, and lessons learned per NIST SP 800-61

Static malware analysis of binaries without execution, including strings, PE headers, and disassembly

Watch out for

Common Security Operations exam traps

▸Collecting disk images before memory, which destroys volatile data such as running processes and network connections
▸Confusing static analysis with dynamic or sandbox analysis when the question says the sample must not be executed
▸Mismatching incident response phases, such as labeling containment as eradication or recovery when the scenario describes isolating a host

Practice set

Security Operations questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Ansible explanation →

A security operations center (SOC) is implementing a SOAR platform to automate responses to phishing incidents. The playbook will include steps to automatically quarantine suspicious emails, delete them from user mailboxes, and block the sender's domain. Which element should the SOAR playbook incorporate to ensure the automated response does not cause unintended disruption?

Trap 1: An automatic rollback script that restores quarantined emails after…

Automatic rollback could reintroduce malicious content and does not address the need for oversight.

Trap 2: Integration with threat intelligence to verify the sender domain…

While threat intel helps, it may not prevent all false positives; the question asks about avoiding unintended disruption.

Trap 3: A manual approval step before executing any automated response

Full manual approval defeats the purpose of automation; a better approach is conditional approval only for high-risk actions.

Study all Security Operations common traps →

A
An automatic rollback script that restores quarantined emails after 24 hours if no user complaint
Why it fails: Automatic rollback could reintroduce malicious content and does not address the need for oversight.
B
Integration with threat intelligence to verify the sender domain reputation score before blocking
Why it fails: While threat intel helps, it may not prevent all false positives; the question asks about avoiding unintended disruption.
C
A confirmation step that prompts the analyst to approve the quarantine and deletion actions
Inserting a manual approval gate before quarantine and deletion lets an analyst validate each automated action, preventing the playbook from disrupting legitimate business email. This directly satisfies the stem's constraint that automated response must not cause unintended disruption.
D
A manual approval step before executing any automated response
Why it fails: Full manual approval defeats the purpose of automation; a better approach is conditional approval only for high-risk actions.

Security Operations practice questions

What to know about Security Operations

Common Security Operations exam traps

Security Operations questions

An organization is deploying deception technology to detect lateral movement by attackers. Which of the following would be the most effective to detect an attacker who has gained access to the internal network and is attempting to move to a sensitive server?

A security team is conducting a penetration test against a client's web application. During the reconnaissance phase, the tester discovers a subdomain that hosts a development version of the application with debug mode enabled. Which type of reconnaissance does this activity represent?

A penetration tester is planning a test for a client that has a critical web application. The rules of engagement specify that the tester must avoid causing a denial of service (DoS). Which THREE actions are appropriate for the tester to include in the scope? (Select THREE.)

A security analyst is reviewing a suspicious executable file. The analyst performs static analysis by examining the file's strings and imports. Which of the following findings would most strongly suggest the file is packed or obfuscated?

During a forensic investigation, an analyst needs to collect volatile data from a compromised Linux server. Which of the following orders of volatility is correct for collecting the listed data?

During a digital forensics investigation, an analyst is examining a Windows system suspected of being compromised. Which THREE of the following artifacts would be most useful for determining the timeline of the attack?

A security engineer is implementing deception technology to detect lateral movement by adversaries. Which type of deception resource would be MOST effective for capturing adversary credential harvesting activities on a network segment that contains no real domain controllers?

A security operations team is designing a threat hunting program. They want to use the MITRE ATT&CK framework to structure their hunts. Which TWO components of the ATT&CK framework should they focus on to develop hypothesis-driven hunts? (Select TWO.)

An organization discovers a critical vulnerability in a legacy application that cannot be patched due to vendor end-of-life. Which of the following is the BEST compensating control to reduce risk?

A security analyst is analyzing a memory dump using Volatility. The analyst wants to list all running processes and identify any hidden processes. Which Volatility plugin should be used?

A security analyst is triaging a suspicious file. The analyst wants to perform static analysis to gather initial information. Which TWO of the following are static analysis techniques?

During an incident response, a security analyst identifies a previously unknown malware variant. Which type of threat intelligence feed would provide the most timely and structured information about this threat?

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect a known attack pattern that involves multiple failed logins followed by a successful login from a different IP address. Which approach best reduces false positives while maintaining detection effectiveness?

Which phase of the incident response lifecycle involves removing the threat from the environment and restoring systems to normal operations?

Track your progress over time

Start a Security Operations only practice session

Related CAS-005 topic practice pages

Governance, Risk, and Compliance practice questions

Security Architecture practice questions

Security Engineering practice questions

Security Operations practice questions

CAS-005 fundamentals practice questions

CAS-005 scenario practice questions

CAS-005 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid