hardMultiple SelectObjective-mapped
CAS-004 Practice Question: Which THREE of the following are effective…
Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)
⚠ Common exam trap
The CAS-004 exam often tests the distinction between detection techniques that rely on known indicators (signature-based) versus those that detect unknown threats (behavioral/anomaly-based), and candidates may mistakenly think signature-based IDS is sufficient for APTs because they focus on the 'advanced' aspect rather than the 'persistent' and 'unknown' nature of the threat.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.
Behavioral analysis (option B) is effective against APTs because it establishes a baseline of normal activity and flags deviations, such as unusual lateral movement or data exfiltration patterns, which APTs often exhibit. Unlike signature-based methods, behavioral analysis can detect novel or zero-day attack techniques that do not match known signatures, making it a critical component of an advanced threat detection strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using signature-based intrusion detection systems (IDS) to match known attack patterns.
Why it's wrong here
Signature-based detection fails against zero-day exploits and custom malware used by APTs.
- ✓
Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.
Why this is correct
Behavioral analysis can uncover APT activities such as lateral movement and data exfiltration.
- ✓
Integrating threat intelligence feeds to correlate indicators of compromise (IOCs) with internal logs.
Why this is correct
Threat intelligence helps identify known APT tactics, techniques, and procedures (TTPs).
- ✓
Implementing anomaly-based network traffic analysis to identify deviations from baseline behavior.
Why this is correct
APTs often exhibit subtle anomalies that can be detected through baseline deviations.
- ✗
Deploying honeypots to attract and analyze attacker behavior.
Why it's wrong here
Honeypots can be useful but are not a primary detection technique; they are more for research and deception.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.