CompTIA CAS-005 Practice Test 55

Question 540

A report describes attacker persistence via scheduled tasks but supplies no IOCs. Which action is the BEST response to the security requirement?

Separate technique matching from actor attribution and confidence.
Pivot to identity, process and destination events before confirmation.
Measure telemetry coverage before interpreting the negative result.
Hunt for anomalous task creation and execution sequences across endpoints.

Explanation

Correct Answer

Behavior-based detection works without a specific hash. The controlling fact is: A report describes attacker persistence via scheduled tasks but supplies no IOCs.

Incorrect Answers

The reported condition calls for this action: Hunt for anomalous task creation and execution sequences across endpoints.

The current facts call for this action: hunt for anomalous task creation and execution sequences across endpoints.

A missing observation is not evidence the behavior never occurred. The scenario does not present the alternate condition: a hunt finds no domain-matching logs from half the fleet. The proper immediate action is to hunt for anomalous task creation and execution sequences across endpoints.

Question 541

A partner wants structured IOC objects with first-seen, last-seen and confidence fields. Which control or decision MOST directly resolves the stated gap?

Share appropriately scoped STIX objects preserving provenance.
Apply classification, authorization and handling restrictions before sharing.
Use TAXII for delivery and STIX for the represented objects.
Update indicator validity and context for recipients.

Explanation

Correct Answer

Structured intelligence should retain context, not just raw values. The controlling fact is: A partner wants structured IOC objects with first-seen, last-seen and confidence fields.

Incorrect Answers

The current facts call for this action: share appropriately scoped STIX objects preserving provenance.

Transport and data representation have different roles. The scenario does not present the alternate condition: a security platform polls an exchange endpoint but confuses TAXII transport with the STIX object format. The proper immediate action is to share appropriately scoped STIX objects preserving provenance.

The reported condition calls for this action: Share appropriately scoped STIX objects preserving provenance.

Question 542

An indicator has high confidence in a vendor report but was last observed years ago. What is the appropriate security response for this scenario?

Validate with internal evidence before public breach conclusions.
Reassess age, current ownership and internal relevance.
Prioritize technique-aligned hunting rather than invent exact indicators.
Normalize provenance, last-seen and confidence before automation.

Explanation

Correct Answer

Threat context decays with time. The controlling fact is: An indicator has high confidence in a vendor report but was last observed years ago.

Incorrect Answers

Validating with internal evidence would not address the need for reassess age, current ownership and internal relevance.

Collective intelligence often informs behavior rather than hashes. The scenario does not present the alternate condition: an ISAC advisory identifies a sector-wide technique but no known IPs. The proper immediate action is to reassess age, current ownership and internal relevance.

Normalizing provenance, last-seen and confidence would not address the need for reassess age, current ownership and internal relevance.

Question 543

A decoy SSH service captures credential stuffing followed by an unexpected binary download. What should the enterprise security architect or analyst do NEXT?

Remove secrets and isolate the decoy from production identities.
Validate exercise scope before classifying the actor as hostile.
Preserve isolated interaction telemetry and investigate the actor sequence.
Keep the collection passive and within authorized engagement boundaries.

Explanation

Correct Answer

Decoys can reveal malicious behavior without exposing production assets. The controlling fact is: A decoy SSH service captures credential stuffing followed by an unexpected binary download.

Incorrect Answers

Removing secrets and isolate the decoy from production identities would not preserve isolated interaction telemetry and investigate the actor sequence.

The current facts call for this action: preserve isolated interaction telemetry and investigate the actor sequence.

Keeping the collection passive and within authorized engagement boundaries would not preserve isolated interaction telemetry and investigate the actor sequence.

Question 544

Two malware variants share command-and-control infrastructure but different code ancestry. Which action is MOST defensible given these facts?

Separate hypotheses about motive from verified technical observations.
Map the observed technique and test realistic defensive analytics.
Build a confidence-labeled timeline and note unresolved paths.
Represent infrastructure overlap without claiming identical authorship.

Explanation

Correct Answer

Shared hosting is not definitive attribution. The controlling fact is: Two malware variants share command-and-control infrastructure but different code ancestry.

Incorrect Answers

The reported condition calls for this action: Represent infrastructure overlap without claiming identical authorship.

The current facts call for this action: represent infrastructure overlap without claiming identical authorship.

Transparent uncertainty improves intelligence quality. The scenario does not present the alternate condition: threat hunters see several related incidents but differ on the initial access vector. The proper immediate action is to represent infrastructure overlap without claiming identical authorship.

Question 545

A hunt finds no domain-matching logs from half the fleet. What should the enterprise security architect or analyst do NEXT?

Measure telemetry coverage before interpreting the negative result.
Pivot to identity, process and destination events before confirmation.
Hunt for anomalous task creation and execution sequences across endpoints.
Separate technique matching from actor attribution and confidence.

Explanation

Correct Answer

A missing observation is not evidence the behavior never occurred. The controlling fact is: A hunt finds no domain-matching logs from half the fleet.

Incorrect Answers

The current facts call for this action: measure telemetry coverage before interpreting the negative result.

Behavior-based detection works without a specific hash. The scenario does not present the alternate condition: a report describes attacker persistence via scheduled tasks but supplies no IOCs. The proper immediate action is to measure telemetry coverage before interpreting the negative result.

The reported condition calls for this action: Measure telemetry coverage before interpreting the negative result.

Question 546

A threat intelligence analyst finds leaked tokens online but cannot verify whether they remain active. Which action is MOST defensible given these facts?

Treat the name as a hypothesis and seek corroborating artifacts.
Privately validate and revoke affected credentials through the authorized owner.
Assess whether published metadata exposes new reachable attack paths.
Enumerate owned public assets and decommission unsafe exposure.

Explanation

Correct Answer

Public leaks require controlled credential response. The controlling fact is: A threat intelligence analyst finds leaked tokens online but cannot verify whether they remain active.

Incorrect Answers

Treat the name as a hypothesis and seek corroborating artifacts would not address the need for credential management.

Open-source discoveries can change the attack surface. The scenario does not present the alternate condition: a public code repository reveals internal subdomain names and service topology. The proper immediate action is to privately validate and revoke affected credentials through the authorized owner.

Enumerate owned public assets and decommission unsafe exposure would not address the need for credential management.

Question 547

A security platform polls an exchange endpoint but confuses TAXII transport with the STIX object format. Which action is the BEST response to the security requirement?

Apply classification, authorization and handling restrictions before sharing.
Share appropriately scoped STIX objects preserving provenance.
Use TAXII for delivery and STIX for the represented objects.
Update indicator validity and context for recipients.

Explanation

Correct Answer

Transport and data representation have different roles. The controlling fact is: A security platform polls an exchange endpoint but confuses TAXII transport with the STIX object format.

Incorrect Answers

Applying classification, authorization and handling restrictions would not meet the need for tAXII for delivery and STIX for the represented objects.

The current facts call for this action: use TAXII for delivery and STIX for the represented objects.

Updating indicator validity and context for recipients would not meet the need for tAXII for delivery and STIX for the represented objects.

Question 548

A dark-web post claims customer data was stolen but provides no unique corroborating detail. Which control or decision MOST directly resolves the stated gap?

Prioritize technique-aligned hunting rather than invent exact indicators.
Reassess age, current ownership and internal relevance.
Normalize provenance, last-seen and confidence before automation.
Validate with internal evidence before public breach conclusions.

Explanation

Correct Answer

Unverified claims should not be treated as established compromise. The controlling fact is: A dark-web post claims customer data was stolen but provides no unique corroborating detail.

Incorrect Answers

The reported condition calls for this action: Validate with internal evidence before public breach conclusions.

The current facts call for this action: validate with internal evidence before public breach conclusions.

Unclean intelligence can distort response prioritization. The scenario does not present the alternate condition: a vendor's feed includes hundreds of duplicate indicators with inconsistent severity. The proper immediate action is to validate with internal evidence before public breach conclusions.

Question 549

A honeypot accidentally uses production authentication secrets for realism. What is the appropriate security response for this scenario?

Remove secrets and isolate the decoy from production identities.
Validate exercise scope before classifying the actor as hostile.
Preserve isolated interaction telemetry and investigate the actor sequence.
Keep the collection passive and within authorized engagement boundaries.

Explanation

Correct Answer

Deception must not create real access. The controlling fact is: A honeypot accidentally uses production authentication secrets for realism.

Incorrect Answers

The current facts call for this action: remove secrets and isolate the decoy from production identities.

Decoys can reveal malicious behavior without exposing production assets. The scenario does not present the alternate condition: a decoy SSH service captures credential stuffing followed by an unexpected binary download. The proper immediate action is to remove secrets and isolate the decoy from production identities.

The reported condition calls for this action: Remove secrets and isolate the decoy from production identities.

Question 550

Analysts need to match characteristic byte strings in a collection of suspicious binaries. What should the enterprise security architect or analyst do NEXT?

Author and test a Sigma rule mapped to normalized events.
Create scoped YARA detection and validate benign-file collisions.
Use appropriate flow-behavior analytics and relationship context.
Deploy a validated Snort rule with monitored alert quality.

Explanation

Correct Answer

YARA is suited to content pattern matching. The controlling fact is: Analysts need to match characteristic byte strings in a collection of suspicious binaries.

Incorrect Answers

Author and test a Sigma rule mapped to normalized events would not create scoped YARA detection and validate benign-file collisions.

Flow analysis serves a different purpose from file signatures. The scenario does not present the alternate condition: a team needs to study recurring beaconing in collected flow records rather than inspect file contents. The proper immediate action is to create scoped YARA detection and validate benign-file collisions.

The reported condition calls for this action: Create scoped YARA detection and validate benign-file collisions.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 53 - 10 Questions (Last Reviewed 16-Sep-2026)
CompTIA CAS-005 Practice Test 54 - 10 Questions (Last Reviewed 15-Sep-2026)
CompTIA CAS-005 Practice Test 55 - 10 Questions (Last Reviewed 14-Sep-2026)
CompTIA CAS-005 Practice Test 56 - 10 Questions (Last Reviewed 13-Sep-2026)
CompTIA CAS-005 Practice Test 57 - 10 Questions (Last Reviewed 08-Nov-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 540

Explanation

Correct Answer

Incorrect Answers

Question 541

Explanation

Correct Answer

Incorrect Answers

Question 542

Explanation

Correct Answer

Incorrect Answers

Question 543

Explanation

Correct Answer

Incorrect Answers

Question 544

Explanation

Correct Answer

Incorrect Answers

Question 545

Explanation

Correct Answer

Incorrect Answers

Question 546

Explanation

Correct Answer

Incorrect Answers

Question 547

Explanation

Correct Answer

Incorrect Answers

Question 548

Explanation

Correct Answer

Incorrect Answers

Question 549

Explanation

Correct Answer

Incorrect Answers

Question 550

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests