CompTIA CAS-005 Practice Test 56

Question 550

Analysts need to match characteristic byte strings in a collection of suspicious binaries. What should the enterprise security architect or analyst do NEXT?

Author and test a Sigma rule mapped to normalized events.
Create scoped YARA detection and validate benign-file collisions.
Use appropriate flow-behavior analytics and relationship context.
Deploy a validated Snort rule with monitored alert quality.

Explanation

Correct Answer

YARA is suited to content pattern matching. The controlling fact is: Analysts need to match characteristic byte strings in a collection of suspicious binaries.

Incorrect Answers

Author and test a Sigma rule mapped to normalized events would not create scoped YARA detection and validate benign-file collisions.

Flow analysis serves a different purpose from file signatures. The scenario does not present the alternate condition: a team needs to study recurring beaconing in collected flow records rather than inspect file contents. The proper immediate action is to create scoped YARA detection and validate benign-file collisions.

The reported condition calls for this action: Create scoped YARA detection and validate benign-file collisions.

Question 551

An actor executes a signed Windows management tool during initial compromise. Which action is MOST defensible given these facts?

Represent infrastructure overlap without claiming identical authorship.
Separate hypotheses about motive from verified technical observations.
Map the observed technique and test realistic defensive analytics.
Build a confidence-labeled timeline and note unresolved paths.

Explanation

Correct Answer

Legitimate utilities can be dual-use. The controlling fact is: An actor executes a signed Windows management tool during initial compromise.

Incorrect Answers

Represent infrastructure overlap without claiming identical authorship would not map the observed technique and test realistic defensive analytics.

The current facts call for this action: map the observed technique and test realistic defensive analytics.

Building a confidence-labeled timeline and note unresolved paths would not map the observed technique and test realistic defensive analytics.

Question 552

A red-team report claims persistence was missed, but the relevant hosts never sent audit data. Which action is the BEST response to the security requirement?

Control environment differences before attributing performance changes.
Verify scope, retain test evidence and tune exercise coordination.
Review the alert-to-case workflow and document the tested gap.
Distinguish detection-rule quality from telemetry coverage.

Explanation

Correct Answer

Absent data does not demonstrate an ineffective rule. The controlling fact is: A red-team report claims persistence was missed, but the relevant hosts never sent audit data.

Incorrect Answers

The reported condition calls for this action: Distinguish detection-rule quality from telemetry coverage.

The current facts call for this action: distinguish detection-rule quality from telemetry coverage.

Detection without operational response is incomplete coverage. The scenario does not present the alternate condition: a blue-team exercise triggers the planned detection but fails to create a response case. The proper immediate action is to distinguish detection-rule quality from telemetry coverage.

Question 553

A honeynet captures attack traffic from a source that appears on a sanctioned red-team schedule. Which action is MOST defensible given these facts?

Validate exercise scope before classifying the actor as hostile.
Preserve isolated interaction telemetry and investigate the actor sequence.
Keep the collection passive and within authorized engagement boundaries.
Remove secrets and isolate the decoy from production identities.

Explanation

Correct Answer

Authorized testing can match malicious behaviors. The controlling fact is: A honeynet captures attack traffic from a source that appears on a sanctioned red-team schedule.

Incorrect Answers

The current facts call for this action: validate exercise scope before classifying the actor as hostile.

Counterintelligence must respect legal and safety limits. The scenario does not present the alternate condition: an automated decoy response attempts to pivot into external attacker infrastructure. The proper immediate action is to validate exercise scope before classifying the actor as hostile.

The reported condition calls for this action: Validate exercise scope before classifying the actor as hostile.

Question 554

A forum post names a new malware family but lacks technical indicators or samples. Which action is the BEST response to the security requirement?

Assess whether published metadata exposes new reachable attack paths.
Treat the name as a hypothesis and seek corroborating artifacts.
Privately validate and revoke affected credentials through the authorized owner.
Enumerate owned public assets and decommission unsafe exposure.

Explanation

Correct Answer

Threat naming is not evidence of behavior. The controlling fact is: A forum post names a new malware family but lacks technical indicators or samples.

Incorrect Answers

Assessing whether published metadata exposes new reachable attack paths would not address the need for treat the name as a hypothesis and seek corroborating artifacts.

Public leaks require controlled credential response. The scenario does not present the alternate condition: a threat intelligence analyst finds leaked tokens online but cannot verify whether they remain active. The proper immediate action is to treat the name as a hypothesis and seek corroborating artifacts.

Enumerate owned public assets and decommission unsafe exposure would not address the need for treat the name as a hypothesis and seek corroborating artifacts.

Question 555

An indicator is shared after its associated infrastructure was legally sinkholed. Which control or decision MOST directly resolves the stated gap?

Use TAXII for delivery and STIX for the represented objects.
Apply classification, authorization and handling restrictions before sharing.
Update indicator validity and context for recipients.
Share appropriately scoped STIX objects preserving provenance.

Explanation

Correct Answer

Outdated indicators can cause harmful false positives. The controlling fact is: An indicator is shared after its associated infrastructure was legally sinkholed.

Incorrect Answers

Using TAXII for delivery and STIX for the represented objects would not update indicator validity and context for recipients.

The current facts call for this action: update indicator validity and context for recipients.

Share appropriately scoped STIX objects preserving provenance would not update indicator validity and context for recipients.

Question 556

A campaign report includes geopolitical assertions unsupported by any victim or activity evidence. What is the appropriate security response for this scenario?

Map the observed technique and test realistic defensive analytics.
Build a confidence-labeled timeline and note unresolved paths.
Represent infrastructure overlap without claiming identical authorship.
Separate hypotheses about motive from verified technical observations.

Explanation

Correct Answer

Attribution requires a higher evidentiary threshold. The controlling fact is: A campaign report includes geopolitical assertions unsupported by any victim or activity evidence.

Incorrect Answers

The reported condition calls for this action: Separate hypotheses about motive from verified technical observations.

The current facts call for this action: separate hypotheses about motive from verified technical observations.

Shared hosting is not definitive attribution. The scenario does not present the alternate condition: two malware variants share command-and-control infrastructure but different code ancestry. The proper immediate action is to separate hypotheses about motive from verified technical observations.

Question 557

A network sensor needs packet signatures for a known protocol misuse. What should the enterprise security architect or analyst do NEXT?

Deploy a validated Snort rule with monitored alert quality.
Create scoped YARA detection and validate benign-file collisions.
Use appropriate flow-behavior analytics and relationship context.
Author and test a Sigma rule mapped to normalized events.

Explanation

Correct Answer

Network signatures operate on packet or protocol evidence. The controlling fact is: A network sensor needs packet signatures for a known protocol misuse.

Incorrect Answers

The current facts call for this action: deploy a validated Snort rule with monitored alert quality.

Flow analysis serves a different purpose from file signatures. The scenario does not present the alternate condition: a team needs to study recurring beaconing in collected flow records rather than inspect file contents. The proper immediate action is to deploy a validated Snort rule with monitored alert quality.

The reported condition calls for this action: Deploy a validated Snort rule with monitored alert quality.

Question 558

One network anomaly appears without corroborating host activity. Which action is MOST defensible given these facts?

Hunt for anomalous task creation and execution sequences across endpoints.
Pivot to identity, process and destination events before confirmation.
Separate technique matching from actor attribution and confidence.
Measure telemetry coverage before interpreting the negative result.

Explanation

Correct Answer

Independent sources improve attribution. The controlling fact is: One network anomaly appears without corroborating host activity.

Incorrect Answers

Hunt for anomalous task creation and execution sequences across endpoints would not address the need for pivot to identity, process and destination events.

Shared techniques do not uniquely identify an adversary. The scenario does not present the alternate condition: analysts claim a single ATT&CK mapping proves a named threat group is present. The proper immediate action is to pivot to identity, process and destination events before confirmation.

Measuring telemetry coverage would not address the need for pivot to identity, process and destination events.

Question 559

An approved adversary simulation generates an urgent SOC page despite clear exercise labeling. Which action is the BEST response to the security requirement?

Distinguish detection-rule quality from telemetry coverage.
Review the alert-to-case workflow and document the tested gap.
Verify scope, retain test evidence and tune exercise coordination.
Control environment differences before attributing performance changes.

Explanation

Correct Answer

A known test should still produce useful detection measurements. The controlling fact is: An approved adversary simulation generates an urgent SOC page despite clear exercise labeling.

Incorrect Answers

Distinguishing detection-rule quality from telemetry coverage would not verify scope, retain test evidence and tune exercise coordination.

The current facts call for this action: verify scope, retain test evidence and tune exercise coordination.

Control environment differences would not verify scope, retain test evidence and tune exercise coordination.

Question 560

An ISAC advisory identifies a sector-wide technique but no known IPs. Which control or decision MOST directly resolves the stated gap?

Validate with internal evidence before public breach conclusions.
Reassess age, current ownership and internal relevance.
Normalize provenance, last-seen and confidence before automation.
Prioritize technique-aligned hunting rather than invent exact indicators.

Explanation

Correct Answer

Collective intelligence often informs behavior rather than hashes. The controlling fact is: An ISAC advisory identifies a sector-wide technique but no known IPs.

Incorrect Answers

The reported condition calls for this action: Prioritize technique-aligned hunting rather than invent exact indicators.

The current facts call for this action: prioritize technique-aligned hunting rather than invent exact indicators.

Unclean intelligence can distort response prioritization. The scenario does not present the alternate condition: a vendor's feed includes hundreds of duplicate indicators with inconsistent severity. The proper immediate action is to prioritize technique-aligned hunting rather than invent exact indicators.

CompTIA SecurityX (CAS-005) Practice Tests

CompTIA CAS-005 Practice Test 54 - 10 Questions (Last Reviewed 15-Sep-2026)
CompTIA CAS-005 Practice Test 55 - 10 Questions (Last Reviewed 14-Sep-2026)
CompTIA CAS-005 Practice Test 56 - 10 Questions (Last Reviewed 13-Sep-2026)
CompTIA CAS-005 Practice Test 57 - 10 Questions (Last Reviewed 08-Nov-2026)
CompTIA CAS-005 Practice Test 58 - 10 Questions (Last Reviewed 07-Nov-2026)

Pass Your CompTIA CAS-005 Exam Easy!

Question 550

Explanation

Correct Answer

Incorrect Answers

Question 551

Explanation

Correct Answer

Incorrect Answers

Question 552

Explanation

Correct Answer

Incorrect Answers

Question 553

Explanation

Correct Answer

Incorrect Answers

Question 554

Explanation

Correct Answer

Incorrect Answers

Question 555

Explanation

Correct Answer

Incorrect Answers

Question 556

Explanation

Correct Answer

Incorrect Answers

Question 557

Explanation

Correct Answer

Incorrect Answers

Question 558

Explanation

Correct Answer

Incorrect Answers

Question 559

Explanation

Correct Answer

Incorrect Answers

Question 560

Explanation

Correct Answer

Incorrect Answers

CompTIA SecurityX (CAS-005) Practice Tests