Free SecurityX Security Operations Practice Questions | CAS-005

This domain represents 22% of CAS-005 and covers threat management, monitoring, incident response, forensics, vulnerability management, operational resilience, and recovery.

Sample Question 1 — Security Operations

A SOC analyst reviews the following correlated SIEM events for a single user account within a two-minute window: 08:14:02 VPN login success, user jmalik, source 203.0.113.44 (country: Brazil) 08:14:20 Badge access granted, user jmalik, building HQ-2 (country: United States) 08:15:33 Mailbox rule created: forward all mail to external address Which of the following best describes what the SIEM correlation has revealed?

  1. A. Impossible travel followed by a suspicious mailbox forwarding rule, indicating account compromise (Correct answer)
  2. B. A user legitimately working remotely while a colleague badges in for them
  3. C. Normal behavior that requires no further investigation
  4. D. A time synchronization problem between the VPN and badge systems

Correct answer: A

Explanation: A is correct because the account authenticated from Brazil and badged into a U.S. building within two minutes, which is physically impossible, and the new external forwarding rule is a common post-compromise action. B is incorrect because badge sharing does not explain a simultaneous VPN login from another country or the external forwarding rule. C is incorrect because impossible travel combined with external forwarding is a strong indicator of compromise. D is incorrect because a clock offset would not create a foreign VPN login or an external mail forwarding rule.

Sample Question 2 — Security Operations

A SIEM engineer finds that firewall logs are being stored but no rules match them, because the firewall was upgraded and now sends events in a new format. Which of the following SIEM functions must be corrected?

  1. A. Event parsing (Correct answer)
  2. B. Log retention
  3. C. Role-based access to the SIEM console
  4. D. Alert prioritization

Correct answer: A

Explanation: A is correct because parsing normalizes raw log data into fields the SIEM can use; when a log format changes, the parser must be updated or the events will not be searchable or matched by rules. B is incorrect because retention controls how long events are stored, not whether they are parsed into fields. C is incorrect because access control governs who can use the SIEM, not how logs are parsed. D is incorrect because prioritization ranks alerts that already exist and does not extract fields from raw logs.

Sample Question 3 — Security Operations

A SIEM shows that a single brute-force attack generated 5,000 nearly identical failed-login events, which nearly hid a later successful login from the same source. The SOC wants each distinct attack represented as one enriched alert. Which of the following SIEM capabilities should be configured?

  1. A. Event aggregation and deduplication (Correct answer)
  2. B. Disabling authentication logging
  3. C. Longer event retention
  4. D. Increasing the alert severity for all failed logins

Correct answer: A

Explanation: A is correct because aggregation groups many similar events into a single representative alert with a count, reducing noise while preserving the ability to see related activity such as the successful login. B is incorrect because disabling logging would hide the attack entirely. C is incorrect because retention affects storage duration, not how repetitive events are consolidated. D is incorrect because raising severity on thousands of events increases noise rather than reducing it.

Sample Question 4 — Security Operations

A SIEM administrator notices that a critical database server stopped sending logs three days ago, but no one was alerted. Which of the following should be implemented to catch this in the future?

  1. A. Increasing the SIEM's total storage capacity
  2. B. Reducing the number of correlation rules
  3. C. Monitoring for non-reporting log sources and alerting when expected data stops (Correct answer)
  4. D. Lengthening the log retention period to one year

Correct answer: C

Explanation: C is correct because detecting log source silence ensures that a device that stops sending events, whether from failure or tampering, generates an alert instead of creating a silent blind spot. A is incorrect because storage capacity does not detect a source that has gone silent. B is incorrect because fewer rules would not detect missing log sources. D is incorrect because retention does not alert when a source stops reporting.

Sample Question 5 — Security Operations

A SOC receives thousands of alerts each day, and analysts cannot decide what to work first. Management wants alerts ranked so that the most business-critical issues rise to the top. Which of the following factors is most appropriate for prioritizing alerts?

  1. A. The vendor that manufactured the device generating the alert
  2. B. Asset criticality and data classification of the affected system (Correct answer)
  3. C. The physical size of the log file that generated the alert
  4. D. The alphabetical order of the affected hostnames

Correct answer: B

Explanation: B is correct because prioritization should reflect business impact, so alerts affecting critical assets and sensitive data are triaged ahead of alerts on low-value systems. A is incorrect because the device vendor is not a measure of business impact. C is incorrect because log file size does not indicate the severity of an alert. D is incorrect because hostname order has no relationship to risk or impact.

Sample Question 6 — Security Operations

Over several weeks, a database server's outbound traffic rises from an average of 2 GB per day to 45 GB per day, mostly late at night to a single external host. No single event triggered an alert. Which of the following analytic techniques would best detect this?

  1. A. Increasing the verbosity of the database's query logs
  2. B. Blocking all outbound traffic from the database server
  3. C. Behavioral baselining that flags deviations from normal activity (Correct answer)
  4. D. Signature matching against known malware hashes

Correct answer: C

Explanation: C is correct because establishing a baseline of normal behavior lets the system detect gradual or subtle deviations, such as a sustained rise in outbound data, that signature-based rules miss. A is incorrect because more query detail does not by itself detect abnormal traffic volume. B is incorrect because blocking all traffic would disrupt legitimate operations and is a response, not detection. D is incorrect because signatures detect known files, not anomalous data transfer volumes.

Sample Question 7 — Security Operations

A SOC wants to detect insider data theft by identifying when employees access systems or data far outside their normal patterns, such as an HR analyst suddenly querying source code repositories at 3 a.m. Which of the following is the best tool?

  1. A. A network firewall with default deny rules
  2. B. A vulnerability scanner run weekly
  3. C. User and entity behavior analytics (Correct answer)
  4. D. Full disk encryption on all endpoints

Correct answer: C

Explanation: C is correct because UEBA builds behavioral profiles for users and entities and flags activity that deviates from normal patterns, which is effective for detecting insider misuse. A is incorrect because a firewall filters traffic by rules and does not model user behavior. B is incorrect because vulnerability scanning finds weaknesses, not anomalous user activity. D is incorrect because encryption protects data at rest and does not detect abnormal access.

Sample Question 8 — Security Operations

A SOC lead wants to improve detection by adding external context so that alerts involving known-malicious IP addresses and domains are automatically escalated. Which of the following data sources best supports this?

  1. A. Threat intelligence feeds correlated with internal events (Correct answer)
  2. B. The company's marketing analytics dashboard
  3. C. Physical building maintenance logs
  4. D. Employee performance review records

Correct answer: A

Explanation: A is correct because threat intelligence feeds supply indicators such as malicious IPs and domains, and correlating them with internal telemetry enriches and prioritizes relevant alerts. B is incorrect because marketing analytics does not provide threat indicators. C is incorrect because maintenance logs do not identify malicious network indicators. D is incorrect because performance data is unrelated to identifying malicious infrastructure.

Sample Question 9 — Security Operations

A newly deployed correlation rule intended to detect password spraying is generating alerts on normal Monday-morning login spikes, when many users sign in after the weekend. Which of the following is the best way to improve the rule?

  1. A. Delete the correlation rule and rely on manual review
  2. B. Raise the severity of every authentication alert
  3. C. Tune the rule using a baseline and thresholds that account for normal login patterns (Correct answer)
  4. D. Disable authentication logging on Mondays

Correct answer: C

Explanation: C is correct because tuning with knowledge of normal behavior, such as expected Monday login volumes, reduces false positives while still detecting the distributed failed logins of password spraying. A is incorrect because removing the rule eliminates automated detection of password spraying. B is incorrect because raising severity increases noise without reducing false positives. D is incorrect because disabling logging would hide real attacks.

Sample Question 10 — Security Operations

An analyst investigating a suspected compromise wants to combine endpoint process events, firewall connection logs, and cloud audit logs to reconstruct what happened. The logs currently live in three separate tools. Which of the following would best support the investigation?

  1. A. Increasing the log verbosity on the firewall only
  2. B. Reviewing each tool separately and manually comparing timestamps
  3. C. Aggregating the data sources into the SIEM for correlation (Correct answer)
  4. D. Deleting two of the three log sources to simplify the investigation

Correct answer: C

Explanation: C is correct because bringing endpoint, network, and cloud logs into one platform lets the analyst correlate events across sources and reconstruct the full sequence of an attack. A is incorrect because more firewall detail alone does not correlate endpoint and cloud activity. B is incorrect because manual cross-tool comparison is slow, error-prone, and does not scale. D is incorrect because removing data sources reduces the evidence available.

SecurityX practice-test hub · Mixed quick-start test