CASP+ Security Operations and Incident Response 2 — Questions and Answers
Question 1: Which forensic principle ensures that evidence is protected from alteration from the moment of collection through legal proceedings?
- Order of volatility
- Chain of custody (Correct answer)
- Non-repudiation
- Data minimization
Correct answer: Chain of custody
Chain of custody documents every person who handles evidence, timestamps all transfers, and verifies integrity, ensuring evidence is admissible and untampered in legal proceedings.
Question 2: A CASP+ analyst suspects lateral movement via SMB. Which log provides the MOST direct evidence?
- DNS server query logs
- Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts (Correct answer)
- Web proxy access logs
- DHCP server logs
Correct answer: Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts
Event ID 4624 with logon type 3 (network logon) recorded on multiple systems in a short timeframe from the same source account indicates lateral movement via SMB authentication.
Question 3: Which playbook element is MOST critical for reducing mean time to respond (MTTR) during an incident?
- A general description of threat actor motivations
- Pre-defined decision trees with specific containment actions for each alert type (Correct answer)
- A list of all company assets
- Historical incident statistics from the previous year
Correct answer: Pre-defined decision trees with specific containment actions for each alert type
Pre-defined decision trees give responders clear, step-by-step actions for each alert, eliminating decision fatigue and enabling faster, consistent containment and remediation.
Question 4: An incident responder acquires a forensic image of a suspect hard drive. Which tool and format combination is the industry standard for maintaining forensic integrity?
- dd to a raw image without hashing
- FTK Imager or dc3dd to an E01 image with SHA-256 hash verification (Correct answer)
- rsync copy of the file system
- xcopy with the /s flag
Correct answer: FTK Imager or dc3dd to an E01 image with SHA-256 hash verification
E01 (Expert Witness Format) images include embedded hash values that can be verified at any time, and tools like FTK Imager record acquisition metadata for chain-of-custody documentation.
Question 5: Which indicator MOST strongly suggests that a web server has been compromised rather than experiencing legitimate high traffic?
- Increased HTTP GET requests for the homepage
- Outbound connections from the web server to unknown external IPs on port 443 (Correct answer)
- A spike in authenticated user sessions during business hours
- Increased CPU usage during a scheduled batch job
Correct answer: Outbound connections from the web server to unknown external IPs on port 443
Outbound connections from a web server to unknown external hosts suggest C2 communication or data exfiltration — web servers should receive requests, not initiate external sessions.
Question 6: A CASP+ analyst needs to detect credential dumping on Windows endpoints. Which security control provides the MOST direct protection?
- Enabling BitLocker drive encryption
- Configuring Credential Guard to isolate LSASS using virtualization-based security (Correct answer)
- Requiring password complexity policies
- Blocking USB mass storage devices
Correct answer: Configuring Credential Guard to isolate LSASS using virtualization-based security
Credential Guard uses VBS to store NTLM hashes and Kerberos tickets in an isolated environment inaccessible to the OS, preventing tools like Mimikatz from dumping credentials from LSASS.
CASP+ Security Operations and Incident Response 2
Which forensic principle ensures that evidence is protected from alteration from the moment of collection through legal proceedings?