CASP+ Security Operations and Incident Response 2

Question 1

Which forensic principle ensures that evidence is protected from alteration from the moment of collection through legal proceedings?

Accepted Answer

Chain of custody

Answer

Chain of custody documents every person who handles evidence, timestamps all transfers, and verifies integrity, ensuring evidence is admissible and untampered in legal proceedings.

Question 2

A CASP+ analyst suspects lateral movement via SMB. Which log provides the MOST direct evidence?

Accepted Answer

Windows Security Event ID 4624 (logon type 3 — network) across multiple hosts

Answer

Event ID 4624 with logon type 3 (network logon) recorded on multiple systems in a short timeframe from the same source account indicates lateral movement via SMB authentication.

Question 3

Which playbook element is MOST critical for reducing mean time to respond (MTTR) during an incident?

Accepted Answer

Pre-defined decision trees with specific containment actions for each alert type

Answer

Pre-defined decision trees give responders clear, step-by-step actions for each alert, eliminating decision fatigue and enabling faster, consistent containment and remediation.

Question 4

An incident responder acquires a forensic image of a suspect hard drive. Which tool and format combination is the industry standard for maintaining forensic integrity?

Accepted Answer

FTK Imager or dc3dd to an E01 image with SHA-256 hash verification

Answer

E01 (Expert Witness Format) images include embedded hash values that can be verified at any time, and tools like FTK Imager record acquisition metadata for chain-of-custody documentation.

Question 5

Which indicator MOST strongly suggests that a web server has been compromised rather than experiencing legitimate high traffic?

Accepted Answer

Outbound connections from the web server to unknown external IPs on port 443

Answer

Outbound connections from a web server to unknown external hosts suggest C2 communication or data exfiltration — web servers should receive requests, not initiate external sessions.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Security Operations and Incident Response 2