CASP+ Security Operations and Incident Response

Question 1

During a security incident, a responder discovers malware on a compromised host. What is the FIRST action that should be taken according to incident response best practices?

Accepted Answer

Isolate the system from the network while preserving volatile memory

Answer

Network isolation stops active exfiltration or C2 communication while preserving volatile memory (RAM) contains critical forensic evidence that is lost on reboot or shutdown.

Question 2

Which log source is MOST valuable for detecting data exfiltration via DNS tunneling?

Accepted Answer

DNS query and response logs with anomaly baselines

Answer

DNS tunneling encodes data in DNS query strings; analysis of DNS logs for high-frequency queries, unusual record types, or large TXT responses reveals this technique.

Question 3

A SOC analyst receives an alert for a possible SQL injection attack. Which evidence BEST confirms successful exploitation?

Accepted Answer

Database error messages followed by unexpected data in HTTP responses

Answer

Database error messages in responses indicate the application is processing injected SQL, and unexpected data in the response confirms the attacker retrieved data from the database.

Question 4

Which incident response phase involves identifying lessons learned and updating security controls to prevent recurrence?

Accepted Answer

Post-Incident Activity

Answer

The Post-Incident Activity phase (NIST SP 800-61) includes a lessons-learned meeting, updating incident response plans, and implementing improvements to prevent similar incidents.

Question 5

A threat hunter is looking for living-off-the-land (LotL) attacks. Which data source provides the MOST visibility into these techniques?

Accepted Answer

Process creation and command-line logging (Sysmon Event ID 1)

Answer

LotL attacks use legitimate system tools (PowerShell, WMI, certutil); Sysmon process creation logs capture command-line arguments that reveal malicious use of trusted binaries.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Security Operations and Incident Response