What does code stylometry analyze in malware to help attribute it to a specific author or group?

The malware's compilation timestamp

The malware's file size and hash values

The unique coding style, habits, and patterns of the author

The malware's network communication protocols

What is the primary purpose of root cause analysis in incident response?

To determine how the incident occurred and prevent recurrence

To quickly restore systems to normal operation

To assign blame to a specific employee

To collect evidence for legal proceedings

After a security incident, the incident response team has identified the malware and the affected systems. The team now needs to determine how the attacker initially gained access to prevent future occurrences. Which activity should the team perform?

Immediately reimage all affected systems and restore from backups.

Run the malware in a sandbox to observe its behavior.

Update all antivirus signatures and rescan the network.

Analyze logs and forensic evidence to trace the attack path back to the initial entry point.

What is the primary purpose of extracting indicators of compromise (IoCs) from a malware sample?

To identify the malware's author

To determine the malware's programming language

To calculate the malware's file size

To enable detection of the malware across other systems

An organization is concerned about a new malware strain that appears to be polymorphic. The security team wants to analyze the malware's behavior and extract IoCs, but the malware may change its code each time it runs. Which approach is most effective?

Extract the malware's file hash and use it for detection.

Use code stylometry to identify the author.

Analyze the malware's static code to identify the polymorphic engine.

Run the malware in a sandbox multiple times and compare the behavioral indicators across runs.

CompTIASecurityX (CASP+)

Domain 4Objective 4

Incident Response CAS-005 Practice Questions (Page 1)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

22%of the exam

Questions 1–5

1foundation · easy
What does code stylometry analyze in malware to help attribute it to a specific author or group?
Select an answer first
2foundation · easy
What is the primary purpose of root cause analysis in incident response?
Select an answer first
3application · medium
After a security incident, the incident response team has identified the malware and the affected systems. The team now needs to determine how the attacker initially gained access to prevent future occurrences. Which activity should the team perform?
Select an answer first
4foundation · easy
What is the primary purpose of extracting indicators of compromise (IoCs) from a malware sample?
Select an answer first
5application · medium
An organization is concerned about a new malware strain that appears to be polymorphic. The security team wants to analyze the malware's behavior and extract IoCs, but the malware may change its code each time it runs. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.