A security team is investigating a series of malware attacks and suspects they are from the same threat actor. The team has two samples: one is written in C++ and the other in Python. The team wants to attribute both to the same actor. Which evidence would be most convincing?

Both samples connect to the same C2 server.

Both samples use the same unique encryption algorithm and similar error messages.

Both samples have the same file icon.

Both samples are packed with the same packer.

During an investigation, an analyst finds a malicious document that was used as a phishing lure. The analyst wants to gather information about the document's origin, such as the author's username and the software used to create it. Which technique should the analyst use?

Run the document in a sandbox to observe its behavior.

Perform code stylometry on the embedded macro.

Examine the document's metadata, including author and software version.

Reverse engineer the document's binary structure.

Which of the following is a common technique used in reverse engineering malware?

Static analysis of the binary code

Running the malware on a production server

Deleting the malware's registry keys

Why is metadata analysis useful in malware investigation?

It can reveal the malware's origin and creation details

It can automatically remove the malware from the system

It can determine the malware's encryption algorithm

It can identify the malware's command-and-control server

A malware analyst is reverse engineering a sample that uses anti-debugging techniques, such as checking for the presence of a debugger and timing checks. The analyst needs to understand the malware's full functionality. Which approach is most effective?

Use a memory dump to analyze the malware after it runs.

Use a debugger with anti-anti-debugging plugins to bypass the checks.

Run the malware in a sandbox and observe its behavior.

CompTIASecurityX (CASP+)

Domain 4Objective 4

Incident Response CAS-005 Practice Questions (Page 2)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

22%of the exam

Questions 6–10

6expert · hard
A security team is investigating a series of malware attacks and suspects they are from the same threat actor. The team has two samples: one is written in C++ and the other in Python. The team wants to attribute both to the same actor. Which evidence would be most convincing?
Select an answer first
7application · medium
During an investigation, an analyst finds a malicious document that was used as a phishing lure. The analyst wants to gather information about the document's origin, such as the author's username and the software used to create it. Which technique should the analyst use?
Select an answer first
8foundation · easy
Which of the following is a common technique used in reverse engineering malware?
Select an answer first
9foundation · easy
Why is metadata analysis useful in malware investigation?
Select an answer first
10expert · hard
A malware analyst is reverse engineering a sample that uses anti-debugging techniques, such as checking for the presence of a debugger and timing checks. The analyst needs to understand the malware's full functionality. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.