What is the primary goal of data recovery in the context of a malware incident?

To prevent the malware from spreading

To identify the malware's author

To restore data that was corrupted or deleted by the malware

A malware analyst is tasked with understanding how a piece of ransomware encrypts files and communicates with its command-and-control server. The analyst has the binary and a safe environment. Which approach would provide the most detailed understanding of the malware's internal logic?

Use a debugger to step through the code and set breakpoints on encryption functions.

Search the binary for strings that reference encryption libraries.

Run the malware in a sandbox and observe which files it modifies.

Compare the malware's hash to known ransomware hashes.

What is the primary goal of reverse engineering malware?

To understand the malware's functionality and design

To delete the malware from infected systems

To create a new variant of the malware

To identify the malware's author

Which of the following is a common technique used for data recovery after a malware attack?

Disabling the network connection

Reinstalling the operating system

Which of the following is a key characteristic of a malware sandbox environment?

It is a physical device that is disconnected from any network.

It is a software tool that only detects malware signatures.

It is designed to be isolated from the production network and systems.

It uses the same network and system resources as the production environment.

CompTIASecurityX (CASP+)

Domain 4Objective 4

Incident Response CAS-005 Practice Questions (Page 5)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

22%of the exam

Questions 21–25

21foundation · easy
What is the primary goal of data recovery in the context of a malware incident?
Select an answer first
22application · medium
A malware analyst is tasked with understanding how a piece of ransomware encrypts files and communicates with its command-and-control server. The analyst has the binary and a safe environment. Which approach would provide the most detailed understanding of the malware's internal logic?
Select an answer first
23foundation · easy
What is the primary goal of reverse engineering malware?
Select an answer first
24foundation · easy
Which of the following is a common technique used for data recovery after a malware attack?
Select an answer first
25foundation · easy
Which of the following is a key characteristic of a malware sandbox environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.