A system administrator has a baseline for a database server that shows normal memory usage is 60%. One day, the SIEM alerts that memory usage is at 95% for an extended period. The administrator investigates and finds that a new reporting tool is consuming excessive memory. What is the most appropriate action?

Investigate the reporting tool's configuration and optimize it to reduce memory usage.

Increase the alert threshold for memory usage to 100% to avoid false positives.

Update the baseline to reflect the new memory usage.

Kill the reporting tool process immediately to free up memory.

A SIEM is ingesting logs from a custom application. The logs contain a timestamp, user ID, and action. The SIEM is not parsing the user ID field correctly, showing it as 'unknown' in alerts. What is the most appropriate action?

Create a custom parsing rule to extract the user ID from the log format.

Ignore the user ID field and rely on other fields for correlation.

Manually review each log to identify the user ID.

Ask the application vendor to change the log format to match SIEM expectations.

A security analyst is reviewing SIEM data and notices that the number of failed logins has been steadily increasing over the past month, but the number of successful logins has remained constant. What is the most likely explanation?

A new application is generating failed logins due to a misconfiguration.

Users are forgetting their passwords more often.

The SIEM is generating false positives due to a misconfigured rule.

A brute-force attack is in progress against user accounts.

CompTIASecurityX (CASP+)

Domain 4Objective 1

Monitoring and Data Analysis CAS-005 Practice Questions (Page 1)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

22%of the exam

Questions 1–5

1application · medium
A system administrator has a baseline for a database server that shows normal memory usage is 60%. One day, the SIEM alerts that memory usage is at 95% for an extended period. The administrator investigates and finds that a new reporting tool is consuming excessive memory. What is the most appropriate action?
Select an answer first
2foundation · easy
A SIEM alert fires whenever a user logs in after business hours, but many of these alerts are for legitimate remote workers. What is this type of alert issue called?
Select an answer first
3application · medium
A SIEM is ingesting logs from a custom application. The logs contain a timestamp, user ID, and action. The SIEM is not parsing the user ID field correctly, showing it as 'unknown' in alerts. What is the most appropriate action?
Select an answer first
4expert · hard
A security analyst is reviewing SIEM data and notices that the number of failed logins has been steadily increasing over the past month, but the number of successful logins has remained constant. What is the most likely explanation?
Select an answer first
5foundation · easy
A SIEM analyst notices a spike in failed logins from one IP address, followed by a successful login and then a large data exfiltration event. Which SIEM capability is used to link these events into a single incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.

Monitoring and Data Analysis CAS-005 Practice Questions (Page 1)

Questions 1–5

A SIEM alert fires whenever a user logs in after business hours, but many of these alerts are for legitimate remote workers. What is this type of alert issue called?

A SIEM is ingesting logs from a custom application. The logs contain a timestamp, user ID, and action. The SIEM is not parsing the user ID field correctly, showing it as 'unknown' in alerts. What is the most appropriate action?

A security analyst is reviewing SIEM data and notices that the number of failed logins has been steadily increasing over the past month, but the number of successful logins has remained constant. What is the most likely explanation?

A SIEM analyst notices a spike in failed logins from one IP address, followed by a successful login and then a large data exfiltration event. Which SIEM capability is used to link these events into a single incident?

Keep studying — Security operations