What is the primary purpose of the Trusted Automated Exchange of Intelligence Information (TAXII) protocol?

To define how threat intelligence is transported and exchanged between systems

To provide a language for describing malware behavior

To encrypt all network traffic within an organization

To replace the need for firewalls in threat detection

What is the common purpose of rule-based languages like Sigma, YARA, and Snort?

To define detection logic for identifying specific threats or malicious activity

To encrypt data at rest in databases

To automate the patching of operating systems

To manage user access permissions in Active Directory

In which security tool are Sigma rules most commonly applied?

Web application firewalls (WAF)

A security analyst needs to share a detailed report about a new attack campaign with a partner organization. The report includes the attacker's tactics, techniques, and procedures (TTPs), the malware used, and the indicators of compromise (IoCs). The analyst wants to ensure the report is structured in a way that can be easily parsed and understood by the partner's security tools. Which format should the analyst use?

A CSV file with only IP addresses

What is an Indicator of Compromise (IoC)?

A security control that prevents unauthorized access

A type of malware that self-replicates across networks

A vulnerability in a software application that can be exploited

A piece of forensic data that suggests a system may have been compromised

CompTIASecurityX (CASP+)

Domain 4Objective 3

Threat Hunting CAS-005 Practice Questions (Page 2)

Part of the Security operations domain, which accounts for 22% of the CAS-005 exam. CompTIA does not publish an official question count, but from its 165-minute exam (~65–110 total, ~14–24 in this domain), expect 4–6 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

15concepts

22%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of the Trusted Automated Exchange of Intelligence Information (TAXII) protocol?
Select an answer first
7foundation · easy
What is the common purpose of rule-based languages like Sigma, YARA, and Snort?
Select an answer first
8foundation · easy
In which security tool are Sigma rules most commonly applied?
Select an answer first
9application · medium
A security analyst needs to share a detailed report about a new attack campaign with a partner organization. The report includes the attacker's tactics, techniques, and procedures (TTPs), the malware used, and the indicators of compromise (IoCs). The analyst wants to ensure the report is structured in a way that can be easily parsed and understood by the partner's security tools. Which format should the analyst use?
Select an answer first
10foundation · easy
What is an Indicator of Compromise (IoC)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CAS-005

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CAS-005” is a trademark of its owner, used for identification only.