CAS-005 Exam Dumps : CompTIA SecurityX Certification Exam

The SIEM already contains multiple events that, if correlated, would have indicated an active attack sequence on VM001—such as denied connections, IPS alerts, malware detection, and then an allowed connection. CAS-005 Security Operations objectives emphasize log correlation as a way to enhance detection by linking related events across different time stamps and data sources into a single, higher-confidence alert.

Option A (adding EDR logs) could add visibility but does not address the need to connect existing events for earlier detection.

Option C (improving parsing) ensures readability but does not create actionable alerts.

Option D (creating a new malware detection rule) is redundant since malware detection already appeared in logs; the issue was the lack of correlation to act on it in time.

By correlating IDS, IPS, firewall, and malware detection logs, the SIEM can raise a higher-priority alert before the attack is completed.

The error message " NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM " indicates that the web browser is rejecting the certificate because it uses a weak signature algorithm. This commonly happens with self-signed certificates, which often use outdated or insecure algorithms.

Why Discontinue Self-Signed Certificates?

Security Compliance: Modern browsers enforce strict security standards and may reject certificates that do not comply with these standards.

Trusted Certificates: Using certificates from a trusted Certificate Authority (CA) ensures compliance with security standards and is less likely to be flagged as insecure.

Weak Signature Algorithm: Self-signed certificates might use weak algorithms like MD5 or SHA-1, which are considered insecure.

Other options do not address the specific cause of the certificate error:

A. Rewriting legacy web functions: Does not address the certificate issue.

B. Disabling deprecated ciphers: Useful for improving security but not related to the certificate error.

C. Blocking non-essential ports: This is unrelated to the issue of certificate validation.

The best solution is to implement an interactive honeypot (A). Honeypots are decoy systems designed to attract and observe adversary behavior in real time. When security tools cannot categorize suspicious inbound traffic, a honeypot provides an isolated environment where the suspicious activity can be redirected and monitored without risking production systems. By deploying an interactive honeypot, analysts can study attacker tactics, techniques, and procedures (TTPs), extract Indicators of Compromise (IoCs), and improve defensive controls.

Option B (mapping to known IoCs) fails because the activity cannot be categorized, implying it is novel or not yet identified in threat intelligence feeds. Option C (monitoring the dark web) provides intelligence about potential threats but does not address real-time inbound suspicious activity. Option D (UEBA) focuses on analyzing user and entity behaviors but is less effective for categorizing inbound external traffic.

By using honeypots, organizations gain visibility into new, unknown, or advanced attack techniques, which helps improve detection capabilities, enrich threat intelligence, and strengthen incident response.