Guide (New 2024) Actual CompTIA CAS-005 Exam Questions [Q15-Q35]

NO.15 An organization wants to implement a platform to better identify which specific assets are affected by a given vulnerability. Which of the following components provides the best foundation to achieve this goal?

SASE

CMDB

SBoM

SLM

NO.16 A systems administrator wants to reduce the number of failed patch deployments in an organization. The administrator discovers that system owners modify systems or applications in an ad hoc manner. Which of the following is the best way to reduce the number of failed patch deployments?

Compliance tracking

Situational awareness

Change management

Quality assurance

NO.17 A developer needs to improve the cryptographic strength of a password-storage component in a web application without completely replacing the crypto-module. Which of the following is the most appropriate technique?

Key splitting

Key escrow

Key rotation

Key encryption

Key stretching

NO.18 Within a SCADA a business needs access to the historian server in order together metric about the functionality of the environment. Which of the following actions should be taken to address this requirement?

Isolating the historian server for connections only from The SCADA environment

Publishing the C$ share from SCADA to the enterprise

Deploying a screened subnet between 11 and SCADA

Adding the business workstations to the SCADA domain

NO.19 A software engineer is creating a CI/CD pipeline to support the development of a web application The DevSecOps team is required to identify syntax errors Which of the following is the most relevant to the DevSecOps team’s task’

Static application security testing

Software composition analysis

Runtime application self-protection

Web application vulnerability scanning

NO.20 An organization wants to manage specialized endpoints and needs a solution that provides the ability to
* Centrally manage configurations
* Push policies.
* Remotely wipe devices
* Maintain asset inventory
Which of the following should the organization do to best meet these requirements?

Use a configuration management database

Implement a mobile device management solution.

Configure contextual policy management

Deploy a software asset manager

NO.21 Users are willing passwords on paper because of the number of passwords needed in an environment. Which of the following solutions is the best way to manage this situation and decrease risks?

Increasing password complexity to require 31 least 16 characters

implementing an SSO solution and integrating with applications

Requiring users to use an open-source password manager

Implementing an MFA solution to avoid reliance only on passwords

NO.22 A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed

Which of the following is the best action for the security analyst to take?

Block messages from hr-saas.com because it is not a recognized domain.

Reroute all messages with unusual security warning notices to the IT administrator

Quarantine all messages with sales-mail.com in the email header

Block vendor com for repeated attempts to send suspicious messages

In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here’s the analysis of the options provided:
A; Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking.
B: Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages.
C: Quarantine all messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails.
D: Block vendor com for repeated attempts to send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.
References:
* CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity.
* NIST Special Publication 800-45 Version 2, “Guidelines on Electronic Mail Security”: Provides guidelines on email security, including the management of suspicious email domains.
* “Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft” by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent offenders.
By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.

NO.23 A company receives reports about misconfigurations and vulnerabilities in a third-party hardware device that is part of its released products. Which of the following solutions is the best way for the company to identify possible issues at an earlier stage?

Performing vulnerability tests on each device delivered by the providers

Performing regular red-team exercises on the vendor production line

Implementing a monitoring process for the integration between the application and the vendor appliance

Implementing a proper supply chain risk management program

NO.24 A software development team requires valid data for internal tests. Company regulations, however do not allow the use of this data in cleartext. Which of the following solutions best meet these requirements?

Configuring data hashing

Deploying tokenization

Replacing data with null record

Implementing data obfuscation

NO.25 A security analyst is reviewing suspicious log-in activity and sees the following data in the SICM:

Which of the following is the most appropriate action for the analyst to take?

Update the log configuration settings on the directory server that Is not being captured properly.

Have the admin account owner change their password to avoid credential stuffing.

Block employees from logging in to applications that are not part of their business area.

implement automation to disable accounts that nave been associated with high-risk activity.

NO.26 After an incident response exercise, a security administrator reviews the following table:

Which of the following should the administrator do to beat support rapid incident response in the future?

Automate alerting to IT support for phone system outages.

Enable dashboards for service status monitoring

Send emails for failed log-In attempts on the public website

Configure automated Isolation of human resources systems

NO.27 A company wants to install a three-tier approach to separate the web. database, and application servers A security administrator must harden the environment which of the following is the best solution?

Deploying a VPN to prevent remote locations from accessing server VLANs

Configuring a SASb solution to restrict users to server communication

Implementing microsegmentation on the server VLANs

installing a firewall and making it the network core

NO.28 A security review revealed that not all of the client proxy traffic is being captured. Which of the following architectural changes best enables the capture of traffic for analysis?

Adding an additional proxy server to each segmented VLAN

Setting up a reverse proxy for client logging at the gateway

Configuring a span port on the perimeter firewall to ingest logs

Enabling client device logging and system event auditing

NO.29 A company isolated its OT systems from other areas of the corporate network These systems are required to report usage information over the internet to the vendor Which oi the following b*st reduces the risk of compromise or sabotage’ (Select two).

Implementing allow lists

Monitoring network behavior

Encrypting data at rest

Performing boot Integrity checks

Executing daily health checks

Implementing a site-to-site IPSec VPN

NO.30 An organization is required to
* Respond to internal and external inquiries in a timely manner
* Provide transparency.
* Comply with regulatory requirements
The organization has not experienced any reportable breaches but wants to be prepared if a breach occurs in the future. Which of the following is the best way for the organization to prepare?

Outsourcing the handling of necessary regulatory filing to an external consultant

Integrating automated response mechanisms into the data subject access request process

Developing communication templates that have been vetted by internal and external counsel

Conducting lessons-learned activities and integrating observations into the crisis management plan

NO.31 Developers have been creating and managing cryptographic material on their personal laptops fix use in production environment. A security engineer needs to initiate a more secure process. Which of the following is the best strategy for the engineer to use?

Disabling the BIOS and moving to UEFI

Managing secrets on the vTPM hardware

Employing shielding lo prevent LMI

Managing key material on a HSM

NO.32 A security analyst reviews the following report:

Which of the following assessments is the analyst performing?

System

Supply chain

Quantitative

Organizational

NO.33 A company hosts a platform-as-a-service solution with a web-based front end, through which customer interact with data sets. A security administrator needs to deploy controls to prevent application-focused attacks. Which of the following most directly supports the administrator’s objective’

improving security dashboard visualization on SIEM

Rotating API access and authorization keys every two months

Implementing application toad balancing and cross-region availability

Creating WAF policies for relevant programming languages

NO.34 A security configure is building a solution to disable weak CBC configuration for remote access connections lo Linux systems. Which of the following should the security engineer modify?

The /etc/openssl.conf file, updating the virtual site parameter

The /etc/nsswith.conf file, updating the name server

The /etc/hosts file, updating the IP parameter

The /etc/etc/sshd, configure file updating the ciphers

NO.35 An organization is planning for disaster recovery and continuity of operations, and has noted the following relevant findings:
1. A natural disaster may disrupt operations at Site A, which would then cause an evacuation. Users are unable to log into the domain from-their workstations after relocating to Site B.
2. A natural disaster may disrupt operations at Site A, which would then cause the pump room at Site B to become inoperable.
3. A natural disaster may disrupt operations at Site A, which would then cause unreliable internet connectivity at Site B due to route flapping.
INSTRUCTIONS
Match each relevant finding to the affected host by clicking on the host name and selecting the appropriate number.
For findings 1 and 2, select the items that should be replicated to Site B. For finding 3, select the item requiring configuration changes, then select the appropriate corrective action from the drop-down menu.

Free Cram & Latest Exams Dumps

Guide (New 2024) Actual CompTIA CAS-005 Exam Questions [Q15-Q35]

leave a comment Cancel reply

Related Certifications

Recent Posts

Archives

Categories