Latest CompTIA CAS-005 Free Certification Exam Material with 232 Q&As [Q58-Q76]

4/5 - (1 vote)

Latest CompTIA CAS-005 Free Certification Exam Material with 232 Q&As

UPDATED CAS-005 Exam Questions Certification Test Engine to PDF

QUESTION 58
A central bank implements strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin. Which of the following best describes the cyberthreat to the bank?

Ability to obtain components during wartime

Fragility and other availability attacks

Physical Implants and tampering

Non-conformance to accepted manufacturing standards

QUESTION 59
SIMULATION
During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.
INSTRUCTIONS
Review each of the events and select the appropriate analysis and remediation options for each IoC.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

QUESTION 60
A security operations analyst is reviewing network traffic baselines for nightly database backups.
Given the following information:

Which of the following should the security analyst do next?

Consult with a network engineer to determine the impact of bandwidth usage.

Quarantine PRDDB01 and then alert the database engineers.

Refer to the incident response playbook for the proper response.

Review all the network logs for further data exfiltration.

QUESTION 61
A company has a requirement in customer contracts that states applications must undergo external audits to identify vulnerabilities. Which of the following is the best action for the company to complete before hiring an external auditor?

Gather evidence for the audit.

Conduct an internal audit assessment.

Identify lessons learned from the audit.

Select samples for audit testing.

QUESTION 62
A security analyst received a report that an internal web page is down after a company-wide update to the web browser Given the following error message:

Which of the following is the best way to fix this issue?

Rewriting any legacy web functions

Disabling all deprecated ciphers

Blocking all non-essential pons

Discontinuing the use of self-signed certificates

QUESTION 63
Emails that the marketing department is sending to customers are pomp to the customers’ spam folders. The security team is investigating the issue and discovers that the certificates used by the email server were reissued, but DNS records had not been updated. Which of the following should the security team update in order to fix this issue? (Select three.)

DMARC

SPF

DKIM

DNSSEC

SASC

SAN

SOA

QUESTION 64
After an incident occurred, a team reported during the lessons-learned review that the team.
* Lost important Information for further analysis.
* Did not utilize the chain of communication
* Did not follow the right steps for a proper response
Which of the following solutions is the best way to address these findinds?

Requesting budget for better forensic tools to Improve technical capabilities for Incident response operations

Building playbooks for different scenarios and performing regular table-top exercises

Requiring professional incident response certifications tor each new team member

Publishing the incident response policy and enforcing it as part of the security awareness program

QUESTION 65
Developers have been creating and managing cryptographic material on their personal laptops fix use in production environment. A security engineer needs to initiate a more secure process.
Which of the following is the best strategy for the engineer to use?

Disabling the BIOS and moving to UEFI

Managing secrets on the vTPM hardware

Employing shielding lo prevent LMI

Managing key material on a HSM

QUESTION 66
A global manufacturing company has an internal application mat is critical to making products.
This application cannot be updated and must Be available in the production area. A security architect is implementing security for the application. Which of the following best describes the action the architect should take-?

Disallow wireless access to the application.

Deploy Intrusion detection capabilities using a network tap

Create an acceptable use policy for the use of the application

Create a separate network for users who need access to the application

QUESTION 67
A company wants to prevent a partner company from denying agreement to a transaction. Which of the following is the best solution for the company?

Federation

Key escrow

Salting hashes

Digital signatures

QUESTION 68
A company wants to invest in research capabilities with the goal to operationalize the research output. Which of the following is the best option for a security architect to recommend?

Dark web monitoring

Threat intelligence platform

Honeypots

Continuous adversary emulation

QUESTION 69
An organization wants to create a threat model to identity vulnerabilities in its infrastructure.
Which of the following, should be prioritized first?

External-facing Infrastructure with known exploited vulnerabilities

Internal infrastructure with high-seventy and Known exploited vulnerabilities

External facing Infrastructure with a low risk score and no known exploited vulnerabilities

External-facing infrastructure with a high risk score that can only be exploited with local access to the resource

QUESTION 70
A financial services organization is using Al lo fully automate the process of deciding client loan rates Which of the following should the organization be most concerned about from a privacy perspective?

Model explainability

Credential Theft

Possible prompt Injections

Exposure to social engineering

QUESTION 71
A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate. Which of the following is the best way to meet this objective?

Configuring an API Integration to aggregate the different data sets

Combining back-end application storage into a single, relational database

Purchasing and deploying commercial off the shelf aggregation software

Migrating application usage logs to on-premises storage

QUESTION 72
Users must accept the terms presented in a captive petal when connecting to a guest network.
Recently, users have reported that they are unable to access the Internet after joining the network.
A network engineer observes the following:
– Users should be redirected to the captive portal.
– The Motive portal runs Tl. S 1 2
– Newer browser versions encounter security errors that cannot be
bypassed
– Certain websites cause unexpected re directs
Which of the following mow likely explains this behavior?

The TLS ciphers supported by the captive portal ate deprecated

Employment of the HSTS setting is proliferating rapidly.

Allowed traffic rules are causing the NIPS to drop legitimate traffic

An attacker is redirecting supplicants to an evil twin WLAN.

QUESTION 73
Developers have been creating and managing cryptographic material on their personal laptops fix use in production environment. A security engineer needs to initiate a more secure process. Which of the following is the best strategy for the engineer to use?

Disabling the BIOS and moving to UEFI

Managing secrets on the vTPM hardware

Employing shielding lo prevent LMI

Managing key material on a HSM

QUESTION 74
An organization receives OSINT reports about an increase in ransomware targeting fileshares at peer companies. The organization wants to deploy hardening policies to its servers and workstations in order to contain potential ransomware. Which of the following should an engineer do to best achieve this goal?

Allow only interactive log-in for users on workstations and restrict port 445 traffic to fileshares.

Enable biometric authentication mechanisms on user workstations and block port 53 traffic.

Instruct users to use a password manager when generating new credentials and secure port 443 traffic.

Give users permission to rotate administrator passwords and deny port 80 traffic.

QUESTION 75
A security analyst is reviewing the following log:

Which of the following possible events should the security analyst investigate further?

A macro that was prevented from running

A text file containing passwords that were leaked

A malicious file that was run in this environment

A PDF that exposed sensitive information improperly

QUESTION 76
A systems engineer is configuring a system baseline for servers that will provide email services. As part of the architecture design, the engineer needs to improve performance of the systems by using an access vector cache, facilitating mandatory access control and protecting against:
* Unauthorized reading and modification of data and programs
* Bypassing application security mechanisms
* Privilege escalation
* interference with other processes
Which of the following is the most appropriate for the engineer to deploy?

SELinux

Privileged access management

Self-encrypting disks

NIPS