Download CAS-005 Exam Dumps Questions to get 100% Success in CompTIA
100% Accurate Answers! CAS-005 Actual Real Exam Questions
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 95
A systems administrator wants to reduce the number of failed patch deployments in an organization. The administrator discovers that system owners modify systems or applications in an ad hoc manner. Which of the following is the best way to reduce the number of failed patch deployments?
- A. Compliance tracking
- B. Situational awareness
- C. Change management
- D. Quality assurance
Answer: C
Explanation:
To reduce the number of failed patch deployments, the systems administrator should implement a robust change management process. Change management ensures that all modifications to systems or applications are planned, tested, and approved before deployment. This systematic approach reduces the risk of unplanned changes that can cause patch failures and ensures that patches are deployed in a controlled and predictable manner.
References:
* CompTIA SecurityX Study Guide: Emphasizes the importance of change management in maintaining system integrity and ensuring successful patch deployments.
* ITIL (Information Technology Infrastructure Library) Framework: Provides best practices for change management in IT services.
* "The Phoenix Project" by Gene Kim, Kevin Behr, and George Spafford: Discusses the critical role of change management in IT operations and its impact on system stability and reliability.
NEW QUESTION # 96
Company A acquired Company B and needs to determine how the acquisition will impact the attack surface of the organization as a whole. Which of the following is the best way to achieve this goal? (Choose two.)
- A. Implementing DLP controls preventing sensitive data from leaving Company B's network
- B. Reviewing the privacy policies currently adopted by Company B
- C. Documenting third-party connections used by Company B
- D. Forcing a password reset requiring more stringent passwords for users on Company B's network
- E. Performing an architectural review of Company B's network
- F. Requiring data sensitivity labeling tor all files shared with Company B
Answer: C,E
Explanation:
To determine how the acquisition of Company B will impact the attack surface, the following steps are crucial:
Documenting third-party connections used by Company B: Understanding all external connections is essential for assessing potential entry points for attackers and ensuring that these connections are secure.
Performing an architectural review of Company B's network: This review will identify vulnerabilities and assess the security posture of the acquired company's network, providing a comprehensive understanding of the new attack surface. These actions will provide a clear picture of the security implications of the acquisition and help in developing a plan to mitigate any identified risks.
NEW QUESTION # 97
A SIEM generated an alert after a third-party database administrator, who had recently been granted temporary access to the repository, accessed business-sensitive content in the database.
The SIEM had generated similar alerts before this incident. Which of the following best explains the cause of the alert?
- A. Database decoy
- B. Database activity monitoring
- C. Database field tokenization
- D. Database integrity enforcement
Answer: B
Explanation:
Database activity monitoring (DAM) tracks user actions within databases and generates alerts for anomalous behavior, such as unauthorized access to sensitive content. Database field tokenization protects sensitive data but does not monitor access. Database decoy involves creating fake data to detect misuse but is unrelated to monitoring. Database integrity enforcement ensures data accuracy but does not generate access alerts.
NEW QUESTION # 98
An organization is developing on Al-enabled digital worker to help employees complete common tasks such as template development, editing, research, and scheduling. As part of the Al workload the organization wants to Implement guardrails within the platform. Which of the following should the company do to secure the Al environment?
- A. Limn the platform's abilities to only non-sensitive functions
- B. Require end-user acknowledgement of organizational policies.
- C. Enhance the training model's effectiveness.
- D. Grant the system the ability to self-govern
Answer: A
Explanation:
Limiting the platform's abilities to only non-sensitive functions helps to mitigate risks associated with AI operations. By ensuring that the AI-enabled digital worker is only allowed to perform tasks that do not involve sensitive or critical data, the organization reduces the potential impact of any security breaches or misuse.
Enhancing the training model's effectiveness (Option B) is important but does not directly address security guardrails. Granting the system the ability to self-govern (Option C) could increase risk as it may act beyond the organization's control. Requiring end-user acknowledgement of organizational policies (Option D) is a good practice but does not implement technical guardrails to secure the AI environment.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations"
* ISO/IEC 27001, "Information Security Management"
NEW QUESTION # 99
A senior security engineer flags me following log file snippet as hawing likely facilitated an attacker's lateral movement in a recent breach:
Which of the following solutions, if implemented, would mitigate the nsk of this issue reoccurnnp?
- A. Disabling DNS zone transfers
- B. Restricting DNS traffic to UDP'W
- C. Permitting only clients from internal networks to query DNS
- D. Implementing DNS masking on internal servers
Answer: A
Explanation:
The log snippet indicates a DNS AXFR (zone transfer) request, which can be exploited by attackers to gather detailed information about an internal network's infrastructure. Disabling DNS zone transfers is the best solution to mitigate this risk. Zone transfers should generally be restricted to authorized secondary DNS servers and not be publicly accessible, as they can reveal sensitive network information that facilitates lateral movement during an attack.
References:
* CompTIA SecurityX Study Guide: Discusses the importance of securing DNS configurations, including restricting zone transfers.
* NIST Special Publication 800-81, "Secure Domain Name System (DNS) Deployment Guide":
Recommends restricting or disabling DNS zone transfers to prevent information leakage.
NEW QUESTION # 100
During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server. Given the following portion of the code:
Which of the following best describes this incident?
- A. Command injection
- B. XSRF attack
- C. Stored XSS
- D. SQL injection
Answer: C
Explanation:
The provided code snippet shows a script that captures the user's cookies and sends them to a remote server. This type of attack is characteristic of Cross-Site Scripting (XSS), specifically stored XSS, where the malicious script is stored on the target server (e.g., in a database) and executed in the context of users who visit the infected web page.
Stored XSS: The provided code snippet matches the pattern of a stored XSS attack, where the script is injected into a web page, and when users visit the page, the script executes and sends the user's cookies to the attacker's server.
NEW QUESTION # 101
A security manager is creating a standard configuration across all endpoints that handle sensitive data. Which of the following techniques should be included in the standard configuration to ensure the endpoints are hardened?
- A. Patch management
- B. Event logging
- C. Resource monitoring
- D. Drive encryption
Answer: D
Explanation:
Drive encryption protects sensitive data at rest by ensuring unauthorized access cannot expose the data if the physical endpoint is compromised.
Patch management is a necessary security control but does not specifically address endpoint hardening for sensitive data.
Event logging aids in monitoring and incident detection but does not directly harden endpoints.
Resource monitoring manages system performance and availability but is unrelated to data security.
NEW QUESTION # 102
The identity and access management team is sending logs to the SIEM for continuous monitoring.
The deployed log collector is forwarding logs to the SIEM. However, only false positive alerts are being generated.
Which of the following is the most likely reason for the inaccurate alerts?
- A. The retention policy is not property configured
- B. The SIEM indexes are 100 large
- C. The compute resources are insufficient to support the SIEM
- D. The data is not being properly parsed
Answer: D
Explanation:
Proper parsing of data is crucial for the SIEM to accurately interpret and analyze the logs being forwarded by the log collector. If the data is not parsed correctly, the SIEM may misinterpret the logs, leading to false positives and inaccurate alerts. Ensuring that the log data is correctly parsed allows the SIEM to correlate and analyze the logs effectively, which is essential for accurate alerting and monitoring.
NEW QUESTION # 103
SIMULATION
An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation:
Given that there is little connection between the two clouds when site A is down and cause an evacuation I would say directory server is damaged causing domain issues. 1 - Directory Server.
SCADA system controls the pumps so 2 - SCADA. Last is route flapping that is VPN concentrator, now dont make the mistake i did put 3 in site B not A as for the added option used the BGP routing, if bgp route is set to go through site A that might cause issues so 3 - VPM Concentrator (Site B) (BGP route option).
NEW QUESTION # 104
A systems administrator wants to introduce a newly released feature for an internal application. The administrate docs not want to test the feature in the production environment. Which of the following locations is the best place to test the new feature?
- A. CI/CO pipeline
- B. Testing environment
- C. Staging environment
- D. Development environment
Answer: C
Explanation:
The best location to test a newly released feature for an internal application, without affecting the production environment, is the staging environment. Here's a detailed explanation:
* Staging Environment: This environment closely mirrors the production environment in terms of hardware, software, configurations, and settings. It serves as a final testing ground before deploying changes to production. Testing in the staging environment ensures that the new feature will behave as expected in the actual production setup.
* Isolation from Production: The staging environment is isolated from production, which means any issues arising from the new feature will not impact the live users or the integrity of the production data.
This aligns with best practices in change management and risk mitigation.
* Realistic Testing: Since the staging environment replicates the production environment, it provides realistic testing conditions. This helps in identifying potential issues that might not be apparent in a development or testing environment, which often have different configurations and workloads.
* References:
* CompTIA Security+ SY0-601 Official Study Guide by Quentin Docter, Jon Buhagiar
* NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 105
SIMULATION
You are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements:
- The application does not need to know the users' credentials.
- An approval interaction between the users and the HTTP service must be orchestrated.
- The application must have limited access to users' data.
INSTRUCTIONS
Use the drop-down menus to select the action items for the appropriate locations. All placeholders must be filled.
Answer:
Explanation:
NEW QUESTION # 106
Users must accept the terms presented in a captive petal when connecting to a guest network. Recently, users have reported that they are unable to access the Internet after joining the network A network engineer observes the following:
* Users should be redirected to the captive portal.
* The Motive portal runs Tl. S 1 2
* Newer browser versions encounter security errors that cannot be bypassed
* Certain websites cause unexpected re directs
Which of the following mow likely explains this behavior?
- A. Allowed traffic rules are causing the NIPS to drop legitimate traffic
- B. An attacker is redirecting supplicants to an evil twin WLAN.
- C. The TLS ciphers supported by the captive portal ate deprecated
- D. Employment of the HSTS setting is proliferating rapidly.
Answer: C
Explanation:
The most likely explanation for the issues encountered with the captive portal is that the TLS ciphers supported by the captive portal are deprecated. Here's why:
* TLS Cipher Suites: Modern browsers are continuously updated to support the latest security standards and often drop support for deprecated and insecure cipher suites. If the captive portal uses outdated TLS ciphers, newer browsers may refuse to connect, causing security errors.
* HSTS and Browser Security: Browsers with HTTP Strict Transport Security (HSTS) enabled will not allow connections to sites with weak security configurations. Deprecated TLS ciphers would cause these browsers to block the connection.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-52: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations
* OWASP Transport Layer Protection Cheat Sheet
By updating the TLS ciphers to modern, supported ones, the security engineer can ensure compatibility with newer browser versions and resolve the connectivity issues reported by users.
NEW QUESTION # 107
A security engineer needs 10 secure the OT environment based on me following requirements
* Isolate the OT network segment
* Restrict Internet access.
* Apply security updates two workstations
* Provide remote access to third-party vendors
Which of the following design strategies should the engineer implement to best meet these requirements?
- A. Enable outbound internet access on the OT firewall to any destination IP address and use the centralized update server for the workstations
- B. Implement a bastion host in the OT network with security tools in place to monitor access and use a dedicated update server for the workstations.
- C. Deploy a jump box on the third party network to access the OT environment and provide updates using a physical delivery method on the workstations
- D. Create a staging environment on the OT network for the third-party vendor to access and enable automatic updates on the workstations.
Answer: B
Explanation:
To secure the Operational Technology (OT) environment based on the given requirements, the best approach is to implement a bastion host in the OT network. The bastion host serves as a secure entry point for remote access, allowing third-party vendors to connect while being monitored by security tools. Using a dedicated update server for workstations ensures that security updates are applied in a controlled manner without direct internet access.
References:
* CompTIA SecurityX Study Guide: Recommends the use of bastion hosts and dedicated update servers for securing OT environments.
* NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security": Advises on isolating OT networks and using secure remote access methods.
* "Industrial Network Security" by Eric D. Knapp and Joel Thomas Langill: Discusses strategies for securing OT networks, including the use of bastion hosts and update servers.
NEW QUESTION # 108
A security team is responding to malicious activity and needs to determine the scope of impact the malicious activity appears to affect certain version of an application used by the organization.
Which of the following actions best enables the team to determine the scope of Impact?
- A. Performing a port scan
- B. Reviewing the asset inventory
- C. Analyzing user behavior
- D. Inspecting egress network traffic
Answer: B
Explanation:
Reviewing the asset inventory allows the security team to identify all instances of the affected application versions within the organization. By knowing which systems are running the vulnerable versions, the team can assess the full scope of the impact, determine which systems might be compromised, and prioritize them for further investigation and remediation.
NEW QUESTION # 109
A security configure is building a solution to disable weak CBC configuration for remote access connections lo Linux systems. Which of the following should the security engineer modify?
- A. The /etc/hosts file, updating the IP parameter
- B. The /etc/nsswith.conf file, updating the name server
- C. The /etc/etc/sshd, configure file updating the ciphers
- D. The /etc/openssl.conf file, updating the virtual site parameter
Answer: C
Explanation:
The sshd_config file is the main configuration file for the OpenSSH server. To disable weak CBC (Cipher Block Chaining) ciphers for SSH connections, the security engineer should modify the sshd_config file to update the list of allowed ciphers. This file typically contains settings for the SSH daemon, including which encryption algorithms are allowed. By editing the
/etc/ssh/sshd_config file and updating the Ciphers directive, weak ciphers can be removed, and only strong ciphers can be allowed. This change ensures that the SSH server does not use insecure encryption methods.
NEW QUESTION # 110
Within a SCADA a business needs access to the historian server in order together metric about the functionality of the environment. Which of the following actions should be taken to address this requirement?
- A. Publishing the C$ share from SCADA to the enterprise
- B. Adding the business workstations to the SCADA domain
- C. Deploying a screened subnet between 11 and SCADA
- D. Isolating the historian server for connections only from The SCADA environment
Answer: D
Explanation:
The best action to address the requirement of accessing the historian server within a SCADA system is to isolate the historian server for connections only from the SCADA environment.
Security and Isolation: Isolating the historian server ensures that only authorized devices within the SCADA environment can connect to it. This minimizes the attack surface and protects sensitive data from unauthorized access.
Access Control: By restricting access to the historian server to only SCADA devices, the organization can better control and monitor interactions, ensuring that only legitimate queries and data retrievals occur.
Best Practices for Critical Infrastructure: Following the principle of least privilege, isolating critical components like the historian server is a standard practice in securing SCADA systems, reducing the risk of cyberattacks.
NEW QUESTION # 111
An organization wants to create a threat model to identity vulnerabilities in its infrastructure.
Which of the following, should be prioritized first?
- A. External facing Infrastructure with a low risk score and no known exploited vulnerabilities
- B. External-facing infrastructure with a high risk score that can only be exploited with local access to the resource
- C. Internal infrastructure with high-seventy and Known exploited vulnerabilities
- D. External-facing Infrastructure with known exploited vulnerabilities
Answer: D
Explanation:
When creating a threat model to identify vulnerabilities in an organization's infrastructure, prioritizing external-facing infrastructure with known exploited vulnerabilities is critical.
Exposure to Attack: External-facing infrastructure is directly exposed to the internet, making it a primary target for attackers. Any vulnerabilities in this layer pose an immediate risk to the organization's security.
Known Exploited Vulnerabilities: Vulnerabilities that are already known and exploited in the wild are of higher concern because they are actively being used by attackers. Addressing these vulnerabilities reduces the risk of exploitation significantly.
Risk Mitigation: By prioritizing external-facing infrastructure with known exploited vulnerabilities, the organization can mitigate the most immediate and impactful threats, thereby improving overall security posture.
NEW QUESTION # 112
During a recent assessment, a security analyst observed the following:
Which of the following should the analyst use to address the vulnerabilities in the future?
- A. OS update
- B. Least privilege
- C. Defense in depth
- D. System image hardening
Answer: C
NEW QUESTION # 113
......
Best Value Available! Realistic Verified Free CAS-005 Exam Questions: https://www.ipassleader.com/CompTIA/CAS-005-practice-exam-dumps.html
Pass Your Exam Easily! CAS-005 Real Question Answers Updated: https://drive.google.com/open?id=1m2JCu4yt2PDiKucsU-UOQxB5Ngp7nmMN