CAS-005 — questions

A company's security policy states that any publicly available server must be patched within 12 hours after a patch is released. A recent IIS zero-day vulnerability was discovered that affects all versions of the Windows Server OS: Which of the following hosts should a security analyst patch first once a patch is available?

An organization has noticed an increase in phishing campaigns utilizing typosquatting. A security analyst needs to enrich the data for commonly used domains against the domains used in phishing campaigns. The analyst uses a log forwarder to forward network logs to the SIEM. Which of the following would allow the security analyst to perform this analysis?

After several companies in the financial industry were affected by a similar incident, they shared information about threat intelligence and the malware used for exploitation. Which of the following should the companies do to best indicate whether the attacks are being conducted by the same actor?

Which of the following most likely explains the reason a security engineer replaced ECC with a lattice-based cryptographic technique?

An administrator reviews the following log and determines the root cause of a site-to-site tunnel failure: Which of the following actions should the administrator take to most effectively correct the failure?

A security architect is mitigating a vulnerability that previously led to a web application data breach. An analysis into the root cause of the issue finds the following: • An administrator’s account was hijacked and used on several Autonomous System Numbers within 30 minutes. • All administrators use named accounts that require multifactor authentication. • Single sign-on is used for all company applications. Which of the following should the security architect do to mitigate the issue?

An organization currently has IDS, firewall, and DLP systems in place. The systems administrator needs to integrate the tools in the environment to reduce response time. Which of the following should the administrator use?

A company migrating to a remote work model requires that company-owned devices connect to a VPN before logging in to the device itself. The VPN gateway requires that a specific key extension is deployed to the machine certificates in the internal PKI. Which of the following best explains this requirement?

A company that uses several cloud applications wants to property identify: • All the devices potentially affected by a given vulnerability • All the internal servers utilizing the same physical switch • The number of endpoints using a particular operating system Which of the following is the best way to meet the requirements?

Which of the following best describes the challenges associated with widespread adoption of homomorphic encryption techniques?

Company A acquired Company B. Both companies serve a user base in different geographic regions but now collectively serve a globally distributed user base. A security architect needs to design resilient monitoring systems with the following requirements: • User data must remain on the systems of each respective company. • Low latency is needed for all users regardless of company location and user location. • Each company must have its own redundancy. Which of the following practices are the most beneficial in meeting the requirements? (Choose two).

During a security assessment using an EDR solution, a security engineer generates the following report about the assets in the system: After five days, the EDR console reports a blocked infection on the host 0WIN23 by a remote access Trojan. Which of the following most likely enabled the attempted infection?

A security engineer must ensure that sensitive corporate information is not exposed if a company laptop is stolen. Which of the following actions best addresses this requirement?

A global company’s Chief Financial Officer (CFO) receives a phone call from someone claiming to be the Chief Executive Officer (CEO). The caller claims to be stranded and in desperate need of money. The CFO is suspicious, but the caller’s voice sounds similar to the CEO’s. Which of the following best describes this type of attack?

A cloud engineer wants to configure mail security protocols to support email authenticity and enable the flow of email security information to a third-party platform for further analysis. Which of the following must be configured to achieve these requirements? (Choose two.)

A company is preparing to move a new version of a web application to production. No issues were reported during security scanning or quality assurance in the CI/CD pipeline. Which of the following actions should the company take next?

A DNS forward lookup zone named comptia.org must: • Ensure the DNS is protected from on-path attacks. • Ensure zone transfers use mutual authentication and are authenticated and negotiated. Which of the following should the security architect configure to meet these requirements? (Choose two).

A security architect is implementing a SOAR solution in an organization’s cloud production environment to support detection capabilities. Which of the following will be the most likely benefit?

A cloud security architect has been tasked with finding a solution for hardening VMs. The solution must meet the following requirements: • Data needs to be stored outside of the VMs. • No unauthorized modifications to the VMs are allowed. • If a change needs to be done, a new VM needs to be deployed. Which of the following is the best solution?

A new, online file hosting service is being offered. The service has the following security requirements: • Threats to customer data integrity and availability should be remediated first. • The environment should be dynamic to match increasing customer demands. • The solution should not interfere with customers’ ability to access their data at anytime. • Security analysts should focus on high-risk items. Which of the following would best satisfy the requirements?