CAS-005 — questions

After a company discovered a zero-day vulnerability in its VPN solution, the company plans to deploy cloud-hosted resources to replace its current on-premises systems. An engineer must find an appropriate solution to facilitate trusted connectivity. Which of the following capabilities is the most relevant?

Recent reports indicate that a software tool is being exploited. Attackers were able to bypass user access controls and load a database. A security analyst needs to find the vulnerability and recommend a mitigation. The analyst generates the following output: Which of the following would the analyst most likely recommend?

The identity and access management team is sending logs to the SIEM for continuous monitoring. The deployed log collector is forwarding logs to the SIEM. However, only false positive alerts are being generated. Which of the following is the most likely reason for the inaccurate alerts?

The security team is receiving escalated support tickets stating that one of the company's publicly available websites is not loading as expected. Given the following observations: Which of the following is most likely the root cause?

A company acquires a location with a large infrastructure of legacy devices. Because of the hardware's age and the legacy software's limitations, the OS cannot be upgraded, and the machines cannot be virtualized. These machines are not publicly facing, but they do have internet access. The following controls are currently in place: • EDR • Anti-malware • Logging and monitoring • Host-based firewall • Proxied internet access A security architect needs to supplement the existing control strategy with one that restricts unauthorized software. Which of the following controls should the architect recommend to best supplement the existing environment?

An organization wants to create a threat model to identify vulnerabilities in its infrastructure. Which of the following should be prioritized first?

A Chief Information Security Officer requests an action plan to remediate vulnerabilities. A security analyst reviews the output from a recent vulnerability scan and notices hundreds of unique vulnerabilities. The output includes the CVSS score, IP address, hostname, and the list of vulnerabilities. The analyst determines more information is needed in order to decide which vulnerabilities should be fixed immediately. Which of the following is the best source for this information?

A security operations analyst is reviewing network traffic baselines for nightly database backups. Given the following information: Which of the following should the security analyst do next?

A company has a requirement in customer contracts that states applications must undergo external audits to identify vulnerabilities. Which of the following is the best action for the company to complete before hiring an external auditor?

During DAST scanning, applications are consistently reporting code defects in open-source libraries that were used to build web applications. Most of the code defects are from using libraries with known vulnerabilities. The code defects are causing product deployment delays. Which of the following is the best way to uncover these issues earlier in the life cycle?

A company's SIEM is designed to associate the company’s asset inventory with user events. Given the following report: Which of the following should a security engineer investigate first as part of a log audit?

A developer receives feedback about code quality and efficiency. The developer needs to identify and resolve the following coding issues before submitting the code changes for peer review: • Indexing beyond arrays • Dereferencing null pointers • Potentially dangerous data type combos • Unreachable code • Non-portable constructs Which of the following would be most appropriate for the developer to use in this situation?

A company wants to improve and automate the compliance of its cloud environments to meet industry standards. Which of the following resources should the company use to best achieve this goal?

A company wants to protect against the most common attacks and rapidly integrate with different programming languages. Which of the following technologies is most likely to meet this need?

An organization is concerned about insider threats from employees who have individual access to encrypted material. Which of the following techniques best addresses this issue?

A manufacturing plant is updating its IT services. During discussions, the senior management team created the following list of considerations: • Staff turnover is high and seasonal. • Extreme conditions often damage endpoints. • Losses from downtime must be minimized. • Regulatory data retention requirements exist. Which of the following best addresses the considerations?

A software vendor provides routine functionality and security updates to its global customer base. The vendor would like to ensure distributed updates are authorized, originate from only the company, and have not been modified by others. Which of the following solutions best supports these objectives?

A security analyst detects a possible RAT infection on a computer in the internal network. After reviewing the details of the alert, the analyst identifies the initial vector of the attack was an email that was forwarded to multiple recipients in the same organizational unit. Which of the following should the analyst do first to minimize this type of threat in the future?

A cloud engineer needs to identify appropriate solutions to: • Provide secure access to internal and external cloud resources. • Eliminate split-tunnel traffic flows. • Enable identity and access management capabilities. Which of the following solutions is the most appropriate?

A security engineer is building a solution to disable weak CBC configurations for remote access connections to Linux systems. Which of the following should the security engineer modify?