CAS-005 — questions

A security engineer is reviewing the results of an annual penetration test. The report lists one of the results as "critical severity" on several domain-joined workstations: SSL/TLS Weak Protocols Supported TLS 1.0, TLS 1.1 Which of the following should the security engineer implement to remediate this finding in the most centralized manner?

An analyst reviews a SIEM and generates the following report: Only HOST002 is authorized for internet traffic. Which of the following statements is accurate?

A company wants to implement a three-tier approach to separate the web, database, and application servers. A security administrator must harden the environment. Which of the following is the best solution?

A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate. Which of the following is the best way to meet this objective?

A vulnerability scan on a web server identified the following: Which of the following actions would most likely eliminate on-path decryption attacks? (Choose two.)

A company’s help desk is experiencing a large number of calls from the finance department stating access issues to www.bank.com. The security operations center reviewed the following security logs: Which of the following is most likely the cause of the issue?

A financial services organization is using AI to fully automate the process of deciding client loan rates. Which of the following should the organization be most concerned about from a regulatory perspective?

A security analyst is reviewing the following log: Which of the following possible events should the security analyst investigate further?

A security operations engineer needs to prevent inadvertent data disclosure when encrypted SSDs are reused within an enterprise. Which of the following is the most secure way to achieve this goal?

A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems. Given the following output: Which of the following actions would address the root cause of this issue?

A company established a new process for business analysts to receive emails that contain links for purchase requests. The new process requires links to be submitted through new emails. Which of the following is the best way to secure this process without disrupting order fulfillment?

An organization receives OSINT reports about an increase in ransomware targeting fileshares at peer companies. The organization wants to deploy hardening policies to its servers and workstations in order to contain potential ransomware. Which of the following should an engineer do to best achieve this goal?

A malicious actor exploited firmware vulnerabilities and used rootkits in an attack on an organization. After the organization recovered from the incident, an engineer needs to recommend a solution that reduces the likelihood of the same type of attack in the future. Which of the following is the most relevant solution?

Which of the following enables the meaningful manipulation of encrypted data when the processor does not know the encryption key?

Emails that the marketing department is sending to customers are going to the customers’ spam folders. The security team is investigating the issue and discovers that the certificates used by the email server were reissued, but DNS records had not been updated. Which of the following should the security team update in order to fix this issue? (Choose three.)

A security engineer performed a code scan that resulted in many false positives. The security engineer must find a solution that improves the quality of scanning results before application deployment. Which of the following is the best solution?

A global company with a remote workforce implemented a new VPN solution. After deploying the VPN solution to several hundred users, the help desk starts receiving reports of slow access to both internally and externally available applications. A security analyst reviews the following: VPN client routing: 0.0.0.0/0 eth1 Which of the following solutions should the analyst use to fix this issue?

A security analyst is reviewing suspicious log-in activity and sees the following data in the SIEM: Which of the following is the most appropriate action for the analyst to take?

An organization determined its preparedness for a ransomware attack is inadequate. A security administrator is working on ways to improve and monitor the organization's response to ransomware attacks. Which of the following is the best action for the administrator to take?

A security engineer receives an alert from the SIEM platform indicating a possible malicious action on the internal network. The engineer generates a report that outputs the logs associated with the incident: Which of the following actions best enables the engineer to investigate further?