CAS-005 — questions

Page 8 of 20 · 393 total questions.

CAS-005 Question 145

Single page →

Topic 1 · Question 145

A security engineer must integrate device attestation into user authentication and authorization workflows for mobile devices. Which of the following best meets the requirements?

AEnforcing a security boundary for all devices outside the perimeter network
BEnabling multifactor authentication using biometrics on access attempts
CImplementing single sign-on to centralize access control enforcement
DConfiguring device profiling for patch level and jailbreak status (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Configuring device profiling for patch level and jailbreak status This option keeps traffic private / properly secured as required.

CAS-005 Question 146

Single page →

Topic 1 · Question 146

An organization is developing an AI-enabled digital worker to help employees complete common tasks, such as template development, editing, research, and scheduling. As part of the AI workload, the organization wants to implement guardrails within the platform. Which of the following should the company do to secure the AI environment?

ALimit the platform's abilities to only non-sensitive functions. (correct answer)
BEnhance the training model's effectiveness.
CGrant the system the ability to self-govern.
DRequire end-user acknowledgement of organizational policies.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Limit the platform's abilities to only non-sensitive functions. This option keeps traffic private / properly secured as required.

CAS-005 Question 147

Single page →

Topic 1 · Question 147

A security analyst discovered requests associated with IP addresses known for both legitimate and bot-related traffic. Which of the following should the analyst use to determine whether the requests are malicious?

AUser-agent string (correct answer)
BByte length of the request
CWeb application headers
DHTML encoding field

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: User-agent string This option keeps traffic private / properly secured as required.

CAS-005 Question 148

Single page →

Topic 1 · Question 148

A security analyst received a report that an internal web page is down after a company-wide update to the web browser. Given the following error message: Your connection is not private. Attackers might be trying to steal your information for www. internalwebsite.company.com. NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM Which of the following is the best way to fix this issue?

ARewriting any legacy web functions
BDisabling all deprecated ciphers
CBlocking all non-essential ports
DDiscontinuing the use of self-signed certificates (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Discontinuing the use of self-signed certificates

Explanation

A certificate binds a public key to an identity through a trusted certificate authority. This option keeps traffic private / properly secured as required.

CAS-005 Question 149

Single page →

Topic 1 · Question 149

A company receives reports about misconfigurations and vulnerabilities in a third-party hardware device that is part of its released products. Which of the following solutions is the best way for the company to identify possible issues at an earlier stage?

APerforming vulnerability tests on each device delivered by the providers
BPerforming regular red-team exercises on the vendor production line
CImplementing a monitoring process for the integration between the application and the vendor appliance
DImplementing a proper supply chain risk management program (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Implementing a proper supply chain risk management program

CAS-005 Question 150

Single page →

Topic 1 · Question 150

While performing threat-hunting functions, an analyst is using the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target. Which of the following must the threat hunter document to use the model effectively?

AKnowledge
BCapabilities (correct answer)
CPhase
DMethodologies

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Capabilities

CAS-005 Question 151

Single page →

Topic 1 · Question 151

A security engineer wants to enhance the security posture of end-user systems in a zero trust environment. Given the following requirements: • Reduce the ability for potentially compromised endpoints to contact C2 infrastructure. • Track the requests that the malware makes to the IPs. • Avoid the download of additional payloads. Which of the following should the engineer deploy to meet these requirements?

ADNS sinkholing (correct answer)
BBrowser isolation
CZone transfer protection
DHIDS

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: DNS sinkholing

Explanation

DNS resolves host names to records such as IP addresses and service locations. This option keeps traffic private / properly secured as required.

CAS-005 Question 152

Single page →

Topic 1 · Question 152

A nation-state actor is exposed for attacking large corporations by establishing persistence in smaller companies that are likely to be acquired by these large corporations. The actor then provisions user accounts in the companies for use post-acquisition. Before an upcoming acquisition, a security officer conducts threat modeling with this attack vector. Which of the following practices is the best way to investigate this threat?

ARestricting internet traffic originating from countries in which the nation-state actor is known to operate
BComparing all existing credentials to personnel and services (correct answer)
CAuditing vendors to mitigate supply chain risk during the acquisition
DPlacing a hold on all information about corporate interest in acquisitions

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Comparing all existing credentials to personnel and services This option keeps traffic private / properly secured as required.

CAS-005 Question 153

Single page →

Topic 1 · Question 153

After an incident response exercise, a security administrator reviews the following table: Which of the following should the administrator do to best support rapid incident response in the future?

AAutomate alerting to IT support for phone system outages. (correct answer)
BEnable dashboards for service status monitoring.
CSend emails for failed log-in attempts on the public website.
DConfigure automated isolation of human resources systems.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Automate alerting to IT support for phone system outages. This option keeps traffic private / properly secured as required.

CAS-005 Question 154

Single page →

Topic 1 · Question 154

An organization is required to: • Respond to internal and external inquiries in a timely manner. • Provide transparency. • Comply with regulatory requirements. The organization has not experienced any reportable breaches but wants to be prepared if a breach occurs in the future. Which of the following is the best way for the organization to prepare?

AOutsourcing the handling of necessary regulatory filings to an external consultant
BIntegrating automated response mechanisms into the data subject access request process
CDeveloping communication templates that have been vetted by internal and external counsel (correct answer)
DConducting lessons-learned activities and integrating observations into the crisis management plan

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Developing communication templates that have been vetted by internal and external counsel

CAS-005 Question 155

Single page →

Topic 1 · Question 155

An incident response team is analyzing malware and observes the following: • Does not execute in a sandbox • No network IoCs • No publicly known hash match • No process injection method detected Which of the following should the team do next to proceed with further analysis?

AUse an online virus analysis tool to analyze the sample.
BCheck for an anti-virtualization code in the sample. (correct answer)
CUtilize a new deployed machine to run the sample.
DSearch other internal sources for a new sample.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Check for an anti-virtualization code in the sample.

CAS-005 Question 156

Single page →

Topic 1 · Question 156

Which of the following best explains the business requirement a healthcare provider fulfills by encrypting patient data at rest?

ASecuring data transfer between hospitals
BProviding for non-repudiation of data
CReducing liability from identity theft (correct answer)
DProtecting privacy while supporting portability

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Reducing liability from identity theft This option keeps traffic private / properly secured as required.

CAS-005 Question 157

Single page →

Topic 1 · Question 157

A security engineer is implementing security measures on new hardware in preparation for its launch. During the development phase, a risk related to protections at the UEFI level was found. Which of the following should the engineer recommend to reduce this risk?

AConfiguring paravirtualization protection
BEnabling Secure Boot (correct answer)
CInstalling cryptography at the operational system level
DImplementing hardware root of trust

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Enabling Secure Boot This option keeps traffic private / properly secured as required.

CAS-005 Question 158

Single page →

Topic 1 · Question 158

A hotel chain wants to use point-of-sale systems to allow customers to check in and out of their rooms without employee assistance. These systems should limit access to a specific set of programs approved to run, with all other programs blocked. Which of the following should the company configure to best support this goal?

AApplication control using a fresh image, with the applications fully configured as a baseline to build and block other applications from execution (correct answer)
BA host-based intrusion detection system to monitor and block all suspicious activities if they occur on the systems
CAnti-malware on these systems and only approved application file locations can be bypassed
DEvent logs to be collected from the systems for all security events and some custom application logs

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Application control using a fresh image, with the applications fully configured as a baseline to build and block other applications from execution

CAS-005 Question 159

Single page →

Topic 1 · Question 159

A user reports application access issues to the help desk. The help desk reviews the logs for the user: Which of the following is most likely the reason for the issue?

AThe user inadvertently tripped the geoblock rule in NGFW.
BA threat actor has compromised the user's account and attempted to log in.
CThe user is not allowed to access the human resources system outside of business hours.
DThe user did not attempt to connect from an approved subnet. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: The user did not attempt to connect from an approved subnet.

Explanation

Subnetting divides an IP network into smaller routing and broadcast domains for address efficiency and segmentation.

CAS-005 Question 160

Single page →

Topic 1 · Question 160

A global organization wants to manage all endpoint and user telemetry. The organization also needs to differentiate this data based on which office it is correlated to. Which of the following strategies best aligns with this goal?

ASensor placement
BData labeling (correct answer)
CContinuous monitoring
DCentralized logging

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Data labeling

CAS-005 Question 161

Single page →

Topic 1 · Question 161

A security architect must make sure that the least number of services as possible is exposed in order to limit an adversary's ability to access the systems. Which of the following should the architect do first?

AEnforce Secure Boot.
BPerform attack surface reduction. (correct answer)
CDisable third-party integrations.
DLimit access to the systems.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Perform attack surface reduction. This option keeps traffic private / properly secured as required.

CAS-005 Question 162

Single page →

Topic 1 · Question 162

A security officer performs due diligence activities before implementing a third-party solution into the enterprise environment. The security officer needs evidence from the third party that a data subject access request handling process is in place. Which of the following is the security officer most likely seeking to maintain compliance?

AInformation security standards
BE-discovery requirements
CPrivacy regulations (correct answer)
DCertification requirements
EReporting frameworks

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Privacy regulations This option keeps traffic private / properly secured as required.

CAS-005 Question 163

Single page →

Topic 1 · Question 163

An administrator needs to craft a single certificate-signing request for a web-server certificate. The server should be able to use the following identities to mutually authenticate other resources over TLS: • www.int.comptia.org • webserver01 .int.comptia.org • 10.5.100.10 Which of the following certificate fields must be set properly to support this objective?

ASubject alternative name (correct answer)
BOrganizational unit
CExtended key usage
DCertificate extension

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Subject alternative name

Explanation

Network address translation maps addresses between networks and commonly lets private hosts share public connectivity.

CAS-005 Question 164

Single page →

Topic 1 · Question 164

A security analyst reviews the following event timeline from an EDR solution: Which of the following has most likely occurred and needs to be fixed?

AThe DLP has failed to block malicious exfiltration, and data tagging is not being utilized properly.
BA NIDS bypass was utilized by a threat actor, and updates must be installed by the administrator.
CA logic flaw has introduced a TOCTOU vulnerability and must be addressed by the vendor. (correct answer)
DA potential insider threat is being investigated and will be addressed by the senior management team.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: A logic flaw has introduced a TOCTOU vulnerability and must be addressed by the vendor. This option keeps traffic private / properly secured as required.

Showing questions 141–160 of 393 · Page 8 of 20