Which of the following is a benefit of using steganalysis techniques in forensic response?

Identifying least significant bit encoding of data in a .wav file

Breaking a symmetric cipher used in secure voice communications

Determining the frequency of unique attacks against DRM-protected media

Maintaining chain of custody for acquired evidence

Identifying least significant bit encoding of data in a .wav file

A security analyst notices a number of SIEM events that show the following activity: Which of the following response actions should the analyst take FIRST?

Configure the forward proxy to block 40.90.23.154.

Disable powershell.exe on all Microsoft Windows endpoints.

Restart Microsoft Windows Defender.

Configure the forward proxy to block 40.90.23.154.

Disable local administrator privileges on the endpoints.

A technician is reviewing the logs and notices a large number of files were transferred to remote sites over the course of three months. This activity then stopped. The files were transferred via TLS-protected HTTP sessions from systems that do not send traffic to those sites.The technician will define this threat as:

a decrypting RSA using obsolete and weakened encryption attack.

A security engineer thinks the development team has been hard-coding sensitive environment variables in its code.Which of the following would BEST secure the company's CI/CD pipeline?

Utilizing a trusted secrets manager

Performing DAST on a weekly basis

Introducing the use of container orchestration

A small company recently developed prototype technology for a military program. The company's security engineer is concerned about potential theft of the newly developed, proprietary information.Which of the following should the security engineer do to BEST manage the threats proactively?

Join an information-sharing community that is relevant to the company.

Leverage the MITRE ATT&CK framework to map the TTR.

Use OSINT techniques to evaluate and analyze the threats.

Update security awareness training to address new threats, such as best practices for data security.

A security engineer has been asked to close all non-secure connections from the corporate network. The engineer is attempting to understand why the corporate UTM will not allow users to download email via IMAPS. The engineer formulates a theory and begins testing by creating the firewall ID 58, and users are able to download emails correctly by using IMAP instead. The network comprises three VLANs: The security engineer looks at the UTM firewall rules and finds the following: Which of the following should the security engineer do to ensure IMAPS functions properly on the corporate user network?

Create an IMAPS firewall rule to ensure email is allowed.

Contact the email service provider and ask if the company IP is blocked.

Confirm the email server certificate is installed on the corporate computers.

Make sure the UTM certificate is imported on the corporate computers.

Create an IMAPS firewall rule to ensure email is allowed.

A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP connections using the command line.Which of the following commands would be the BEST to run to view only active Internet connections?

sudo netstat -pnut | grep -P ^tcp

sudo netstat -antu | grep ''LISTEN'' | awk '{print$5}'

sudo netstat -nlt -p | grep ''ESTABLISHED''

sudo netstat -plntu | grep -v ''Foreign Address''

sudo netstat -pnut -w | column -t -s $'\w'

sudo netstat -pnut | grep -P ^tcp

A business stores personal client data of individuals residing in the EU in order to process requests for mortgage loan approvals.Which of the following does the business's IT manager need to consider?

The right to personal data erasure

The availability of personal data

The right to personal data erasure

The language of the web application

An organization is referencing NIST best practices for BCP creation while reviewing current internal organizational processes for mission-essential items.Which of the following phases establishes the identification and prioritization of critical systems and functions?

Conduct a business impact analysis.

Perform a cost-benefit analysis.

Conduct a business impact analysis.

Develop an exposure factor matrix.

An organization is preparing to migrate its production environment systems from an on-premises environment to a cloud service. The lead security architect is concerned that the organization's current methods for addressing risk may not be possible in the cloud environment.Which of the following BEST describes the reason why traditional methods of addressing risk may not be possible in the cloud?

Specific risks cannot be transferred to the cloud provider.

Migrating operations assumes the acceptance of all risk.

Cloud providers are unable to avoid risk.

Specific risks cannot be transferred to the cloud provider.

Risks to data in the cloud cannot be mitigated.

In preparation for the holiday season, a company redesigned the system that manages retail sales and moved it to a cloud service provider. The new infrastructure did not meet the company's availability requirements. During a postmortem analysis, the following issues were highlighted:1- International users reported latency when images on the web page were initially loading.2- During times of report processing, users reported issues with inventory when attempting to place orders.3- Despite the fact that ten new API servers were added, the load across servers was heavy at peak times.Which of the following infrastructure design changes would be BEST for the organization to implement to avoid these issues in the future?

Serve static content via distributed CDNs, create a read replica of the central database and pull reports from there, and auto-scale API servers based on performance.

Increase the bandwidth for the server that delivers images, use a CDN, change the database to a non-relational database, and split the ten API servers across two load balancers.

Serve images from an object storage bucket with infrequent read times, replicate the database across different regions, and dynamically create API servers based on load.

Serve static-content object storage across different regions, increase the instance size on the managed relational database, and distribute the ten API servers across multiple regions.

During a remodel, a company's computer equipment was moved to a secure storage room with cameras positioned on both sides of the door. The door is locked using a card reader issued by the security team, and only the security team and department managers have access to the room. The company wants to be able to identify any unauthorized individuals who enter the storage room by following an authorized employee.Which of the following processes would BEST satisfy this requirement?

Require both security and management to open the door.

Monitor camera footage corresponding to a valid access request.

Require both security and management to open the door.

Require department managers to review denied-access requests.

Issue new entry badges on a weekly basis.

A company is preparing to deploy a global service.Which of the following must the company do to ensure GDPR compliance? (Choose two.)

Inform users regarding what data is stored.

Provide data deletion capabilities.

Inform users regarding what data is stored.

Provide opt-in/out for marketing messages.

Provide data deletion capabilities.

Provide optional data encryption.

Grant data access to third parties.

Provide alternative authentication techniques.

A SOC analyst is reviewing malicious activity on an external, exposed web server. During the investigation, the analyst determines specific traffic is not being logged, and there is no visibility from the WAF for the web application.Which of the following is the MOST likely cause?

HTTP traffic is not forwarding to HTTPS to decrypt.

The user agent client is not compatible with the WAF.

A certificate on the WAF is expired.

HTTP traffic is not forwarding to HTTPS to decrypt.

Old, vulnerable cipher suites are still being used.

A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.Which of the following actions would BEST address the potential risks by the activity in the logs?

Modifying the AllowUsers configuration directive

Alerting the misconfigured service account password

Modifying the AllowUsers configuration directive

Restricting external port 22 access

Implementing host-key preferences

A high-severity vulnerability was found on a web application and introduced to the enterprise. The vulnerability could allow an unauthorized user to utilize an open-source library to view privileged user information. The enterprise is unwilling to accept the risk, but the developers cannot fix the issue right away.Which of the following should be implemented to reduce the risk to an acceptable level until the issue can be fixed?

Implement MFA, review the application logs, and deploy a WAF.

Scan the code with a static code analyzer, change privileged user passwords, and provide security training.

Change privileged usernames, review the OS logs, and deploy hardware tokens.

Implement MFA, review the application logs, and deploy a WAF.

Deploy a VPN, configure an official open-source library repository, and perform a full application review for vulnerabilities.

A developer wants to maintain integrity to each module of a program and ensure the code cannot be altered by malicious users.Which of the following would be BEST for the developer to perform? (Choose two.)

Utilize code signing by a trusted third party.

Implement certificate-based authentication.

Compress the program with a password.

Which of the following is the MOST important security objective when applying cryptography to control messages that tell an ICS how much electrical power to output?

Assuring the integrity of messages

Importing the availability of messages

Ensuring non-repudiation of messages

Enforcing protocol conformance for messages

Assuring the integrity of messages

A university issues badges through a homegrown identity management system to all staff and students. Each week during the summer, temporary summer school students arrive and need to be issued a badge to access minimal campus resources. The security team received a report from an outside auditor indicating the homegrown system is not consistent with best practices in the security field and leaves the institution vulnerable.Which of the following should the security team recommend FIRST?

Working with procurement and creating a requirements document to select a new IAM system/vendor

Investigating a potential threat identified in logs related to the identity management system

Updating the identity management system to use discretionary access control

Beginning research on two-factor authentication to later introduce into the identity management system

Working with procurement and creating a requirements document to select a new IAM system/vendor

A customer reports being unable to connect to a website at www.test.com to consume services. The customer notices the web application has the following published cipher suite: Which of the following is the MOST likely cause of the customer's inability to connect?

The public key should be using ECDSA.

The default should be on port 80.

The server name should be test.com.

CompTIA CAS-004 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

An energy company is required to report the average pressure of natural gas used over the past quarter. A PLC sends data to a historian server that creates the required reports.

Which of the following historian server locations will allow the business to get the required reports in an and IT environment?

In the environment, use a VPN from the IT environment into the environment.

In the environment, allow IT traffic into the environment.

In the IT environment, allow PLCs to send data from the environment to the IT environment.

Use a screened subnet between the and IT environments.

Comment (0)

CompTIA CAS-004 Practice Test 1

Question

CompTIA CAS-004 Practice Tests

Practice Tests