A managed security provider (MSP) is engaging with a customer who was working through a complete digital transformation Part of this transformation involves a move to cloud servers to ensure a scalable, high-performance, online user experience The current architecture includes:• Directory servers• Web servers• Database servers• Load balancers• Cloud-native VPN concentrator• Remote access serverThe MSP must secure this environment similarly to the infrastructure on premises Which of the following should the MSP put in place to BEST meet this objective? (Select THREE)

Virtual next-generation firewall

A company recently deployed a SIEM and began importing logs from a firewall, a file server, a domain controller a web server, and a laptop. A security analyst receives a series of SIEM alerts and prepares to respond. The following is the alert information: Which of the following should the security analyst do FIRST?

Disable the jdoe account, it is likely compromised

Disable Administrator on abc-uaa-fsl, the local account is compromised

Shut down the abc-usa-fsl server, a plaintext credential is being used

Disable the jdoe account, it is likely compromised

Shut down abc-usa-fw01; the remote access VPN vulnerability is exploited

A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented in order to meet contractual requirements, the company must achieve the following thresholds• 99 99% uptime• Load time in 3 seconds• Response time = <1 0 secondsStarting with the computing environment, which of the following should a security engineer recommend to BEST meet the requirements? (Select THREE)

Deploying a content delivery network

Installing a firewall at corporate headquarters

Deploying a content delivery network

Employing bare-metal loading of applications

Implementing RAID on the backup servers

Utilizing redundant power for all developer workstations

Ensuring technological diversity on critical servers

An ISP is receiving reports from a portion of its customers who state that typosquatting is occurring when they type in a portion of the URL for the ISP's website. The reports state that customers are being directed to an advertisement website that is asking for personal information. The security team has verified the DNS system is returning proper results and has no known lOCs. Which of the following should the security team implement to best mitigate this situation?

Revocation of compromised certificates

A security engineer investigates an incident and determines that a rogue device is on the network. Further investigation finds that an employee's personal device has been set up to access company resources and does not comply with standard security controls. Which of the following should the security engineer recommend to reduce the risk of future reoccurrence?

Require device certificates to access company resources.

Enable MFA at the organization's SSO portal.

Encrypt all workstation hard drives.

Hide the company wireless SSID.

A company with customers in the United States and Europe wants to ensure its content is delivered to end users with low latency. Content includes both sensitive and public information. The company's data centers are located on the West Coast of the United States. Users on the East Coast of the United States and users in Europe are experiencing slow application response. Which of the following would allow the company to improve application response quickly?

Implementing a CDN and forcing all traffic through the CDN

Installing reverse caching proxies in both data centers and implementing proxy auto scaling

Using HTTPS to serve sensitive content and HTTP for public content

Using colocation services in regions where the application response is slow

Implementing a CDN and forcing all traffic through the CDN

Which of the following is the primary reason that a risk practitioner determines the security boundary prior to conducting a risk assessment?

To determine the scope of the risk assessment

To determine the business owner(s) of the system

To decide between conducting a quantitative or qualitative analysis

To determine which laws and regulations apply

A security engineer is re-architecting a network environment that provides regional electric distribution services. During a pretransition baseline assessment, the engineer identified the following security-relevant characteristics of the environment:* Enterprise IT servers and supervisory industrial systems share the same subnet.* Supervisory controllers use the 750MHz band to direct a portion of fielded PLCs.* Command and telemetry messages from industrial control systems are unencrypted and unauthenticated.Which of the following re-architecture approaches would be best to reduce the company's risk?

Create a new network segment for enterprise IT servers, configure NGFW to enforce a well-defined segmentation policy, and implement a WIDS to monitor the spectrum.

Implement a one-way guard between enterprise IT services and mission-critical systems, obfuscate legitimate RF signals by broadcasting noise, and implement modern protocols to authenticate ICS messages.

Characterize safety-critical versus non-safety-critical systems, isolate safety-critical systems from other systems, and increase the directionality of RF links in the field.

Create a new network segment for enterprise IT servers, configure NGFW to enforce a well-defined segmentation policy, and implement a WIDS to monitor the spectrum.

Segment supervisory controllers from field PLCs, disconnect the entire network from the internet, and use only the 750MHz link for controlling energy distribution services.

A financial institution generates a list of newly created accounts and sensitive information on a daily basis. The financial institution then sends out a file containing thousands of lines of data. Which of the following would be the best way to reduce the risk of a malicious insider making changes to the file that could go undetected?

Implement a FIM that automatically generates alerts when the file is accessed by IP addresses that are not associated with the application.

Write a SIEM rule that generates a critical alert when files are created on the application server.

Implement a FIM that automatically generates alerts when the file is accessed by IP addresses that are not associated with the application.

Create a script that compares the size of the file on an hourly basis and generates alerts when changes are identified.

Tune the rules on the host-based IDS for the application server to trigger automated alerts when the application server is accessed from the internet.

The information security manager at a 24-hour manufacturing facility is reviewing a contract for potential risks to the organization. The contract pertains to the support of printers and multifunction devices during non-standard business hours. Which of the following will the security manager most likely identify as a risk?

The lack of an NDA with the company that supports its devices

Print configurations settings for locked print jobs

The lack of an NDA with the company that supports its devices

The lack of an MSA to govern other services provided by the service provider

The lack of chain of custody for devices prior to deployment at the company

Which of the following best describes what happens if chain of custody is broken?

Vital evidence could be deemed inadmissible.

Tracking record details are not properly labeled.

Vital evidence could be deemed inadmissible.

Evidence is not exhibited in the court of law.

Evidence will need to be recollected.

A security architect is implementing a SOAR solution in an organization's cloud production environment to support detection capabilities. Which of the following will be the most likely benefit?

Improved security operations center performance

Automated firewall log collection tasks

Optimized cloud resource utilization

Which of the following is a security concern for DNP3?

Authentication is not allocated.

Free-form messages require support.

Available function codes are not standardized.

Authentication is not allocated.

During a review of events, a security analyst notes that several log entries from the FIM system identify changes to firewall rule sets. While coordinating a response to the FIM entries, the analyst receives alerts from the DLP system that indicate an employee is sending sensitive data to an external email address. Which of the following would be the most relevant to review in order to gain a better understanding of whether these events are associated with an attack?

Mobile device management platform

A user in the finance department uses a laptop to store a spreadsheet that contains confidential financial information for the company. Which of the following would be the best way to protect the file while the user brings the laptop between locations? (Select two).

Encrypt the hard drive with full disk encryption.

Back up the file to an encrypted flash drive.

Encrypt the hard drive with full disk encryption.

Back up the file to an encrypted flash drive.

Place an ACL on the file to only allow access to specified users.

Store the file in the user profile.

Place an ACL on the file to deny access to everyone.

Enable access logging on the file.

After installing an unapproved application on a personal device, a Chief Executive Officer reported an incident to a security analyst. This device is not controlled by the MDM solution, as stated in the BYOD policy. However, the device contained critical confidential information. The cyber incident response team performed the analysis on the device and found the following log: Which of the following is the most likely reason for the successful attack?

Lack of application segmentation

A security administrator wants to enable a feature that would prevent a compromised encryption key from being used to decrypt all the VPN traffic. Which of the following should the security administrator use?

PKI-based IKE IPSec negotiation

In order to save money, a company has moved its data to the cloud with a low-cost provider. The company did not perform a security review prior to the move; however, the company requires all of its data to be stored within the country where the headquarters is located. A new employee on the security team has been asked to evaluate the current provider against the most important requirements. The current cloud provider that the company is using offers:* Only multitenant cloud hosting* Minimal physical security* Few access controls* No access to the data centerThe following information has been uncovered:* The company is located in a known floodplain, which flooded last year.* Government regulations require data to be stored within the country.Which of the following should be addressed first?

Provision services according to the appropriate legal requirements.

Update the disaster recovery plan to account for natural disasters.

Establish a new memorandum of understanding with the cloud provider.

Establish a new service-level agreement with the cloud provider.

Provision services according to the appropriate legal requirements.

CompTIA CAS-004 Practice Test 10 - Free Online Exam Prep & Questions

A bank hired a security architect to improve its security measures against the latest threats The solution must meet the following requirements

• Recognize and block fake websites

• Decrypt and scan encrypted traffic on standard and non-standard ports

• Use multiple engines for detection and prevention

• Have central reporting

Which of the following is the BEST solution the security architect can propose?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CAS-004 Practice Test 10

Question

CompTIA CAS-004 Practice Tests

Practice Tests