A security architect must mitigate the risks from what is suspected to be an exposed, private cryptographic key. Which of the following is the best step to take?

Inform all the users of the certificate.

Contact the company's Chief Information Security Officer.

Disable the website using the suspected certificate.

Signed applications reduce risks by:

providing assurance that the application is using unmodified source code.

encrypting the application's data on the device.

requiring the developer to use code-level hardening techniques.

providing assurance that the application is using unmodified source code.

costing the developer money to publish, which reduces the likelihood of malicious intent.

After a server was compromised an incident responder looks at log files to determine the attack vector that was used The incident responder reviews the web server log files from the time before an unexpected SSH session began: Which of the following is the most likely vulnerability that was exploited based on the log files?

Directory traversal revealed the hashed SSH password, which was used to access the server.

A SQL injection was used during the ordering process to compromise the database server

The root password was easily guessed and used as a parameter lo open a reverse shell

An outdated third-party PHP plug-in was vulnerable to a known remote code execution

A hospital has fallen behind with patching known vulnerabilities due to concerns that patches may cause disruptions in the availability of data and impact patient care. The hospital does not have a tracking solution in place to audit whether systems have been updated or to track the length of time between notification of the weakness and patch completion Since tracking is not in place the hospital lacks accountability with regard to who is responsible for these activities and the timeline of patching efforts. Which of the following should the hospital do first to mitigate this risk?

Complete a vulnerability analysis

Obtain guidance from the health ISAC

Purchase a ticketing system for auditing efforts

Train administrators on why patching is important

A security engineer is concerned about the threat of side-channel attacks The company experienced a past attack that degraded parts of a SCADA system, causing a fluctuation to 20,000rpm from its normal operating range As a result, the part deteriorated more quickly than the mean time to failure A further investigation revealed the attacker was able to determine the acceptable rpm range, and the malware would then fluctuate the rpm until the pan failed Which of the following solutions would be best to prevent a side-channel attack in the future?

Air gapping important ICS and machines

Installing online hardware sensors

Air gapping important ICS and machines

Installing a SIEM agent on the endpoint

A security administrator needs to implement a security solution that will* Limit the attack surface in case of an incident* Improve access control for external and internal network security.* Improve performance with less congestion on network trafficWhich of the following should the security administrator do?

Update firewall rules to match new IP addresses in use

Integrate threat intelligence feeds into the FIM

Update firewall rules to match new IP addresses in use

Configure SIEM dashboards to provide alerts and visualizations

Deploy DLP rules based on updated Pll formatting

An multinational organization was hacked, and the incident response team's timely action prevented a major disaster Following the event, the team created an after action report. Which of the following is the primary goal of an after action review?

To identify ways to improve the response process

To gather evidence for subsequent legal action

To determine the identity of the attacker

To identify ways to improve the response process

To create a plan of action and milestones

A security engineer needs to select the architecture for a cloud database that will protect an organization's sensitive data. The engineer has a choice between a single-tenant or a multitenant database architecture offered by a cloud vendor. Which of the following best describes the security benefits of the single-tenant option? (Select two).

Full control and ability to customize

Low resilience to side-channel attacks

Full control and ability to customize

A company with multiple locations has taken a cloud-only approach to its infrastructure The company does not have standard vendors or systems resulting in a mix of various solutions put in place by each location The Chief Information Security Officer wants to ensure that the internal security team has visibility into all platforms Which of the following best meets this objective?

Security information and event management

Cloud security posture management

SNMFV2 monitoring and log aggregation

Managed detection and response services from a third party

The general counsel at an organization has received written notice of upcoming litigation. The general counsel has issued a legal records hold. Which of the following actions should the organization take to comply with the request?

Preserve all communication matching the requested search terms

Block communication with the customer while litigation is ongoing

Require employees to be trained on legal record holds

Request that all users do not delete any files

A cyberanalyst for a government agency is concerned about how Pll is protected A supervisor indicates that a Privacy Impact Assessment must be done. Which of the following describes a function of a Privacy Impact Assessment?

To validate the project participants

A security officer is requiring all personnel working on a special project to obtain a security clearance requisite with the level of all information being accessed Data on this network must be protected at the same level of each clearance holder The need to know must be vended by the data owner Which of the following should the security officer do to meet these requirements?

Assign labels to the files and require formal access authorization

Create a rule lo authorize personnel only from certain IPs to access the files

Assign labels to the files and require formal access authorization

Assign attributes to each file and allow authorized users to share the files

Assign roles to users and authorize access to files based on the roles

A company with only U S -based customers wants to allow developers from another country to work on the company's website However, the company plans to block normal internet traffic from the other country Which of the following strategies should the company use to accomplish this objective? (Select two).

Have the developers use the company's VPN

Give the developers access to a jump box on the network

Block foreign IP addresses from accessing the website

Have the developers use the company's VPN

Implement a WAP for the website

Give the developers access to a jump box on the network

Employ a reverse proxy for the developers

Use NAT to enable access for the developers

A SOC analyst received an alert about a potential compromise and is reviewing the following SIEM logs: Which of the following is the most appropriate action for the SOC analyst to recommend?

Isolating laptop314 from the network

Disabling account JDoe to prevent further lateral movement

Isolating laptop314 from the network

Alerting JDoe about the potential account compromise

Creating HIPS and NIPS rules to prevent logins

Company A is merging with Company B Company A is a small, local company Company B has a large, global presence The two companies have a lot of duplication in their IT systems processes, and procedures On the new Chief Information Officer's (ClO's) first day a fire breaks out at Company B's mam data center Which of the following actions should the CIO take first?

Review the incident response plans, and engage the disaster recovery plan while relying on the IT leaders from both companies.

Determine whether the incident response plan has been tested at both companies, and use it to respond

Review the incident response plans, and engage the disaster recovery plan while relying on the IT leaders from both companies.

Ensure hot. warm, and mobile disaster recovery sites are available, and give an update to the companies' leadership teams

Initiate Company A's IT systems processes and procedures, assess the damage, and perform a BIA

An loT device implements an encryption module built within its SoC where the asymmetric private key has been defined in a write-once read-many portion of the SoC hardware Which of the following should the loT manufacture do if the private key is compromised?

Manufacture a new loT device with a redesigned SoC

Use over-the-air updates to replace the private key

Manufacture a new loT device with a redesigned SoC

Replace the public portion of the loT key on its servers

Release a patch for the SoC software

A company is in the process of refreshing its entire infrastructure The company has a business-critical process running on an old 2008 Windows server If this server fails, the company would lose millions of dollars in revenue. Which of the following actions should the company should take?

Calculate the ALE and conduct a cost-benefit analysis

Accept the risk as the cost of doing business

Create an organizational risk register for project prioritization

Calculate the ALE and conduct a cost-benefit analysis

Purchase insurance to offset the cost if a failure occurred

A security engineer is assessing a legacy server and needs to determine if FTP is running and on which port The service cannot be turned off, as it would impact a critical application's ability to function. Which of the following commands would provide the information necessary to create a firewall rule to prevent that service from being exploited?

service ---status-ali I grep ftpd

systeactl list-unit-file ---type service ftpd

An organization has an operational requirement with a specific equipment vendor The organization is located in the United States, but the vendor is located in another region Which of the following risks would be most concerning to the organization in the event of equipment failure?

Support may not be available during all business hours

The organization requires authorized vendor specialists.

Each region has different regulatory frameworks to follow

Shipping delays could cost the organization money

The Chief Executive Officer of an online retailer notices a sudden drop in sales A security analyst at the retailer detects a redirection of unsecure web traffic to a competitor's site Which of the following would best prevent this type of attack?

Configuring certificate pinning

An organization is designing a MAC scheme (or critical servers running GNU/Linux. The security engineer is investigating SELinux but is confused about how to read labeling contexts. The engineer executes the command stat ./secretfile and receives the following output: Which of the following describes the correct order of labels shown in the output above?

User identity, role, type, and MLS level

Role, type MLS level, and user identity

Role, user identity, object, and MLS level

Object MLS level, role, and type

User identity, role, type, and MLS level

Object, user identity, role, and MLS level

CompTIA CAS-004 Practice Test 11 - Free Online Exam Prep & Questions

An internal security assessor identified large gaps in a company's IT asset inventory system during a monthly asset review. The assessor is aware of an external audit that is underway. In an effort to avoid external findings, the assessor chooses not to report the gaps in the inventory system. Which of the following legal considerations is the assessor directly violating?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CAS-004 Practice Test 11

Question

CompTIA CAS-004 Practice Tests

Practice Tests