When implementing serverless computing an organization must still account for:

the underlying computing network infrastructure

The security analyst discovers a new device on the company's dedicated loT subnet during the most recent vulnerability scan. The scan results show numerous open ports and insecure protocols in addition to default usernames and passwords. A camera needs to transmit video to the security server in the loT subnet. Which of the following should the security analyst recommend to securely operate the camera?

Harden the camera configuration.

Encrypt the camera's video stream.

Place the camera on an isolated segment

A technician accidentally deleted the secret key that was corresponding to the public key pinned to a busy online magazine. To remedy the situation, the technician obtained a new certificate with a different key. However, paying subscribers were locked out of the website until the key-pinning policy expired. Which of the following alternatives should the technician adopt to prevent a similar issue in the future?

Certificate authority authorization

Which of the following is the reason why security engineers often cannot upgrade the security of embedded facility automation systems?

They are constrained by available compute.

They are not logic-bearing devices.

A security engineer has learned that terminated employees' accounts are not being disabled. The termination dates are updated automatically in the human resources information system software by the appropriate human resources staff. Which of the following would best reduce risks to the organization?

Automating a process to disable the accounts by integrating Active Directory and human resources information systems

Exporting reports from the system on a weekly basis to disable terminated employees' accounts

Granting permission to human resources staff to mark terminated employees' accounts as disabled

Configuring allowed login times for all staff to only work during business hours

Automating a process to disable the accounts by integrating Active Directory and human resources information systems

A penetration tester discovers a condition that causes unexpected behavior in a web application. This results in the dump of the interpreter's debugging information, which includes the interpreter's version, full path of binary files, and the user ID running the process. Which of the following actions would best mitigate this risk?

Include routines in the application for message handling

Adopt a compiled programming language instead.

Perform SAST vulnerability scans on every build.

A junior security researcher has identified a buffer overflow vulnerability leading to remote code execution in a former employer's software. The security researcher asks for the manager's advice on the vulnerability submission process. Which of the following is the best advice the current manager can provide the security researcher?

Recommend legal consultation about the process.

Collect proof that the exploit works in order to expedite the process.

Publish proof-of-concept exploit code on a personal blog.

Recommend legal consultation about the process.

Visit a bug bounty website for the latest information.

A company has a website with a huge database. The company wants to ensure that a DR site could be brought online quickly in the event of a failover. and end users would miss no more than 30 minutes of data. Which of the following should the company do to meet these objectives?

Implement real-time replication for the DR site.

Build a content caching system at the DR site.

Store the nightly full backups at the DR site.

Increase the network bandwidth to the DR site.

Implement real-time replication for the DR site.

A company uses a CSP to provide a front end for its new payment system offering. The new offering is currently certified as PCI compliant. In order for the integrated solution to be compliant, the customer:

must ensure in-scope systems for the new offering are also PCI compliant.

must also be PCI compliant, because the risk is transferred to the provider.

still needs to perform its own PCI assessment of the provider's managed serverless service.

needs to perform a penetration test of the cloud provider's environment.

must ensure in-scope systems for the new offering are also PCI compliant.

A security researcher identified the following messages while testing a web application: Which of the following should the researcher recommend to remediate the issue?

Elimination of the use of unsafe functions

During a software assurance assessment, an engineer notices the source code contains multiple instances of strcpy. which does not verify the buffer length. Which of the following solutions should be integrated into the SDLC process to reduce future risks?

Update the company's secure coding policy to exclude insecure functions.

Require custom IDS/IPS detection signatures for each type of insecure function found.

Perform a penetration test before moving to the next step of the SDLC.

Update the company's secure coding policy to exclude insecure functions.

Perform DAST/SAST scanning before handoff to another team.

A security architect examines a section of code and discovers the following: Which of the following changes should the security architect require before approving the code for release?

Prevent more than 20 characters from being entered.

Allow only alphanumeric characters for the username.

Make the password variable longer to support more secure passwords.

Prevent more than 20 characters from being entered.

Add a password parameter to the checkUserExists function.

A control systems analyst is reviewing the defensive posture of engineering workstations on the shop floor. Upon evaluation, the analyst makes the following observations:* Unsupported, end-of-life operating systems were still prevalent on the shop floor.* There are no security controls for systems with supported operating systems.* There is little uniformity of installed software among the workstations.Which of the following would have the greatest impact on the attack surface?

Harden all of the engineering workstations using a common strategy.

Deploy antivirus software to all of the workstations.

Increase the level of monitoring on the workstations.

Utilize network-based allow and block lists.

Harden all of the engineering workstations using a common strategy.

A company recently migrated its critical web application to a cloud provider's environment. As part of the company's risk management program, the company intends to conduct an external penetration test. According to the scope of work and the rules of engagement, the penetration tester will validate the web application's security and check for opportunities to expose sensitive company information in the newly migrated cloud environment. Which of the following should be the first consideration prior to engaging in the test?

Obtain agreement between the company and the cloud provider to conduct penetration testing.

Prepare a redundant server to ensure the critical web application's availability during the test.

Obtain agreement between the company and the cloud provider to conduct penetration testing.

Ensure the latest patches and signatures are deployed on the web server.

Create an NDA between the external penetration tester and the company.

An application engineer is using the Swagger framework to leverage REST APIs to authenticate endpoints. The engineer is receiving HTTP 403 responses. Which of the following should the engineer do to correct this issue? (Select two).

Leverage OAuth for authentication.

Leverage Kerberos for authentication

Leverage OAuth for authentication.

Leverage LDAP for authentication.

A company has identified a number of vulnerable, end-of-support systems with limited defensive capabilities. Which of the following would be the first step in reducing the attack surface in this environment?

Utilizing hardening recommendations

Deploying IPS/IDS throughout the environment

Installing and updating antivirus

Installing all available patches

A security analyst identified a vulnerable and deprecated runtime engine that is supporting a public-facing banking application. The developers anticipate the transition to modern development environments will take at least a month. Which of the following controls would best mitigate the risk without interrupting the service during the transition?

Configuring IPS and WAF with signatures

Shutting down the systems until the code is ready

Uninstalling the impacted runtime engine

Selectively blocking traffic on the affected port

Configuring IPS and WAF with signatures

A recent security assessment generated a recommendation to transition Wi-Fi to WPA2/WPA3 Enterprise requiring EAP-TLS. Which of the following conditions must be met for the organization's mobile devices to be able to successfully join the corporate wireless network?

Client computer X.509 certificates have been installed.

Supplicants are configured to provide a 64-bit authenticator.

A hardware TOTP token has been issued to mobile users.

The device's IPSec configuration matches the VPN concentrator.

An accounting team member received a voicemail message from someone who sounded like the Chief Financial Officer (CFO). In the voicemail message, the caller requested a wire transfer to a bank account the organization had not used before. Which of the following best describes this type of attack?

The attacker used deepfake technology to simulate the CFO's voice.

The CFO tried to commit a form of embezzlement.

The attacker used caller ID spoofing to imitate the CFO's internal phone extension.

The attacker successfully phished someone in the accounts payable department.

A company would like to move its payment card data to a cloud provider. Which of the following solutions will best protect account numbers from unauthorized disclosure?

Only storing tokenized card data

Storing the data in an encoded file

Implementing database encryption at rest

Only storing tokenized card data

Implementing data field masking

Which of the following describes how a risk assessment is performed when an organization has a critical vendor that provides multiple products?

At the individual product level

Through the selection of a random product

Using a third-party audit report

A pharmaceutical company uses a cloud provider to host thousands of independent resources in object storage. The company needs a practical and effective means of discovering data, monitoring changes, and identifying suspicious activity. Which of the following would best meet these requirements?

A machine-learning-based data security service

A file integrity monitoring service

A cloud configuration assessment and compliance service

An automated data classification system

CompTIA CAS-004 Practice Test 12 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

CompTIA CAS-004 Practice Test 12

Question

CompTIA CAS-004 Practice Tests

Practice Tests