An analyst reviews the following output collected during the execution of a web application security assessment: Which of the following attacks would be most likely to succeed, given the output?

NULL and unauthenticated cipher downgrade attack

Availability attack from manipulation of associated authentication data

On-path forced renegotiation to insecure ciphers

During the development process, the team identifies major components that need to be rewritten. As a result, the company hires a security consultant to help address major process issues. Which of the following should the consultant recommend to best prevent these issues from reoccurring in the future?

Utilizing a risk-based threat modeling approach on new projects

Implementing a static analysis tool within the CI/CD system

Configuring a dynamic application security testing tool

Performing software composition analysis on all third-party components

Utilizing a risk-based threat modeling approach on new projects

Setting up an interactive application security testing tool

The IT team suggests the company would save money by using self-signed certificates, but the security team indicates the company must use digitally signed third-party certificates. Which of the following is a valid reason to pursue the security team's recommendation?

Private-key CSR signage prevents on-path interception.

PKCS #10 is still preferred over PKCS #12.

Private-key CSR signage prevents on-path interception.

There is more control in using a local certificate over a third-party certificate.

There is minimal benefit in using a certificate revocation list.

A security architect is reviewing the following organizational specifications for a new application:* Be sessionless and API-based* Accept uploaded documents with Pll, so all storage must be ephemeral* Be able to scale on-demand across multiple nodes* Restrict all network access except for the TLS portWhich of the following ways should the architect recommend the application be deployed in order to meet security and organizational infrastructure requirements?

Utilizing the cloud container service

On server instances with autoscaling groups

With a content delivery network

A Chief Information Security Officer (CISO) received a call from the Chief Executive Officer (CEO) about a data breach from the SOC lead around 9:00 a.m. At 10:00 a.m. The CEO informs the CISO that a breach of the firm is being reported on national news. Upon investigation, it is determined that a network administrator has reached out to a vendor prior to the breach for information on a security patch that failed to be installed. Which of the following should the CISO do to prevent this from happening again?

Create an effective communication plan and socialize it with all employees.

Properly triage events based on brand imaging and ensure the CEO is on the call roster.

Create an effective communication plan and socialize it with all employees.

Send out a press release denying the breach until more information can be obtained.

Implement a more robust vulnerability identification process.

A company is migrating its data center to the cloud. Some hosts had been previously isolated, but a risk assessment convinced the engineering team to reintegrate the systems. Because the systems were isolated, the risk associated with vulnerabilities was low. Which of the following should the security team recommend be performed before migrating these servers to the cloud?

Performing patching and hardening

Implementing least functionality and time-based access

Creating a honeypot and adding decoy files

The primary advantage of an organization creating and maintaining a vendor risk registry is to:

ensure that inventory of potential risk is maintained.

define the risk assessment methodology.

study a variety of risks and review the threat landscape.

ensure that inventory of potential risk is maintained.

ensure that all assets have low residual risk.

A software developer has been tasked with creating a unique threat detection mechanism that is based on machine learning. The information system for which the tool is being developed is on a rapid CI/CD pipeline, and the tool developer is considered a supplier to the process. Which of the following presents the most risk to the development life cycle and lo the ability to deliver the security tool on time?

Big Data processing required for maturity

Deep learning language barriers

Big Data processing required for maturity

Secure, multiparty computation requirements

Computing capabilities available to the developer

A security administrator has been provided with three separate certificates and is trying to organize them into a single chain of trust to deploy on a website. Given the following certificate properties: Which of the following are true about the PKI hierarchy? (Select two).

SuperTrust RSA 2018 is the top-level CA.

www.budgetcert.com.is the top-level CA.

www.budgetcert.com. is an intermediate CA.

SuperTrust RSA 2018 is the top-level CA.

SuperTrust RSA 2018 is an intermediate CA.

BudgetCert is an intermediate CA.

A software development company needs to mitigate third-party risks to its software supply chain. Which of the following techniques should the company use in the development environment to best meet this objective?

Performing software composition analysis

Requiring multifactor authentication

Establishing coding standards and monitoring for compliance

Implementing a robust unit and regression-testing scheme

During a vendor assessment, an analyst reviews a listing of the complementary user entity controls included in the audit report. Which of the following is the most important aspect to consider when reviewing this list with the security team?

How the organization will implement and monitor the user entity controls

How the CSP performs the controls on behalf of the user entity

How the organization should monitor the CSP's execution of the user entity controls

How the user entity will audit the CSP's implementation of the user entity controls

A security architect discovers the following page while testing a website for vulnerabilities:404 - page not found: /gy67162The page you have requested is no. avai.able on .his server.Apache Tomcat 7.0.52Which of the following best describes why this issue should be corrected?

The information can be used for more targeted attacks.

The website is generating a server error.

The URL for this page can be used for directory traversal.

The website fuzzing tool has overloaded the server's capacity.

The information can be used for more targeted attacks.

A customer requires secure communication of subscribed web services at all times, but the company currently signs its own certificate requests to an internal C

Request a software signing certificate from a public CA.

Which of the following approaches will best meet the customer's requirements?

Generate a CSR to the local CA for email encryption.

Submit a CSR for a wildcard certificate to a public CA.

Request a software signing certificate from a public CA.

Process a CSR for a server authentication certificate.

A company has integrated source code from a subcontractor into its security product. The subcontractor is located in an adversarial country and has informed the company of a requirement to escrow the source code with the subcontractor's government. Which of the following is a potential security risk arising from this situation?

Development of zero-day exploits based on the source code

Legal action to force disclosure of the source code

Sale of source code to competitors during a buyout

Publication of the source code on the internet

CompTIA CAS-004 Practice Test 13 - Free Online Exam Prep & Questions

After investigating a recent security incident, a SOC analyst is charged with creating a reference guide for the entire team to use. Which of the following should the analyst create to address future incidents?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CAS-004 Practice Test 13

Question

CompTIA CAS-004 Practice Tests

Practice Tests