A regulated company is in the process of refreshing its entire infrastructure. The company has a business-critical process running on an old 2008 Windows server. If this server fails, the company would lose millions of dollars in revenue. Which of the following actions should the company take?

Create an organizational risk register for project prioritization.

Accept the risk as the cost of doing business.

Create an organizational risk register for project prioritization.

Implement network compensating controls.

Purchase insurance to offset the cost if a failure occurred.

A security engineer needs to ensure production containers are automatically scanned for vulnerabilities before they are accepted into the production environment. Which of the following should the engineer use to automatically incorporate vulnerability scanning on every commit?

Integrated development environment

A security analyst reviews network logs and notices a large number of domain name queries originating from an internal server for an unknown domain, similar to the following:2736287327321782.hgQ43jsi23-y.com0357320932922C91.hgQ43jsu23Ty.com4042301801399103.hgQ43jsu23Ly.comWhich of the following should the analyst do next?

Reconfigure the server's DNS settings.

Browse for a website on the requested domain.

Add the host names to a block list.

A company that provides services to clients who work with highly sensitive data would like to provide assurance that the data's confidentiality is maintained in a dynamic, low-risk environment. Which of the following would best achieve this goal? (Select two).

Encrypt all data and files at rest, in transit, and in use.

Configure SOAR to monitor and intercept files and data leaving the network.

Install a SOAR on all endpoints.

Encrypt all data and files at rest, in transit, and in use.

Configure SOAR to monitor and intercept files and data leaving the network.

Implement file integrity monitoring.

An ASIC manufacturer wishing to best reduce downstream supply chain risk can provide validation instructions for consumers that:

Leverage physically uncloneable functions.

Analyze an emplaced holographic icon on the board.

Include schematics traceable via X-ray interrogation.

Incorporate MD5 hashes of the ASIC design file.

A security analyst is examining a former employee's laptop for suspected evidence of suspicious activity. The analyst uses dd during the investigation. Which of the following best explains why the analyst is using this tool?

To capture an image of the hard drive

To reverse engineer binary programs

To recover deleted logs from the laptop

To deduplicate unnecessary data from the hard drive

A technology company developed an in-house chat application that is used only by developers. An open-source library within the application has been deprecated. The facts below are provided:* The cost of replacing this system is nominal.* The system provides no revenue to the business.* The system is not a critical part of the business.Which of the following is the best risk mitigation strategy?

Avoid the risk by shutting down this application and migrating to another chat platform.

Transfer the risk, since developers prefer using this chat application over alternatives.

Accept the risk, since any system disruption will only impact developers.

Avoid the risk by shutting down this application and migrating to another chat platform.

Mitigate the risk by purchasing an EDR and configuring network ACLs.

An ASIC manufacturer wishing to best reduce downstream supply chain risk can provide validation instructions for consumers that:

Leverage physically uncloneable functions.

Analyze an emplaced holographic icon on the board.

Include schematics traceable via X-ray interrogation.

Incorporate MD5 hashes of the ASIC design file.

A company has a website with a huge database. The company wants to ensure that a DR site could be brought online quickly in the event of a failover, and end users would miss no more than 30 minutes of data. Which of the following should the company do to meet these objectives?

Implement real-time replication for the DR site.

Build a content caching system at the DR site.

Store the nightly full backups at the DR site.

Increase the network bandwidth to the DR site.

Implement real-time replication for the DR site.

A security engineer is reviewing metrics for a series of bug bounty reports. The engineer finds systematic cross-site scripting issues and unresolved previous findings. Which of the following is the best solution to address the issue?

Introducing secure coding training focused on common issues

Implementing a third-party API management solution with input filtering

Leveraging middleware to handle integrations in the application

Introducing secure coding training focused on common issues

Ensuring functional checks are performed in the software development pipeline

Configuring a software composition analysis tool to look for issues

An administrator completed remediation for all the findings of a penetration test and notifies the management team that the systems are ready to be placed back into production. Which of the following steps should the management team require the analyst to perform immediately before placing the systems back into production?

Rescan for corrections/changes.

Conduct the entire penetration test again.

Ensure a host-based IPS is in place.

A security engineer is reviewing Apache web server logs and has identified the following pattern in the log:GET https://example.com/image5/../../etc/passwd HTTP/1.1 200 OKThe engineer has also reviewed IDS and firewall logs and established a correlation to an external IP address. Which of the following can be determined regarding the vulnerability and response?

A directory traversal attack was successful at reading the /etc/passwd file, and the system should avoid passing user-supplied input to the filesystem.

A cross-site scripting attack was successful at reading the /etc/passwd file, and the system should avoid passing user-supplied input to REST API.

A cross-site request forgery attack was successful at reading the /etc/passwd file, and the system should avoid passing user-supplied input to HTTP POST commands.

A directory traversal attack was successful at reading the /etc/passwd file, and the system should avoid passing user-supplied input to the filesystem.

A brute-force authentication attempt was successful, and the system should implement salting as part of the password hashing algorithm.

A security engineer is performing a threat modeling procedure against a machine learning system that correlates analytic information for decision support. Which of the following threat statements most likely applies to this type of system?

An attacker is able to overload the system with incorrect information.

An attacker conducts a password-spraying attack against the system's authentication method.

An attacker exploits a server-side request forgery attack.

An attacker accesses information that should not be disclosed due to an authorization error.

A security analyst and a DevOps engineer are working together to address configuration drifts in highly scalable systems that are leading to increased vulnerability findings. Which of the following recommendations would be best to eliminate this issue?

Deploying an immutable infrastructure through containers

Using a baseline configuration manager for deployment

Deploying an immutable infrastructure through containers

Eliminating false positives from the vulnerability scans

Performing continuous audits of the patching status

A user logged in to a web application. Later, a SOC analyst noticed the user logged in to systems after normal business hours. The end user confirms the log-ins after hours were unauthorized. Following an investigation, the SOC analyst determined that the web server was running an outdated version of OpenSSL. No other suspicious user log-ins were found. Which of the following describes what happened and how to fix it?

A downgrade attack occurred. Any use of old, outdated software should be disallowed.

The attacker obtained the systems' private keys. New key pairs must be generated.

Malware is present on the client machine. A full OS needs to be reinstalled.

The user fell for a phishing attack. The end user must attend security training.

A recent audit discovered that multiple employees had been using their badges to walk through the secured data center to get to the employee break room. Most of the employees were given access during a previous project, but the access was not removed in a timely manner when the project was complete. Which of the following would reduce the likelihood of this scenario occurring again?

Create an automated quarterly attestation process that requires management approval for data center access and removes unapproved access.

Require all employees to sign an AUP that prohibits accessing the data center without an active service ticket number.

Remove all access to the data center badge readers and only re-add employees with a valid business purpose for entering the floor.

Implement time-of-day restrictions on the data center badge readers and create automated alerts for unapproved swipe attempts.

Which of the following is the best reason for obtaining file hashes from a confiscated laptop?

To later validate the integrity of each file

To prevent metadata tampering on each file

To later validate the integrity of each file

To generate unique identifiers for each file

To preserve the chain of custody of files

A security engineer receives reports through the organization's bug bounty program about remote code execution in a specific component in a custom application. Management wants to properly secure the component and proactively avoid similar issues. Which of the following is the best approach to uncover additional vulnerable paths in the application?

Implement fuzz testing focused on the component and inputs uncovered by the bug bounty program.

Leverage a software composition analysis tool to find all known vulnerabilities in dependencies.

Use a vulnerability scanner to perform multiple types of network scans to look for vulnerabilities.

Utilize a network traffic analyzer to find malicious packet combinations that lead to remote code execution.

Run an exploit framework with all payloads against the application to see if it is able to gain access.

An organization wants to implement an access control system based on its data classification policy that includes the following data types:ConfidentialRestrictedInternalPublicThe access control system should support SSO federation to map users into groups. Each group should only access systems that process and store data at the classification assigned to the group. Which of the following should the organization implement to enforce its requirements with minimal impact to systems and resources?

A tagging strategy in which all resources are assigned a tag based on the data classification type, and a system that enforces attribute-based access control.

Role-based access control that maps data types to internal roles, which are defined in the human resources department's source of truth system.

Network microsegmentation based on data types, and a network access control system enforcing mandatory access control based on the user principal.

A rule-based access control strategy enforced by the SSO system with rules managed by the internal LDAP and applied on a per-system basis.

A company has a BYOD policy and has configured remote-wiping capabilities to support security requirements. An executive has raised concerns about personal contacts and photos being deleted from personal devices when an employee is terminated. Which of the following is the best way to address these concerns?

Enforce the use of the approved email client.

Require full device encryption.

Disable geotagging on the devices.

A technology company developed an in-house chat application that is used only by developers. An open-source library within the application has been deprecated. The facts below are provided:The cost of replacing this system is nominal.The system provides no revenue to the business.The system is not a critical part of the business.Which of the following is the best risk mitigation strategy?

Avoid the risk by shutting down this application and migrating to another chat platform.

Transfer the risk, since developers prefer using this chat application over alternatives.

Accept the risk, since any system disruption will only impact developers.

Avoid the risk by shutting down this application and migrating to another chat platform.

Mitigate the risk by purchasing an EDR and configuring network ACLs.

During a recent breach, an attacker was able to get a user's login credentials by cracking a password that was retrieved via a stolen laptop. The attacker accessed the hashed passwords from the hard drive when it was connected to another device. Which of the following security measures could have helped prevent this account from being compromised?

Host-based Intrusion Detection System

Endpoint Detection and Response

An organization has a secure manufacturing facility that is approximately 10mi (16km) away from its corporate headquarters. The organization's management team is concerned about being able to track personnel who utilize the facility. Which of the following would best help to prevent staff from being tracked?

Configuring geofencing to disable mobile devices and wearable devices near the secure facility.

Ensuring that all staff use covered parking so they cannot be seen from outside the perimeter.

Configuring geofencing to disable mobile devices and wearable devices near the secure facility.

Constructing a tunnel between headquarters and the facility to allow more secure access.

Enforcing physical security controls like access control vestibules and appropriate fencing.

A security technician is trying to connect a remote site to the central office over a site-to-site VPN. The technician has verified the source and destination IP addresses are correct, but the technician is unable to get the remote site to connect. The following error message keeps repeating:'An error has occurred during Phase 1 handshake. Deleting keys and retrying...'Which of the following is most likely the reason the connection is failing?

The Diffie-Hellman group on both sides matches but is a legacy group.

The IKE hashing algorithm uses different key lengths on each VPN device.

The IPSec settings allow more than one cipher suite on both devices.

The Diffie-Hellman group on both sides matches but is a legacy group.

The remote VPN is attempting to connect with a protocol other than SSL/TLS.

A pharmaceutical company uses a cloud provider to host thousands of independent resources in object storage. The company needs a practical and effective means of discovering data, monitoring changes, and identifying suspicious activity. Which of the following would best meet these requirements?

A machine-learning-based data security service

A file integrity monitoring service

A cloud configuration assessment and compliance service

An automated data classification system

CompTIA CAS-004 Practice Test 14 - Free Online Exam Prep & Questions

A security analyst is designing a touch screen device so users can gain entry into a locked room by touching buttons numbered zero through nine in a specific numerical sequence. The analyst designs the keypad so that the numbers are randomly presented to the user each time the device is used. Which of the following best describes the design trade-offs? (Select two.)

Become a Premium Member for full access

Unlock Premium Member

CompTIA CAS-004 Practice Test 14

Question

CompTIA CAS-004 Practice Tests

Practice Tests