CompTIA CAS-004 Practice Test - Questions Answers, Page 47

A common industrial protocol has the following characteristics:

* Provides for no authentication/security

* Is often implemented in a client/server relationship

* Is implemented as either RTU or TCP/IP

Which of the following is being described?

A security researcher identified the following messages while testing a web application:

Which of the following should the researcher recommend to remediate the issue?

During a software assurance assessment, an engineer notices the source code contains multiple instances of strcpy. which does not verify the buffer length. Which of the following solutions should be integrated into the SDLC process to reduce future risks?

An organization developed a containerized application. The organization wants to run the application in the cloud and automatically scale it based on demand. The security operations team would like to use container orchestration but does not want to assume patching responsibilities. Which of the following service models best meets these requirements?

A security architect examines a section of code and discovers the following:

Which of the following changes should the security architect require before approving the code for release?

A control systems analyst is reviewing the defensive posture of engineering workstations on the shop floor. Upon evaluation, the analyst makes the following observations:

* Unsupported, end-of-life operating systems were still prevalent on the shop floor.

* There are no security controls for systems with supported operating systems.

* There is little uniformity of installed software among the workstations.

Which of the following would have the greatest impact on the attack surface?

A DNS forward lookup zone named complia.org must:

* Ensure the DNS is protected from on-path attacks.

* Ensure zone transfers use mutual authentication and are authenticated and negotiated.

Which of the following should the security architect configure to meet these requirements? (Select two).

A company recently migrated its critical web application to a cloud provider's environment. As part of the company's risk management program, the company intends to conduct an external penetration test. According to the scope of work and the rules of engagement, the penetration tester will validate the web application's security and check for opportunities to expose sensitive company information in the newly migrated cloud environment. Which of the following should be the first consideration prior to engaging in the test?

A security team is concerned with attacks that are taking advantage of return-oriented programming against the company's public-facing applications. Which of the following should the company implement on the public-facing servers?