A security engineer performed a code scan that resulted in many false positives. The security engineer must find a solution that improves the quality of scanning results before application deployment. Which of the following is the best solution?

Limiting the tool to a specific coding language and tuning the rule set

Configuring branch protection rules and dependency checks

Using an application vulnerability scanner to identify coding flaws in production

Performing updates on code libraries before code development

A security engineer needs 10 secure the OT environment based on me following requirements* Isolate the OT network segment* Restrict Internet access.* Apply security updates two workstations* Provide remote access to third-party vendorsWhich of the following design strategies should the engineer implement to best meet these requirements?

Implement a bastion host in the OT network with security tools in place to monitor access and use a dedicated update server for the workstations.

Deploy a jump box on the third party network to access the OT environment and provide updates using a physical delivery method on the workstations

Implement a bastion host in the OT network with security tools in place to monitor access and use a dedicated update server for the workstations.

Enable outbound internet access on the OT firewall to any destination IP address and use the centralized update server for the workstations

Create a staging environment on the OT network for the third-party vendor to access and enable automatic updates on the workstations.

During a gap assessment, an organization notes that OYOD usage is a significant risk. The organization implemented administrative policies prohibiting BYOD usage However, the organization has not implemented technical controls to prevent the unauthorized use of BYOD assets when accessing the organization's resources. Which of the following solutions should the organization implement to b reduce the risk of OYOD devices? (Select two).

Conditional access, to enforce user-to-device binding

NAC, to enforce device configuration requirements

Cloud 1AM to enforce the use of token based MFA

Conditional access, to enforce user-to-device binding

NAC, to enforce device configuration requirements

PAM. to enforce local password policies

SD-WAN. to enforce web content filtering through external proxies

DLP, to enforce data protection capabilities

DLP to enforce data protection capabilities: Protects data but does not control BYOD device access and compliance.

Audit findings indicate several user endpoints are not utilizing full disk encryption During me remediation process, a compliance analyst reviews the testing details for the endpoints and notes the endpoint device configuration does not support full disk encryption Which of the following is the most likely reason me device must be replaced'

The motherboard was not configured with a TPM from the OEM supplier.

The HSM is outdated and no longer supported by the manufacturer

The vTPM was not properly initialized and is corrupt.

The HSM is vulnerable to common exploits and a firmware upgrade is needed

The motherboard was not configured with a TPM from the OEM supplier.

The HSM does not support sealing storage

A global manufacturing company has an internal application mat is critical to making products This application cannot be updated and must Be available in the production area A security architect is implementing security for the application. Which of the following best describes the action the architect should take-?

Create a separate network for users who need access to the application

Disallow wireless access to the application.

Deploy Intrusion detection capabilities using a network tap

Create an acceptable use policy for the use of the application

Create a separate network for users who need access to the application

A software company deployed a new application based on its internal code repository Several customers are reporting anti-malware alerts on workstations used to test the application Which of the following is the most likely cause of the alerts?

Invalid code signing certificate

A senior security engineer flags me following log file snippet as hawing likely facilitated an attacker's lateral movement in a recent breach: Which of the following solutions, if implemented, would mitigate the nsk of this issue reoccurnnp?

Restricting DNS traffic to UDP'W

Implementing DNS masking on internal servers

Permitting only clients from internal networks to query DNS

A security operations engineer needs to prevent inadvertent data disclosure when encrypted SSDs are reused within an enterprise. Which of the following is the most secure way to achieve this goal?

Securely deleting the encryption keys used by the SSD

Executing a script that deletes and overwrites all data on the SSD three times

Wiping the SSD through degaussing

Securely deleting the encryption keys used by the SSD

Writing non-zero, random data to all cells of the SSD

A security engineer is given the following requirements:* An endpoint must only execute Internally signed applications* Administrator accounts cannot install unauthorized software.* Attempts to run unauthorized software must be loggedWhich of the following best meets these requirements?

Configuring application control with blocked hashes and enterprise-trusted root certificates

Maintaining appropriate account access through directory management and controls

Implementing a CSPM platform to monitor updates being pushed to applications

Deploying an EDR solution to monitor and respond to software installation attempts

Configuring application control with blocked hashes and enterprise-trusted root certificates

A security analyst is troubleshooting the reason a specific user is having difficulty accessing company resources The analyst reviews the following information: Which of the following is most likely the cause of the issue?

A network geolocation is being misidentified by the authentication server

The local network access has been configured to bypass MFA requirements.

A network geolocation is being misidentified by the authentication server

Administrator access from an alternate location is blocked by company policy

Several users have not configured their mobile devices to receive OTP codes

A security analyst received a report that an internal web page is down after a company-wide update to the web browser Given the following error message: Which of the following is the b way to fix this issue?

Discontinuing the use of self-signed certificates

Rewriting any legacy web functions

Disabling all deprecated ciphers

Blocking all non-essential pons

Discontinuing the use of self-signed certificates

A company's help desk is experiencing a large number of calls from the finance department slating access issues to www bank com The security operations center reviewed the following security logs: Which of the following is most likely the cause of the issue?

DNS traffic is being sinkholed.

Recursive DNS resolution is failing

The DNS record has been poisoned.

DNS traffic is being sinkholed.

The DNS was set up incorrectly.

A security analyst is reviewing suspicious log-in activity and sees the following data in the SICM: Which of the following is the most appropriate action for the analyst to take?

implement automation to disable accounts that nave been associated with high-risk activity.

Update the log configuration settings on the directory server that Is not being captured properly.

Have the admin account owner change their password to avoid credential stuffing.

Block employees from logging in to applications that are not part of their business area.

implement automation to disable accounts that nave been associated with high-risk activity.

Which of the following is the security engineer most likely doing?

Assessing log in activities using geolocation to tune impossible Travel rate alerts

Reporting on remote log-in activities to track team metrics

Threat hunting for suspicious activity from an insider threat

Baselining user behavior to support advanced analytics

A company detects suspicious activity associated with external connections Security detection tools are unable to categorize this activity. Which of the following is the best solution to help the company overcome this challenge?

Implement an Interactive honeypot

Map network traffic to known loCs.

SIMULATIONA product development team has submitted code snippets for review prior to release.INSTRUCTIONSAnalyze the code snippets, and then select one vulnerability, and one fix for each code snippet.Code Snippet 1 Code Snippet 2 Vulnerability 1:SQL injectionCross-site request forgeryServer-side request forgeryIndirect object referenceCross-site scriptingFix 1:Perform input sanitization of the userid field.Perform output encoding of queryResponse,Ensure usex:ia belongs to logged-in user.Inspect URLS and disallow arbitrary requests.Implement anti-forgery tokens.Vulnerability 21) Denial of service2) Command injection3) SQL injection4) Authorization bypass5) Credentials passed via GETFix 2A) Implement prepared statements and bind variables.B) Remove the serve_forever instruction.C) Prevent the 'authenticated' value from being overridden by a GET parameter.D) HTTP POST should be used for sensitive parameters.E) Perform input sanitization of the userid field.

See the solution below in explanation

SIMULATIONA security engineer needs to review the configurations of several devices on the network to meet the following requirements:* The PostgreSQL server must only allow connectivity in the 10.1.2.0/24 subnet.* The SSH daemon on the database server must be configured to listen to port 4022.* The SSH daemon must only accept connections from a Single workstation.* All host-based firewalls must be disabled on all workstations.* All devices must have the latest updates from within the past eight days.* All HDDs must be configured to secure data at rest.* Cleartext services are not allowed.* All devices must be hardened when possible.Instructions:Click on the various workstations and network devices to review the posture assessment results. Remediate any possible issues or indicate that no issue is found.Click on Server A to review output data. Select commands in the appropriate tab to remediate connectivity problems to the pOSTGREsql DATABASE VIA ssh WAP A PC A Laptop A Switch A Switch B: Laptop B PC B PC C Server A

See the Explanation below for the solution

SIMULATIONAn IPSec solution is being deployed. The configuration files for both the VPNconcentrator and the AAA server are shown in the diagram.Complete the configuration files to meet the following requirements:* The EAP method must use mutual certificate-based authentication (With issued client certificates).* The IKEv2 Cipher suite must be configured to the MOST secure authenticated mode of operation,* The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimum length requirement of eight characters,INSTRUCTIONSClick on the AAA server and VPN concentrator to complete the configuration.Fill in the appropriate fields and make selections from the drop-down menus. VPN Concentrator: AAA Server:

See the answer below in Explanation

SIMULATIONAn organization is planning for disaster recovery and continuity of operations, and has noted the following relevant findings:1. A natural disaster may disrupt operations at Site A, which would then cause an evacuation. Users are unable to log into the domain from-their workstations after relocating to Site B.2. A natural disaster may disrupt operations at Site A, which would then cause the pump room at Site Bto become inoperable.3. A natural disaster may disrupt operations at Site A, which would then cause unreliable internet connectivity at Site B due to route flapping.INSTRUCTIONSMatch each relevant finding to the affected host by clicking on the host name and selecting the appropriate number.For findings 1 and 2, select the items that should be replicated to Site B. For finding 3, select the item requiring configuration changes, then select the appropriate corrective action from the drop-down menu.

See the complete solution below in Explanation

SIMULATIONDuring the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.INSTRUCTIONSReview each of the events and select the appropriate analysis and remediation options for each IoC.

See the complete solution below in Explanation

SIMULATIONYou are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements:. The application does not need to know the users' credentials.. An approval interaction between the users and the HTTP service must be orchestrated.. The application must have limited access to users' data.INSTRUCTIONSUse the drop-down menus to select the action items for the appropriate locations. All placeholders must be filled.

See the complete solution below in Explanation

The security team is looking into aggressive bot behavior that is resulting in performance issues on the web server. After further investigation, the security engineer determines that the bot traffic is legitimate. Which of the following is the best course of action to reduce performance issues without allocating additional resources to the server?

Update robots.txt to slow down the crawling speed.

Block all bot traffic using the IPS.

Monitor legitimate SEO bot traffic for abnormalities.

Configure the WAF to rate-limit bot traffic.

Update robots.txt to slow down the crawling speed.

A company updates its cloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved lo the repository The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment Which of the following should a security engineer recommend to reduce the deployment failures? (Select two).

Code submit authorization workflow

CompTIA CAS-005 Practice Test 3 - Free Online Exam Prep & Questions

A company that uses containers to run its applications is required to identify vulnerabilities on every container image in a private repository The security team needs to be able to quickly evaluate whether to respond to a given vulnerability Which of the following, will allow the security team to achieve the objective with the last effort?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CAS-005 Practice Test 3

Question

CompTIA CAS-005 Practice Tests

Practice Tests