Which of the following key management practices ensures that an encryption key is maintained within the organization?

Encrypting using a key stored in an on-premises hardware security module

Encrypting using server-side encryption capabilities provided by the cloud provider

Encrypting using encryption and key storage systems provided by the cloud provider

Encrypting using a key escrow process for storage of the encryption key

An organization has been using self-managed encryption keys rather than the free keys managed by the cloud provider. The Chief Information Security Officer (CISO) reviews the monthly bill and realizes the self-managed keys are more costly than anticipated. Which of the following should the CISO recommend to reduce costs while maintaining a strong security posture?

Adjust the configuration for cloud provider keys on data that is classified as public.

Utilize an on-premises HSM to locally manage keys.

Adjust the configuration for cloud provider keys on data that is classified as public.

Begin using cloud-managed keys on all new resources deployed in the cloud.

Extend the key rotation period to one year so that the cloud provider can use cached keys.

Source code snippets for two separate malware samples are shown below:Sample 1:knockEmDown(String e) {if(target.isAccessed()) {target.toShell(e);System.out.printIn(e.toString());c2.sendTelemetry(target.hostname.toString + ' is ' + e.toString());} else {target.close();}}Sample 2:targetSys(address a) {if(address.islpv4()) {address.connect(1337);address.keepAlive('paranoid');String status = knockEmDown(address.current);remote.sendC2(address.current + ' is ' + status);} else {throw Exception e;}}Which of the following describes the most important observation about the two samples?

The samples were probably written by the same developer.

Telemetry is first buffered and then transmitted in paranoid mode.

The samples were probably written by the same developer.

Both samples use IP connectivity for command and control.

Sample 1 is the target agent while Sample 2 is the C2 server.

A company reduced its staff 60 days ago, and applications are now starting to fail. The security analyst is investigating to determine if there is malicious intent for the application failures. The security analyst reviews the following logs:Mar 5 22:09:50 akj3 sshd[21502]: Success login for userOl from 192.168.2.5Mar 5 22:10:00 akj3 sshd[21502]: Failed login for userID from 192.168.2.5Which of the following is the most likely reason for the application failures?

The user's home directory was deleted.

The user's account was set as a service account.

The user's home directory was deleted.

The user does not have sudo access.

The root password has been changed.

A company receives reports about misconfigurations and vulnerabilities in a third-party hardware device that is part of its released products. Which of the following solutions is the best way for the company to identify possible issues at an earlier stage?

Implementing a proper supply chain risk management program

Performing vulnerability tests on each device delivered by the providers

Performing regular red-team exercises on the vendor production line

Implementing a monitoring process for the integration between the application and the vendor appliance

Implementing a proper supply chain risk management program

Which of the following best explains the business requirement a healthcare provider fulfills by encrypting patient data at rest?

Protecting privacy while supporting portability.

Securing data transfer between hospitals

Providing for non-repudiation data

Reducing liability from identity theft

Protecting privacy while supporting portability.

A user submits a help desk ticket stating then account does not authenticate sometimes. An analyst reviews the following logs for the user:Which of the following best explains the reason the user's access is being denied?

Invalid user-to-device bindings

A user reports application access issues to the help desk. The help desk reviews the logs for the user: Which of the following is most likely the reason for the issue?

The user inadvertently tripped the geoblock rule in NGFW.

A threat actor has compromised the user's account and attempted to log in.

The user is not allowed to access the human resources system outside of business hours.

The user did not attempt to connect from an approved subnet.

A systems engineer is configuring SSO for a business that will be using SaaS applications for its remote-only workforce. Privileged actions in SaaS applications must be allowed only from corporate mobile devices that meet minimum security requirements, but BYOD must also be permitted for other activity. Which of the following would best meet this objective?

Configure device attestations and continuous authorization controls.

Block any connections from outside the business's network security boundary.

Install machine certificates on corporate devices and perform checks against the clients.

Configure device attestations and continuous authorization controls.

Deploy application protection policies using a corporate, cloud-based MDM solution.

A company wants to modify its process to comply with privacy requirements after an incident involving PII data in a development environment. In order to perform functionality tests, the QA team still needs to use valid data in the specified format. Which of the following best addresses the risk without impacting the development life cycle?

Utilizing tokenization for sensitive fields

Encrypting the data before moving into the QA environment

Truncating the data to make it not personally identifiable

Using a large language model to generate synthetic data

Utilizing tokenization for sensitive fields

A security architect must make sure that the least number of services as possible is exposed in order to limit an adversary's ability to access the systems. Which of the following should the architect do first?

Perform attack surface reduction.

Disable third-party integrations.

As part of a security audit in the software development life cycle, a product manager must demonstrate and provide evidence of a complete representation of the code and modules used within the production-deployed application prior to the build. Which of the following best provides the required evidence?

Static application security testing

Interactive application security testing

A company recently experienced a ransomware attack. Although the company performs systems and data backup on a schedule that aligns with its RPO (Recovery Point Objective) requirements, the backup administrator could not recover critical systems and data from its offline backups to meet the RPO. Eventually, the systems and data were restored with information that was six months outside of RPO requirements.Which of the following actions should the company take to reduce the risk of a similar attack?

Perform regular disaster recovery testing of IT and non-IT systems and processes.

Encrypt and label the backup tapes with the appropriate retention schedule before they are sent to the off-site location.

Implement a business continuity process that includes reverting manual business processes.

Perform regular disaster recovery testing of IT and non-IT systems and processes.

Carry out a tabletop exercise to update and verify the RACI matrix with IT and critical business functions.

A company finds logs with modified time stamps when compared to other systems. The security team decides to improve logging and auditing for incident response. Which of the following should the team do to best accomplish this goal?

Implement a central logging server, allowing only log ingestion.

Integrate a file-monitoring tool with the SIEM.

Change the log solution and integrate it with the existing SIEM.

Implement a central logging server, allowing only log ingestion.

Rotate and back up logs every 24 hours, encrypting the backups.

Previously intercepted communications must remain secure even if a current encryption key is compromised in the future. Which of the following best supports this requirement?

Simultaneous authentication of equals

A security engineer is assisting a DevOps team that has the following requirements for container images:Ensure container images are hashed and use version controls.Ensure container images are up to date and scanned for vulnerabilities.Which of the following should the security engineer do to meet these requirements?

Enable new security and quality checks within a CI/CD pipeline.

Enable clusters on the container image and configure the mesh with ACLs.

Enable new security and quality checks within a CI/CD pipeline.

Enable audits on the container image and monitor for configuration changes.

Enable pulling of the container image from the vendor repository and deploy directly to operations.

During a vulnerability assessment, a scan reveals the following finding:Windows Server 2016 Missing hotfix KB87728 - CVSS 3.1 Score: 8.1 [High] - Affected host 172.16.15.2Later in the review process, the remediation team marks the finding as a false positive. Which of the following is the best way to avoid this issue on future scans?

Performing an authenticated scan on the servers

Getting an up-to-date list of assets from the CMDB

Performing an authenticated scan on the servers

Configuring the sensor with an advanced policy for fingerprinting servers

Coordinating the scan execution with the remediation team early in the process

After a company discovered a zero-day vulnerability in its VPN solution, the company plans to deploy cloud-hosted resources to replace its current on-premises systems. An engineer must find an appropriate solution to facilitate trusted connectivity. Which of the following capabilities is the most relevant?

Secure access service edge (SASE)

A security engineer must resolve a vulnerability in a deprecated version of Python for a custom-developed flight simulation application that is monitored and controlled remotely. The source code is proprietary and built with Python functions running on the Ubuntu operating system. Version control is not enabled for the application in development or production. However, the application must remain online in the production environment using built-in features. Which of the following solutions best reduces the attack surface of these issues and meets the outlined requirements?

Configure code-signing within the CI/CD pipeline, update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.

Enable branch protection in the GitHub repository. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.

Use an NFS network share. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.

Configure version designation within the Python interpreter. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.

An organization recently implemented a new email DLP solution. Emails sent from company email addresses to matching personal email addresses generated a large number of alerts, but the content of the emails did not include company data. The security team needs to reduce the number of emails sent without blocking all emails to common personal email services. Which of the following should the security team implement first?

Create an acceptable use policy.

Automatically quarantine outgoing email.

Create an acceptable use policy.

Enforce email encryption standards.

Perform security awareness training focusing on phishing.

An organization that performs real-time financial processing is implementing a new backup solution. Given the following business requirements:The backup solution must reduce the risk of potential backup compromise.The backup solution must be resilient to a ransomware attack.The time to restore from backups is less important than backup data integrity.Multiple copies of production data must be maintained.Which of the following backup strategies best meets these requirements?

Creating a secondary, immutable database and adding live data on a continuous basis

Utilizing two connected storage arrays and ensuring the arrays constantly sync

Enabling remote journaling on the databases to ensure real-time transactions are mirrored

Setting up anti-tampering on the databases to ensure data cannot be changed unintentionally

A company migrating to a remote work model requires that company-owned devices connect to a VPN before logging in to the device itself. The VPN gateway requires that a specific key extension is deployed to the machine certificates in the internal PKI. Which of the following best explains this requirement?

The VPN client selected the certificate with the correct key usage without user interaction.

The certificate is an additional factor to meet regulatory MFA requirements for VPN access.

The VPN client selected the certificate with the correct key usage without user interaction.

The internal PKI certificate deployment allows for Wi-Fi connectivity before logging in to other systems.

The server connection uses SSL VPN, which uses certificates for secure communication.

An organization has noticed an increase in phishing campaigns utilizing typosquatting. A security analyst needs to enrich the data for commonly used domains against the domains used in phishing campaigns. The analyst uses a log forwarder to forward network logs to the SIEM. Which of the following would allow the security analyst to perform this analysis?

Create a parser that matches domains.

Use a cron job to regularly update and compare domains.

Create a parser that matches domains.

Develop a query that filters out all matching domain names.

Implement a dashboard on the SIEM that shows the percentage of traffic by domain.

An analyst reviews a SIEM and generates the following report: Only HOST002 is authorized for internet traffic. Which of the following statements is accurate?

The network connection activity is unusual, and a network infection is highly possible.

The VM002 host is misconfigured and needs to be revised by the network team.

The HOST002 host is under attack, and a security incident should be declared.

The SIEM platform is reporting multiple false positives on the alerts.

The network connection activity is unusual, and a network infection is highly possible.

A compliance officer is facilitating a business impact analysis (BIA) and wants business unit leaders to collect meaningful data. Several business unit leaders want more information about the types of data the officer needs.Which of the following data types would be the most beneficial for the compliance officer? (Select two)

Applicable contract obligations

A company's SIEM is designed to associate the company's asset inventory with user events. Given the following report: Which of the following should a security engineer investigate first as part of a log audit?

Unauthorized usage attempts of the administrator account

An endpoint that is not submitting any logs

Potential activity indicating an attacker moving laterally in the network

A misconfigured syslog server creating false negatives

Unauthorized usage attempts of the administrator account

During a recent security event, access from the non-production environment to the production environment enabled unauthorized users to:Install unapproved softwareMake unplanned configuration changesDuring the investigation, the following findings were identified:Several new users were added in bulk by the IAM teamAdditional firewalls and routers were recently addedVulnerability assessments have been disabled for more than 30 daysThe application allow list has not been modified in two weeksLogs were unavailable for various types of trafficEndpoints have not been patched in over ten daysWhich of the following actions would most likely need to be taken to ensure proper monitoring? (Select two)

Disable bulk user creations by the IAM team

Routinely update all endpoints and network devices as soon as new patches/hot fixes are available

Ensure all network and security devices are sending relevant data to the SIEM

Disable bulk user creations by the IAM team

Extend log retention for all security and network devices to 180 days for all traffic

Review the application allow list daily

Routinely update all endpoints and network devices as soon as new patches/hot fixes are available

Ensure all network and security devices are sending relevant data to the SIEM

Configure firewall rules to only allow production-to-non-production traffic

A building camera is remotely accessed and disabled from the remote console application during off-hours. A security analyst reviews the following logs: Which of the following actions should the analyst take to best mitigate the threat?

Only allow connections from approved IPs.

Implement WAF protection for the web application.

Upgrade the firmware on the camera.

Only allow connections from approved IPs.

Block IP 104.18.16.29 on the firewall.

A company must build and deploy security standards for all servers in its on-premises and cloud environments based on hardening guidelines. Which of the following solutions most likely meets the requirements?

Create baseline images for each OS in use, following security standards, and integrate the images into the patching and deployment solution.

Develop a security baseline to integrate with the vulnerability scanning platform to alert about any server not aligned with the new security standards.

Create baseline images for each OS in use, following security standards, and integrate the images into the patching and deployment solution.

Build all new images from scratch, installing only needed applications and modules in accordance with the new security standards.

Run a script during server deployment to remove all the unnecessary applications as part of provisioning.

CompTIA CAS-005 Practice Test 4 - Free Online Exam Questions 121-160

Operational technology often relies upon aging command, control, and telemetry subsystems that were created with the design assumption of:

Become a Premium Member for full access

Unlock Premium Member

CompTIA CAS-005 Practice Test 4

Question

CompTIA CAS-005 Practice Tests

Practice Tests