An enterprise is deploying APIs that utilize a private key and a public key to ensure the connection string is protected. To connect to the API, customers must use the private key. Which of the following would best secure the REST API connection to the database while preventing the use of a hard-coded string in the request string?

Deploy MFA for the service accounts

A recent security audit identified multiple endpoints have the following vulnerabilities:* Various unsecured open ports* Active accounts for terminated personnel* Endpoint protection software with legacy versions* Overly permissive access rulesWhich of the following would best mitigate these risks? (Select three).

Address space layout randomization

A security analyst notices a number of SIEM events that show the following activity:10/30/2020 - 8:01 UTC - 192.168.1.1 - sc stop HinDctend10/30/2020 - 8:05 UTC - 192.168.1.2 - c:\program files\games\comptidcasp.exe10/30/2020 - 8:07 UTC - 192.168.1.1 - c:\windows\system32\cmd.exe /c powershell10/30/2020 - 8:07 UTC - 192.168.1.1 - powershell ---> 40.90.23.154:443Which of the following response actions should the analyst take first?

Configure the forward proxy to block 40.90.23.154

Disable powershell.exe on all Microsoft Windows endpoints

Restart Microsoft Windows Defender

Configure the forward proxy to block 40.90.23.154

Disable local administrator privileges on the endpoints

A malware researcher has discovered a credential stealer is looking at a specific memory register to harvest passwords that will be used later for lateral movement in corporate networks. The malware is using TCP 4444 to communicate with other workstations. The lateral movement would be best mitigated by:

Enforcing all systems to use UEFI

Enabling ASLR on the Active Directory server

While investigating a security event an analyst finds evidence that a user opened an email attachment from an unknown source. Shortly after the user opened the attachment, a group of servers experienced a large amount of network and resource activity. Upon investigating the servers, the analyst discovers the servers were encrypted by ransomware that is demanding payment within 48 hours or all data will be destroyed. The company has no response plans for ransomware. Which of the following is the next step the analyst should take after reporting the incident to the management team?

Isolate the servers to prevent the spread

Request that the affected servers be restored immediately

The device event logs sourced from MDM software are as follows:Device | Date/Time | Location | Event | DescriptionANDROID_102 | 01JAN21 0255 | 38.9072N, 77.0369W | PUSH | APPLICATION 1220 INSTALL QUEUEDANDROID_102 | 01JAN21 0301 | 38.9072N, 77.0369W | INVENTORY | APPLICATION 1220 ADDEDANDROID_1022 | 01JAN21 0701 | 39.0067N, 77.4291W | CHECK-IN | NORMALANDROID_1022 | 01JAN21 0701 | 25.2854N, 51.5310E | CHECK-IN | NORMALANDROID_1022 | 01JAN21 0900 | 39.0067N, 77.4291W | CHECK-IN | NORMALANDROID_1022 | 01JAN21 1030 | 39.0067N, 77.4291W | STATUS | LOCAL STORAGE REPORTING 85% FULLWhich of the following security concerns and response actions would best address the risks posed by the device in the logs?

Impossible travel; disable the device's account and access while investigating

Malicious installation of an application; change the MDM configuration to remove application ID 1220

Resource leak; recover the device for analysis and clean up the local storage

Impossible travel; disable the device's account and access while investigating

Falsified status reporting; remotely wipe the device

Which of the following best describes a common use case for homomorphic encryption?

Transmitting confidential data to a CSP for processing on a large number of resources without revealing information

Processing data on a server after decrypting in order to prevent unauthorized access in transit

Maintaining the confidentiality of data both at rest and in transit to and from a CSP for processing

Transmitting confidential data to a CSP for processing on a large number of resources without revealing information

Storing proprietary data across multiple nodes in a private cloud to prevent access by unauthenticated users

A security architect is investigating instances of employees who had their phones stolen in public places through seemingly targeted attacks. Devices are able to access company resources such as email and internal documentation, some of which can persist in application storage. Which of the following would best protect the company from information exposure? (Select two).

Implement a remote wipe procedure if the phone does not check in for a period of time

Enforce biometric access control with configured timeouts

Implement a remote wipe procedure if the phone does not check in for a period of time

Enforce biometric access control with configured timeouts

Set up geofencing for corporate applications where the phone must be near an office

Use application control to restrict the applications that can be installed

Leverage an MDM solution to prevent the side loading of mobile applications

Enable device certificates that will be used for access to company resources

An organization recently implemented a purchasing freeze that has impacted endpoint life-cycle management efforts. Which of the following should a security manager do to reduce risk without replacing the endpoints?

Dispose of end-of-support devices

4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 206d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 0050 45 00 00 4c 01 03 00 34 6d be 66 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 05 00 00 70 00 00 00 10 00 00 00 d0 00 00 70 4c 01 00 00 e0 00 00 00 50 01 00 00 00 40 0000 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 02 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 0000 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00Attempts to run the code in a sandbox produce no results. Which of the following should the malware analyst do next to further analyze the malware and discover useful IoCs?

Convert the hex-encoded sample to binary and attempt to decompile it.

Run the encoded sample through an online vulnerability tool and check for any matches.

Pad the beginning and end of the sample with binary executables and attempt to execute it.

Use a disassembler on the unencoded snippet to convert from binary to ASCII text.

CompTIA CAS-005 Practice Test 6 - Free Online Exam Questions 201-221

Which of the following security risks should be considered as an organization reduces cost and increases availability of services by adopting serverless computing?

Become a Premium Member for full access

Unlock Premium Member

CompTIA CAS-005 Practice Test 6

Question

CompTIA CAS-005 Practice Tests

Practice Tests