A Review Of Refined CAS-004 Free Download

NEW QUESTION 1
A company is deploying multiple VPNs to support supplier connections into its extranet applications. The network security standard requires:
• All remote devices to have up-to-date antivirus
• An up-to-date and patched OS
Which of the following technologies should the company deploy to meet its security objectives? (Select TWO)_

• A. NAC
• B. WAF
• C. NIDS
• D. Reverse proxy
• E. NGFW
• F. Bastion host

Answer: AC

NEW QUESTION 2
A hospitality company experienced a data breach that included customer Pll. The hacker used social engineering to convince an employee to grant a third-party application access to some company documents within a cloud file storage service. Which of the following is the BEST solution to help prevent this type of attack in the future?

• A. NGFW for web traffic inspection and activity monitoring
• B. CSPM for application configuration control
• C. Targeted employee training and awareness exercises
• D. CASB for OAuth application permission control

Answer: D

Explanation:
The company should use CASB for OAuth application permission control to help prevent this type of attack in the future. CASB stands for cloud access security broker, which is a software tool that monitors and enforces security policies for cloud applications. CASB can help control which third-party applications can access the company’s cloud file storage service and what permissions they have. CASB can also detect and block any unauthorized or malicious applications that try to access the company’s data. Verified References:
https://www.kaspersky.com/resource-center/threats/how-to-avoid-social-engineering-attacks
https://www.eccouncil.org/cybersecurity-exchange/ethical-hacking/understanding-preventing-social-engin
https://www.indusface.com/blog/10-ways-businesses-can-prevent-social-engineering-attacks/

NEW QUESTION 3
A small business would like to provide guests who are using mobile devices encrypted WPA3 access without first distributing PSKs or other credentials. Which of the following features will enable the business to meet this objective?

• A. Simultaneous Authentication of Equals
• B. Enhanced open
• C. Perfect forward secrecy
• D. Extensible Authentication Protocol

Answer: A

NEW QUESTION 4
Users are reporting intermittent access issues with & new cloud application that was recently added to the network. Upon investigation, he scary administrator notices the human resources department Is able to run required queries with the new application, but the marketing department is unable to pull any needed reports on various resources using the new application. Which of the following MOST likely needs to be done to avoid this in the future?

• A. Modify the ACLs.
• B. Review the Active Directory.
• C. Update the marketing department's browser.
• D. Reconfigure the WAF.

Answer: A

Explanation:
Modifying the ACLs (access control lists) is the most likely solution to avoid the intermittent access issues with the new cloud application. ACLs are used to define permissions for different users and groups to access resources on a network. The problem may be caused by incorrect or missing ACLs for the marketing department that prevent them from accessing the cloud application or its data sources. The other options are either irrelevant or less effective for the given scenario

NEW QUESTION 5
A company has decided that only administrators are permitted to use PowerShell on their Windows computers. Which of the following is the BEST way for an administrator to implement this decision?

• A. Monitor the Application and Services Logs group within Windows Event Log.
• B. Uninstall PowerSheII from all workstations.
• C. Configure user settings in Group Policy.
• D. Provide user education and training.
• E. Block PowerSheII via HIDS.

Answer: C

Explanation:

Configuring user settings in Group Policy is the best way for an administrator to implement the decision to restrict PowerShell access to only administrators. Group Policy is a feature of Windows that allows administrators to manage and enforce settings for users and computers in a domain. By using Group Policy, an administrator can create a policy that blocks or disables PowerShell for all users except for a particular group, such as administrators. This policy can be applied to all computers in the domain or to specific organizational units. This method is more effective and manageable than uninstalling PowerShell, monitoring event logs, providing user education, or blocking PowerShell via HIDS. Verified References:
✑ https://www.windowscentral.com/how-disable-powershell-windows-10
✑ https://learn.microsoft.com/en-us/answers/questions/195218/how-to-restrict- powershell-for-all-users-except-fo
✑ https://windowsloop.com/block-disable-powershell/

NEW QUESTION 6
In a shared responsibility model for PaaS, which of the following is a customer's responsibility?

• A. Network security
• B. Physical security
• C. OS security
• D. Host infrastructure

Answer: C

Explanation:
In a shared responsibility model for PaaS, the customer’s responsibility is OS security. PaaS stands for Platform as a Service, which is a cloud service model that provides a platform for customers to develop, run, and manage applications without having to deal with the underlying infrastructure. The cloud provider is responsible for the physical security, network security, and host infrastructure of the platform, while the customer is responsible for the security of the operating system, the application, and the data. The customer needs to ensure that the operating system is patched, configured, and protected from malware and unauthorized access. Verified References:
https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
https://www.techtarget.com/searchcloudcomputing/feature/The-cloud-shared-responsibility-model-for-Iaa
https://www.splunk.com/en_us/blog/learn/shared-responsibility-model.html

NEW QUESTION 7
A security architect for a large, multinational manufacturer needs to design and implement a security solution to monitor traffic.
When designing the solution, which of the following threats should the security architect focus on to prevent attacks against the network?

• A. Packets that are the wrong size or length
• B. Use of any non-DNP3 communication on a DNP3 port
• C. Multiple solicited responses over time
• D. Application of an unsupported encryption algorithm

Answer: C

NEW QUESTION 8
The goal of a Chief information Security Officer (CISO) providing up-to-date metrics to a bank’s risk committee is to ensure:

• A. Budgeting for cybersecurity increases year over year.
• B. The committee knows how much work is being done.
• C. Business units are responsible for their own mitigation.
• D. The bank is aware of the status of cybersecurity risks

Answer: A

NEW QUESTION 9
Company A acquired Company B. During an initial assessment, the companies discover they are using the same SSO system. To help users with the transition, Company A is requiring the following:
• Before the merger is complete, users from both companies should use a single set of usernames and passwords.
• Users in the same departments should have the same set of rights and privileges, but they should have different sets of rights and privileges if they have different IPs.
• Users from Company B should be able to access Company A's available resources. Which of the following are the BEST solutions? (Select TWO).

• A. Installing new Group Policy Object policies
• B. Establishing one-way trust from Company B to Company A
• C. Enabling multifactor authentication
• D. Implementing attribute-based access control
• E. Installing Company A's Kerberos systems in Company B's network
• F. Updating login scripts

Answer: BD

Explanation:
Establishing one-way trust from Company B to Company A would allow users from Company B to access Company A’s resources using their existing credentials. Implementing attribute-based access control would allow users to have different sets of rights and privileges based on their attributes, such as department and IP address. Verified References:
https://www.cloudflare.com/learning/access-management/what-is-sso/
https://frontegg.com/blog/a-complete-guide-to-implementing-single-sign-on
https://learn.microsoft.com/en-us/host-integration-server/esso/enterprise-single-sign-on-basics

NEW QUESTION 10
A vulnerability assessment endpoint generated a report of the latest findings. A security analyst needs to review the report and create a priority list of items that must be addressed. Which of the following should the analyst use to create the list quickly?

• A. Business impact rating
• B. CVE dates
• C. CVSS scores
• D. OVAL

Answer: A

NEW QUESTION 11
A security engineer has been informed by the firewall team that a specific Windows workstation is part of a command-and-control network. The only information the security engineer is receiving is that the traffic is occurring on a non-standard port (TCP 40322). Which of the following commands should the security engineer use FIRST to find the malicious process?

• A. tcpdump
• B. netstar
• C. tasklist
• D. traceroute
• E. ipconfig

Answer: B

Explanation:

Netstat is a command-line tool that can be used to find the malicious process that is using a specific port on a Windows workstation. Netstat displays active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6 protocols). To find the process that is using a specific port, such as TCP 40322, the security engineer can use the following command:
netstat -ano | findstr :40322
This command will filter the netstat output by the port number and show the process identifier (PID) of the process that is using that port. The security engineer can then use the task manager or another tool to identify and terminate the malicious process by its PID. Verified References:
✑ https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
✑ https://www.howtogeek.com/28609/how-can-i-tell-what-is-listening-on-a-tcpip-port- in-windows/

NEW QUESTION 12
A security architect needs to implement a CASB solution for an organization with a highly distributed remote workforce. One Of the requirements for the implementation includes the capability to discover SaaS applications and block access to those that are unapproved or identified as risky. Which of the following would BEST achieve this objective?

• A. Deploy endpoint agents that monitor local web traffic to enforce DLP and encryption policies.
• B. Implement cloud infrastructure to proxy all user web traffic to enforce DI-P and encryption policies.
• C. Implement cloud infrastructure to proxy all user web traffic and control access according to centralized policy.
• D. Deploy endpoint agents that monitor local web traffic and control access according to centralized policy.

Answer: C

Explanation:
The best way to achieve the objective of discovering SaaS applications and blocking access to unapproved or identified as risky ones is to implement cloud infrastructure to proxy all user web traffic and control access according to centralized policy (C). This solution would allow the security architect to inspect all web traffic and enforce access control policies centrally. This solution also allows the security architect to detect and block risky SaaS applications.
Reference: CompTIA Advanced Security Practitioner (CASP+) Study Guide: Chapter 1:
Network Security Architecture and Design, Section 1.3: Cloud Security.

NEW QUESTION 13
A cloud security engineer is setting up a cloud-hosted WAF. The engineer needs to implement a solution to protect the multiple websites the organization hosts. The organization websites are:
* www.mycompany.org
* www.mycompany.com
* campus.mycompany.com
* wiki. mycompany.org
The solution must save costs and be able to protect all websites. Users should be able to notify the cloud security engineer of any on-path attacks. Which of the following is the BEST solution?

• A. Purchase one SAN certificate.
• B. Implement self-signed certificates.
• C. Purchase one certificate for each website.
• D. Purchase one wildcard certificate.

Answer: D

Explanation:
Purchasing one wildcard certificate is the best solution to protect multiple websites hosted by an organization in a cloud-hosted WAF. A wildcard certificate is a type of SSL/TLS certificate that can secure a domain name and any number of its subdomains with a single certificate. For example, a wildcard certificate for *.mycompany.com can secure www.mycompany.com, campus.mycompany.com, and any other subdomain under mycompany.com. A wildcard certificate can save costs and simplify management compared to purchasing individual certificates for each website.
References: [CompTIA CASP+ Study Guide, Second Edition, page 301]

NEW QUESTION 14
A security analyst needs to recommend a remediation to the following threat:

Which of the following actions should the security analyst propose to prevent this successful exploitation?

• A. Patch the system.
• B. Update the antivirus.
• C. Install a host-based firewall.
• D. Enable TLS 1.2.

Answer: D

NEW QUESTION 15
A company is on a deadline to roll out an entire CRM platform to all users at one time. However, the company is behind schedule due to reliance on third-party vendors. Which of the following development approaches will allow the company to begin releases but also continue testing and development for future releases?

• A. Implement iterative software releases.
• B. Revise the scope of the project to use a waterfall approach
• C. Change the scope of the project to use the spiral development methodolog
• D. Perform continuous integration.

Answer: A

NEW QUESTION 16
Device event logs sources from MDM software as follows:

Which of the following security concerns and response actions would BEST address the risks posed by the device in the logs?

• A. Malicious installation of an application; change the MDM configuration to remove application ID 1220.
• B. Resource leak; recover the device for analysis and clean up the local storage.
• C. Impossible travel; disable the device’s account and access while investigating.
• D. Falsified status reporting; remotely wipe the device.

Answer: C

Explanation:
The device event logs show that the device was in two different locations (New York and London) within a short time span (one hour), which indicates impossible travel. This could be a sign of a compromised device or account. The best response action is to disable the device’s account and access while investigating the incident. Malicious installation of an application is not evident from the logs, nor is resource leak or falsified status reporting. Verified References: https://www.comptia.org/blog/what-is-impossible- travel https://partners.comptia.org/docs/default-source/resources/casp-content-guide

NEW QUESTION 17
As part of the customer registration process to access a new bank account, customers are required to upload a number of documents, including their passports and driver’s licenses. The process also requires customers to take a current photo of themselves to be compared against provided documentation.
Which of the following BEST describes this process?

• A. Deepfake
• B. Know your customer
• C. Identity proofing
• D. Passwordless

Answer: C

Explanation:
Reference: https://auth0.com/blog/what-is-identity-proofing-and-why-does-it-matter/

NEW QUESTION 18
A managed security provider (MSP) is engaging with a customer who was working through a complete digital transformation Part of this transformation involves a move to cloud servers to ensure a scalable, high-performance, online user experience The current architecture includes:
• Directory servers
• Web servers
• Database servers
• Load balancers
• Cloud-native VPN concentrator
• Remote access server
The MSP must secure this environment similarly to the infrastructure on premises Which of the following should the MSP put in place to BEST meet this objective? (Select THREE)

• A. Content delivery network
• B. Virtual next-generation firewall
• C. Web application firewall
• D. Software-defined WAN
• E. External vulnerability scans
• F. Containers
• G. Microsegmentation

Answer: BCG

Explanation:
A virtual next-generation firewall (vNGFW) is a software version of a NGFW that can be deployed on cloud servers to provide advanced network security features. A vNGFW can help secure the cloud environment similarly to the infrastructure on premises by providing functions such as URL filtering, SSL/TLS inspection, deep packet inspection, antivirus, IPS, application control, and sandboxing. A web application firewall (WAF) is a device or software that filters and blocks malicious web traffic from reaching an application. A WAF can help secure the web servers in the cloud environment by protecting them from common attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). Microsegmentation is a technique that divides a network into smaller segments or zones based on criteria such as identity, role, or function. Microsegmentation can help secure the cloud environment by isolating different types of servers and applying granular security policies to each segment.
A content delivery network (CDN) is a distributed system of servers that delivers web content to users based on their geographic location, the origin of the content, and the performance of the network. A CDN can help improve the availability and performance of web applications by caching content closer to the users, reducing latency and bandwidth consumption. However, a CDN does not provide the same level of security as a vNGFW or a WAF. Software-defined WAN (SD-WAN) is a technology that uses software to manage the connectivity and routing of wide area network (WAN) traffic across multiple links or carriers. SD-WAN can help improve the reliability and efficiency of WAN connections by
dynamically selecting the best path for each application based on factors such as bandwidth, latency, cost, and quality of service (QoS). However, SD-WAN does not provide the same level of security as a vNGFW or a WAF. External vulnerability scans are assessments that identify and report on the vulnerabilities and weaknesses of an IT system from an external perspective. External vulnerability scans can help improve the security posture of an IT system by providing visibility into its exposure to potential threats. However, external vulnerability scans do not provide the same level of protection as a vNGFW or a WAF. Containers are units of software that package an application and its dependencies into a standardized format that can run on any platform or environment. Containers can help improve the portability and scalability of applications by allowing them to run independently from the underlying infrastructure. However, containers do not provide the same level of security as microsegmentation. References: [CompTIA Advanced Security Practitioner (CASP+) Certification Exam Objectives], Domain 2: Enterprise Security Architecture, Objective 2.3: Implement solutions for the secure use of cloud services

NEW QUESTION 19
The Chief information Officer (CIO) of a large bank, which uses multiple third-party organizations to deliver a service, is concerned about the handling and security of customer data by the parties. Which of the following should be implemented to BEST manage the risk?

• A. Establish a review committee that assesses the importance of suppliers and ranks them according to contract renewal
• B. At the time of contract renewal, incorporate designs and operational controls into the contracts and a right-to-audit claus
• C. Regularly assess the supplier’s post-contract renewal with a dedicated risk management team.
• D. Establish a team using members from first line risk, the business unit, and vendor management to assess only design security controls of all supplier
• E. Store findings from the reviews in a database for all other business units and risk teams to reference.
• F. Establish an audit program that regularly reviews all suppliers regardless of the data they access, how they access the data, and the type of data, Review all design and operational controls based on best practice standard and report the finding back to upper management.
• G. Establish a governance program that rates suppliers based on their access to data, the type of data, and how they access the data Assign key controls that are reviewed andmanaged based on the supplier’s ratin
• H. Report finding units that rely on the suppliers and the various risk teams.

Answer: D

Explanation:
A governance program that rates suppliers based on their access to data, the type of data, and how they access the data is the best way to manage the risk of handling and security of customer data by third parties. This allows the company to assign key controls that are reviewed and managed based on the supplier’s rating and report findings to the relevant units and risk teams. Verified References: https://www.comptia.org/training/books/casp-cas-004-study-guide , https://www.isaca.org/resources/isaca-journal/issues/2018/volume-1/third-party-risk- management

NEW QUESTION 20
......