High Quality CompTIA CAS-004 Practice Exam Online

NEW QUESTION 1
An organization mat provides a SaaS solution recently experienced an incident involving customer data loss. The system has a level of sell-healing that includes monitoring performance and available resources. When me system detects an issue, the self-healing process is supposed to restart pans of me software.
During the incident, when me self-healing system attempted to restart the services,
available disk space on the data drive to restart all the services was inadequate. The self- healing system did not detect that some services did not fully restart and declared me system as fully operational. Which of the following BEST describes me reason why the silent failure occurred?

• A. The system logs rotated prematurely.
• B. The disk utilization alarms are higher than what me service restarts require.
• C. The number of nodes in me self-healing cluster was healthy,
• D. Conditional checks prior to the service restart succeeded.

Answer: D

NEW QUESTION 2
A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.
Which of the following actions would BEST address the potential risks by the activity in the logs?

• A. Alerting the misconfigured service account password
• B. Modifying the AllowUsers configuration directive
• C. Restricting external port 22 access
• D. Implementing host-key preferences

Answer: B

Explanation:
Reference: https://www.rapid7.com/blog/post/2017/10/04/how-to-secure-ssh-server-using- port-knocking-on-ubuntu-linux/
The AllowUsers configuration directive is an option for SSH servers that specifies which users are allowed to log in using SSH. The directive can include usernames, hostnames, IP addresses, or patterns. The directive can also be negated with a preceding exclamation mark (!) to deny access to specific users.
The logs show that there are multiple failed login attempts from different IP addresses using different usernames, such as root, admin, test, etc. This indicates a brute-force attack that is trying to guess the SSH credentials. To address this risk, the security analyst should modify the AllowUsers configuration directive to only allow specific users or hosts that are authorized to access the SSH jump server. This will prevent unauthorized users from attempting to log in using SSH and reduce the attack surface. References: https://man.openbsd.org/sshd_config#AllowUsers
https://www.ssh.com/academy/ssh/brute-force

NEW QUESTION 3
An organization is deploying a new, online digital bank and needs to ensure availability and performance. The cloud-based architecture is deployed using PaaS and SaaS solutions, and it was designed with the following considerations:
- Protection from DoS attacks against its infrastructure and web applications is in place.
- Highly available and distributed DNS is implemented.
- Static content is cached in the CDN.
- A WAF is deployed inline and is in block mode.
- Multiple public clouds are utilized in an active-passive architecture.
With the above controls in place, the bank is experiencing a slowdown on the unauthenticated payments page. Which of the following is the MOST likely cause?

• A. The public cloud provider is applying QoS to the inbound customer traffic.
• B. The API gateway endpoints are being directly targeted.
• C. The site is experiencing a brute-force credential attack.
• D. A DDoS attack is targeted at the CDN.

Answer: A

NEW QUESTION 4
The Chief Security Officer (CSO) requested the security team implement technical controls that meet the following requirements:
* Monitors traffic to and from both local NAS and cloud-based file repositories
* Prevents on-site staff who are accessing sensitive customer Pll documents on file repositories from accidentally or deliberately sharing sensitive documents on personal Saa$S solutions
* Uses document attributes to reduce false positives
* Is agentless and not installed on staff desktops or laptops
Which of the following when installed and configured would BEST meet the CSO's requirements? (Select TWO).

• A. DLP
• B. NGFW
• C. UTM
• D. UEBA
• E. CASB
• F. HIPS

Answer: AE

Explanation:
DLP, or data loss prevention, and CASB, or cloud access security broker, are the solutions that when installed and configured would best meet the CSO’s requirements. DLP is a technology that monitors and prevents unauthorized or accidental data leakage or exfiltration from an organization’s network or devices. DLP can use document attributes, such as metadata, keywords, or fingerprints, to identify and classify sensitive data and enforce policies on how they can be accessed, transferred, or shared. CASB is a technology that acts as a proxy or intermediary between an organization’s cloud
services and its users. CASB can provide visibility, compliance, threat protection, and data security for cloud-based applications and data. CASB can also prevent on-site staff from accessing personal SaaS solutions that are not authorized by the organization. References: [CompTIA CASP+ Study Guide, Second Edition, pages 281-282 and 424-425]

NEW QUESTION 5
A SaaS startup is maturing its DevSecOps program and wants to identify weaknesses earlier in the development process in order to reduce the average time to identify serverless application vulnerabilities and the costs associated with remediation The startup began its early security testing efforts with DAST to cover public-facing application components and recently implemented a bug bounty program Which of the following will BEST accomplish the company's objectives?

• A. RASP
• B. SAST
• C. WAF
• D. CMS

Answer: B

Explanation:
Static application security testing (SAST) is a method of analyzing the source code of an application for vulnerabilities and weaknesses before it is deployed. SAST can help identify security issues earlier in the development process, reducing the time and cost of remediation. Dynamic application security testing (DAST) is a method of testing the functionality and behavior of an application at runtime for vulnerabilities and weaknesses. DAST can cover public-facing application components, but it cannot detect issues in the source code or in serverless applications. Runtime application self-protection (RASP) is a technology that monitors and protects an application from attacks in real time by embedding security features into the application code or runtime environment. RASP can help prevent exploitation of vulnerabilities, but it cannot identify or fix them. A web application firewall (WAF) is a device or software that filters and blocks malicious web traffic from reaching an application. A WAF can help protect an application from common attacks, but it cannot detect or fix vulnerabilities in the application code or in serverless applications. References: [CompTIA Advanced Security Practitioner (CASP+) Certification Exam Objectives], Domain 3: Enterprise Security Operations, Objective 3.4: Conduct security assessments using appropriate tools

NEW QUESTION 6
A significant weather event caused all systems to fail over to the disaster recovery site successfully. However, successful data replication has not occurred in the last six months, which has resulted in the service being unavailable. V•Vh1ch of the following would BEST prevent this scenario from happening again?

• A. Performing routine tabletop exercises
• B. Implementing scheduled, full interruption tests
• C. Backing up system log reviews
• D. Performing department disaster recovery walk-throughs

Answer: B

NEW QUESTION 7
A security engineer performed an assessment on a recently deployed web application. The engineer was able to exfiltration a company report by visiting the following URL:
www.intranet.abc.com/get-files.jsp?file=report.pdf
Which of the following mitigation techniques would be BEST for the security engineer to recommend?

• A. Input validation
• B. Firewall
• C. WAF
• D. DLP

Answer: A

Explanation:
Input validation is a technique that checks the user input for any errors, malicious data, or unexpected values before processing it by the application. Input validation can prevent many common web application attacks, such as:
✑ SQL injection, which exploits a vulnerability in the application’s database query to execute malicious SQL commands.
✑ Cross-site scripting (XSS), which injects malicious JavaScript code into the application’s web page to execute on the client-side browser.
✑ Directory traversal, which accesses files or directories outside of the intended scope by manipulating the file path.
In this case, the security engineer should recommend input validation as the best mitigation technique, because it would:
✑ Prevent the exfiltration of a company report by validating the file parameter in the
URL and ensuring that it matches a predefined list of allowed files or formats.
✑ Enhance the security of the web application by filtering out any malicious or invalid input from users or attackers.
✑ Be more effective and efficient than other techniques, such as firewall, WAF (Web Application Firewall), or DLP (Data Loss Prevention), which may not be able to detect or block all types of web application attacks.

NEW QUESTION 8
Which of the following represents the MOST significant benefit of implementing a passwordless authentication solution?

• A. Biometric authenticators are immutable.
• B. The likelihood of account compromise is reduced.
• C. Zero trust is achieved.
• D. Privacy risks are minimized.

Answer: B

Explanation:
Reference: https://cloudworks.no/en/5-benefits-of-passwordless-authentication/

NEW QUESTION 9
The Chief information Security Officer (CISO) of a small locate bank has a compliance requirement that a third-party penetration test of the core banking application must be conducted annually. Which of the following services would fulfill the compliance requirement with the LOWEST resource usage?

• A. Black-box testing
• B. Gray-box testing
• C. Red-team hunting
• D. White-box testing
• E. Blue-learn exercises

Answer: C

NEW QUESTION 10
A user from the sales department opened a suspicious file attachment. The sales department then contacted the SOC to investigate a number of unresponsive systems, and the team successfully identified the file and the origin of the attack.
Which of the following is t he NEXT step of the incident response plan?

• A. Remediation
• B. Containment
• C. Response
• D. Recovery

Answer: B

Explanation:
Reference: https://www.sciencedirect.com/topics/computer-science/containment-strategy

NEW QUESTION 11
A software development company is building a new mobile application for its social media platform. The company wants to gain its Users' rust by reducing the risk of on-path attacks between the mobile client and its servers and
by implementing stronger digital trust. To support users’ trust, the company has released the following internal guidelines:
* Mobile clients should verify the identity of all social media servers locally.
* Social media servers should improve TLS performance of their certificate status.
* Social media servers should inform the client to only use HTTPS.
Given the above requirements, which of the following should the company implement? (Select TWO).

• A. Quick UDP internet connection
• B. OCSP stapling
• C. Private CA
• D. DNSSEC
• E. CRL
• F. HSTS
• G. Distributed object model

Answer: BF

Explanation:
OCSP stapling and HSTS are the best options to meet the requirements of reducing the risk of on-path attacks and implementing stronger digital trust. OCSP stapling allows the
social media servers to improve TLS performance by sending a signed certificate status along with the certificate, eliminating the need for the client to contact the CA separately. HSTS allows the social media servers to inform the client to only use HTTPS and prevent downgrade attacks.

NEW QUESTION 12
A company suspects a web server may have been infiltrated by a rival corporation. The security engineer reviews the web server logs and finds the following:

The security engineer looks at the code with a developer, and they determine the log entry is created when the following line is run:

Which of the following is an appropriate security control the company should implement?

• A. Restrict directory permission to read-only access.
• B. Use server-side processing to avoid XSS vulnerabilities in path input.
• C. Separate the items in the system call to prevent command injection.
• D. Parameterize a query in the path variable to prevent SQL injection.

Answer: C

Explanation:
The company using the wrong port is the most likely root cause of why secure LDAP is not working. Secure LDAP is a protocol that provides secure communication between clients and servers using LDAP (Lightweight Directory Access Protocol), which is a protocol that allows querying and modifying directory services over TCP/IP. Secure LDAP uses SSL (Secure Sockets Layer) or TLS (Transport Layer Security) to encrypt LDAP traffic and prevent unauthorized disclosure or interception.

NEW QUESTION 13
A company Is adopting a new artificial-intelligence-based analytics SaaS solution. This Is the company's first attempt at using a SaaS solution, and a security architect has been asked to determine any future risks. Which of the following would be the GREATEST risk In adopting this solution?

• A. The inability to assign access controls to comply with company policy
• B. The inability to require the service provider process data in a specific country
• C. The inability to obtain company data when migrating to another service
• D. The inability to conduct security assessments against a service provider

Answer: C

NEW QUESTION 14
A consultant needs access to a customer's cloud environment. The customer wants to enforce the following engagement requirements:
• All customer data must remain under the control of the customer at all times.
• Third-party access to the customer environment must be controlled by the customer.
• Authentication credentials and access control must be under the customer's control.
Which of the following should the consultant do to ensure all customer requirements are satisfied when accessing the cloud environment?

• A. use the customer's SSO with read-only credentials and share data using the customer's provisioned secure network storage
• B. use the customer-provided VDI solution to perform work on the customer's environment.
• C. Provide code snippets to the customer and have the customer run code and securely deliver its output
• D. Request API credentials from the customer and only use API calls to access the customer's environmen

Answer: B

Explanation:
The consultant should use the customer-provided VDI solution to perform work on the customer’s environment. VDI stands for virtual desktop infrastructure, which is a technology that allows users to access a virtual desktop hosted on a remote server. VDI can help meet the customer’s requirements by ensuring that all customer data remains under the customer’s control at all times, that third-party access to the customer environment is controlled by the customer, and that authentication credentials and access control are under the customer’s control. Verified References:
https://www.kaspersky.com/resource-center/threats/how-to-avoid-social-engineering-attacks
https://www.eccouncil.org/cybersecurity-exchange/ethical-hacking/understanding-preventing-social-engin
https://www.indusface.com/blog/10-ways-businesses-can-prevent-social-engineering-attacks/

NEW QUESTION 15
During a phishing exercise, a few privileged users ranked high on the failure list. The enterprise would like to ensure that privileged users have an extra security-monitoring control in place. Which of the following Is the MOST
likely solution?

• A. A WAF to protect web traffic
• B. User and entity behavior analytics
• C. Requirements to change the local password
• D. A gap analysis

Answer: B

Explanation:
User and entity behavior analytics (UEBA) is the best solution to monitor and detect unusual or malicious activity by privileged users who failed the phishing exercise. UEBA uses machine learning and behavioral analytics to establish a baseline of normal activity and identify anomalies that indicate potential threats. UEBA can help detect compromised credentials, insider threats, and advanced persistent threats that may evade traditional security solutions. The other options are either irrelevant or less effective for the given scenario.

NEW QUESTION 16
A company is moving most of its customer-facing production systems to the cloud-facing production systems to the cloud. IaaS is the service model being used. The Chief Executive Officer is concerned about the type of encryption available and requires the solution must have the highest level of security.
Which of the following encryption methods should the cloud security engineer select during the implementation phase?

• A. Instance-based
• B. Storage-based
• C. Proxy-based
• D. Array controller-based

Answer: B

Explanation:
We recommend that you encrypt your virtual hard disks (VHDs) to help protect your boot volume and data volumes at rest in storage, along with your encryption keys and secrets. Azure Disk Encryption helps you encrypt your Windows and Linux IaaS virtual machine disks. Azure Disk Encryption uses the industry-standard BitLocker feature of Windows and the DM-Crypt feature of Linux to provide volume encryption for the OS and the data disks. The solution is integrated with Azure Key Vault to help you control and manage the disk-encryption keys and secrets in your key vault subscription. The solution also ensures that all data on the virtual machine disks are encrypted at rest in Azure Storage. https://docs.microsoft.com/en-us/azure/security/fundamentals/iaas

NEW QUESTION 17
An application developer is including third-party background security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is released to the public, report come In that a previously vulnerability has returned. Which of the following should the developer integrate into the process to BEST prevent this type of behavior?

• A. Peer review
• B. Regression testing
• C. User acceptance
• D. Dynamic analysis

Answer: A

NEW QUESTION 18
An HVAC contractor requested network connectivity permission to remotely support/troubleshoot equipment issues at a company location. Currently, the company does not have a process that allows vendors remote access to the corporate network Which of the following solutions represents the BEST course of action to allow the contractor access?

• A. Add the vendor's equipment to the existing network Give the vendor access through the standard corporate VPN
• B. Give the vendor a standard desktop PC to attach the equipment to Give the vendor access through the standard corporate VPN
• C. Establish a certification process for the vendor Allow certified vendors access to the VDI to monitor and maintain the HVAC equipment
• D. Create a dedicated segment with no access to the corporate network Implement dedicated VPN hardware for vendor access

Answer: D

NEW QUESTION 19
A security engineer estimates the company’s popular web application experiences 100 attempted breaches per day. In the past four years, the company’s data has been breached two times.
Which of the following should the engineer report as the ARO for successful breaches?

• A. 0.5
• B. 8
• C. 50
• D. 36,500

Answer: A

Explanation:
Reference: https://blog.netwrix.com/2020/07/24/annual-loss-expectancy-and-quantitative- risk-analysis/
The ARO (annualized rate of occurrence) for successful breaches is the number of times an event is expected to occur in a year. To calculate the ARO for successful breaches, the engineer can divide the number of breaches by the number of years. In this case, the company’s data has been breached two times in four years, so the ARO is 2 / 4 = 0.5. The other options are incorrect calculations. Verified References: https://www.comptia.org/blog/what-is-risk-management https://partners.comptia.org/docs/default-source/resources/casp-content-guide

NEW QUESTION 20
......