[Nov-2024] CAS-004 Exam Dumps, CAS-004 Practice Test Questions
Attested CAS-004 Dumps PDF Resource [2024]
NEW QUESTION # 120
Company A acquired Company B. During an initial assessment, the companies discover they are using the same SSO system. To help users with the transition, Company A is requiring the following:
* Before the merger is complete, users from both companies should use a single set of usernames and passwords.
* Users in the same departments should have the same set of rights and privileges, but they should have different sets of rights and privileges if they have different IPs.
* Users from Company B should be able to access Company A's available resources.
Which of the following are the BEST solutions? (Select TWO).
- A. Enabling multifactor authentication
- B. Updating login scripts
- C. Installing Company A's Kerberos systems in Company B's network
- D. Establishing one-way trust from Company B to Company A
- E. Implementing attribute-based access control
- F. Installing new Group Policy Object policies
Answer: D,E
Explanation:
Establishing one-way trust from Company B to Company A would allow users from Company B to access Company A's resources using their existing credentials. Implementing attribute-based access control would allow users to have different sets of rights and privileges based on their attributes, such as department and IP address. Verified Reference:
https://www.cloudflare.com/learning/access-management/what-is-sso/
https://frontegg.com/blog/a-complete-guide-to-implementing-single-sign-on
https://learn.microsoft.com/en-us/host-integration-server/esso/enterprise-single-sign-on-basics
NEW QUESTION # 121
A company provides guest WiFi access to the internet and physically separates the guest network from the company's internal WIFI. Due to a recent incident in which an attacker gained access to the compay's intend WIFI, the company plans to configure WPA2 Enterprise in an EAP- TLS configuration. Which of the following must be installed on authorized hosts for this new configuration to work properly?
- A. Active Directory OPOs
- B. NAC persistent agent
- C. PKI certificates
- D. Host-based firewall
Answer: C
NEW QUESTION # 122
Leveraging cryptographic solutions to protect data that is in use ensures the data is encrypted:
- A. by an enterprise hardware security module.
- B. when it is passed across a local network.
- C. when it is written to a system's solid-state drive.
- D. in memory during processing
Answer: D
NEW QUESTION # 123
A hospital is using a functional magnetic resonance imaging (fMRI) scanner, which is controlled legacy desktop connected to the network.
The manufacturer of the fMRI will not support patching of the legacy system.
The legacy desktop needs to be network accessible on TCP port 445.
A security administrator is concerned the legacy system will be vulnerable to exploits.
Which of the following would be the BEST strategy to reduce the risk of an outage while still providing for security?
- A. Segment the network and configure a controlled interface
- B. Enable application whitelisting and disable SMB.
- C. Apply only critical security patches for known vulnerabilities.
- D. Install HIDS and disable unused services.
Answer: A
NEW QUESTION # 124
A security engineer was auditing an organization's current software development practice and discovered that multiple open-source libraries were Integrated into the organization's software. The organization currently performs SAST and DAST on the software it develops.
Which of the following should the organization incorporate into the SDLC to ensure the security of the open-source libraries?
- A. Implement the SDLC security guidelines.
- B. Track the library versions and monitor the CVE website for related vulnerabilities.
- C. Perform unit testing of the open-source libraries.
- D. Perform additional SAST/DAST on the open-source libraries.
Answer: B
NEW QUESTION # 125
A company wants to quantify and communicate the effectiveness of its security controls but must establish measures. Which of the following is MOST likely to be included in an effective assessment roadmap for these controls?
- A. Develop a communication plan.
- B. Perform a security control assessment.
- C. Create a change management process.
- D. Establish key performance indicators.
- E. Create an integrated master schedule.
Answer: E
NEW QUESTION # 126
After a security incident, a network security engineer discovers that a portion of the company's sensitive external traffic has been redirected through a secondary ISP that is not normally used.
Which of the following would BEST secure the routes while allowing the network to function in the event of a single provider failure?
- A. Disable BGP and implement OSPF.
- B. Implement an inbound BGP prefix list.
- C. Disable BGP and implement a single static route for each internal network.
- D. Implement a BGP route reflector.
Answer: D
NEW QUESTION # 127
Which of the following risks does expanding business into a foreign country carry?
- A. Data sovereignty laws could result in unexpected liability
- B. Data ownership might revert to the regulatory entities in the new country
- C. Some security tools might be monitored by legal authorities
- D. Export controls might decrease software costs
Answer: A
NEW QUESTION # 128
A healthcare system recently suffered from a ransomware incident. As a result, the board of directors decided to hire a security consultant to improve existing network security. The security consultant found that the healthcare network was completely flat, had no privileged access limits, and had open RDP access to servers with personal health information. As the consultant builds the remediation plan, which of the following solutions would BEST solve these challenges?
(Choose three.)
- A. Network segmentation
- B. MFA
- C. BGP
- D. PAM
- E. Remote access VPN
- F. NAC
- G. SD-WAN
Answer: A,B,D
Explanation:
B: PAM (Privileged Access Management): This solution would help limit privileged access to the network and ensure that only authorized users can access sensitive information.
D: MFA (Multi-Factor Authentication): This solution would add an additional layer of security to prevent unauthorized access to the network.
E: Network Segmentation: This solution would help isolate different parts of the network and reduce the attack surface by creating distinct security zones for different types of resources, such as servers containing personal health information.
NEW QUESTION # 129
A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented in order to meet contractual requirements, the company must achieve the following thresholds
* 99 99% uptime
* Load time in 3 seconds
* Response time = <1 0 seconds
Starting with the computing environment, which of the following should a security engineer recommend to BEST meet the requirements? (Select THREE)
- A. Lowering storage input/output
- B. Utilizing redundant power for all developer workstations
- C. Employing bare-metal loading of applications
- D. Ensuring technological diversity on critical servers
- E. Implementing server clusters
- F. Implementing RAID on the backup servers
- G. Installing a firewall at corporate headquarters
- H. Deploying a content delivery network
Answer: A,E,H
Explanation:
To meet the contractual requirements of the web service provider, a security engineer should recommend the following actions:
* Deploying a content delivery network (CDN): A CDN is a distributed system of servers that delivers
* web content to users based on their geographic location, the origin of the content, and the performance of the network. A CDN can help improve the uptime, load time, and response time of web services by caching content closer to the users, reducing latency and bandwidth consumption. A CDN can also help mitigate distributed denial-of-service (DDoS)attacks by absorbing or filtering malicious traffic before it reaches the origin servers, reducing the impact on the web service availability12.
* Implementing server clusters: A server cluster is a group of servers that work together to provide high availability, scalability, and load balancing for web services. A server cluster can help improve the uptime, load time, and response time of web services by distributing the workload across multiple servers, reducing the risk of single points of failure and performance bottlenecks. A server cluster can also help recover from failures by automatically switching to another server in case of a malfunction34.
* Lowering storage input/output (I/O): Storage I/O is the amount of data that can be read from or written to a storage device in a given time. Storage I/O can affect the performance of web services by limiting the speed of data transfer between the servers and the storage devices. Lowering storage I/O can help improve the load time and response time of web services by reducing the latency and congestion of data access. Lowering storage I/O can be achieved by using faster storage devices, such as solid-state drives (SSDs), optimizing the storage layout and configuration, such as using RAID or striping, and caching frequently accessed data in memory5 .
Installing a firewall at corporate headquarters is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. A firewall is a device or software that filters and blocks unwanted network traffic based on predefined rules. A firewall can help improve the security of web services by preventing unauthorized access and attacks, but it may also introduce additional latency and complexity to the network.
Employing bare-metal loading of applications is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. Bare-metal loading is a technique that allows applications to run directly on hardware without an operating system or a hypervisor. Bare-metal loading can help improve the performance and efficiency of applications by eliminating the overhead and interference of other software layers, but it may also increase the difficulty and cost of deployment and maintenance.
Implementing RAID on the backup servers is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. RAID (redundant array of independent disks) is a technique that combines multiple disks into a logical unit that provides improved performance, reliability, or both. RAID can help improve the availability and security of backup data by protecting it from disk failures or corruption, but it may also introduce additional complexity and overhead to the backup process.
Utilizing redundant power for all developer workstations is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. Redundant power is a technique that provides multiple sources of power for an IT system in case one fails. Redundant power can help improve the availability and reliability of developer workstations by preventing them from losing power due to outages or surges, but it may also increase the cost and energy consumption of the system.
Ensuring technological diversity on critical servers is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services.
Technological diversity is a technique that uses different types of hardware, software, or platforms in an IT environment. Technological diversity can help improve resilience by reducing single points of failure and increasing compatibility, but it may also introduce additional complexity and inconsistency to the environment. References: What Is CDN? How Does CDN Work? | Imperva, What Is Server Clustering? | IBM, What Is Server Clustering? | IBM, Server Clustering: What It Is & How It Works | Liquid Web, Storage I/O Performance - an overview | ScienceDirect Topics, [How to Improve Storage I/O Performance | StarWind Blog], [What Is Firewall Security? | Cisco], [What is Bare Metal? | IBM], [What is RAID? | Dell Technologies US], [What Is Redundant Power Supply? | Dell Technologies US], [Technological Diversity - an overview | ScienceDirect Topics]
NEW QUESTION # 130
A company hired a third party to develop software as part of its strategy to be quicker to market. The company's policy outlines the following requirements:
The credentials used to publish production software to the container registry should be stored in a secure location.
Access should be restricted to the pipeline service account, without the ability for the third-party developer to read the credentials directly.
Which of the following would be the BEST recommendation for storing and monitoring access to these shared credentials?
- A. Local secure password file
- B. TPM
- C. MFA
- D. Key vault
Answer: D
NEW QUESTION # 131
A security analyst is investigating a series of suspicious emails by employees to the security team. The email appear to come from a current business partner and do not contain images or URLs. No images or URLs were stripped from the message by the security tools the company uses instead, the emails only include the following in plain text.
Which of the following should the security analyst perform?
- A. Pull the devices of the affected employees from the network in case they are infected with a zero-day virus.
- B. Configure the email gateway to automatically quarantine all messages originating from the business partner.
- C. Contact the security department at the business partner and alert them to the email event.
- D. Block the IP address for the business partner at the perimeter firewall.
Answer: C
NEW QUESTION # 132
An enterprise is undergoing an audit to review change management activities when promoting code to production. The audit reveals the following:
* Some developers can directly publish code to the production environment.
* Static code reviews are performed adequately.
* Vulnerability scanning occurs on a regularly scheduled basis per policy.
Which of the following should be noted as a recommendation within the audit report?
- A. Implement short maintenance windows.
- B. Implement job rotation.
- C. Improve separation of duties.
- D. Perform periodic account reviews.
Answer: C
NEW QUESTION # 133
A company security engineer arrives at work to face the following scenario:
1) Website defacement
2) Calls from the company president indicating the website needs to be fixed Immediately because It Is damaging the brand
3) A Job offer from the company's competitor
4) A security analyst's investigative report, based on logs from the past six months, describing how lateral movement across the network from various IP addresses originating from a foreign adversary country resulted in exfiltrated data Which of the following threat actors Is MOST likely involved?
- A. APT/nation-state
- B. Competitor
- C. Organized crime
- D. Script kiddie
Answer: A
Explanation:
An Advanced Persistent Threat (APT) is an attack that is targeted, well-planned, and conducted over a long period of time by a nation-state actor. The evidence provided in the scenario indicates that the security analyst has identified a foreign adversary, which is strong evidence that an APT/nation-state actor is responsible for the attack. Resources:
CompTIA Advanced Security Practitioner (CASP+) Study Guide, Chapter 5: "Advanced Persistent Threats," Wiley, 2018. https://www.wiley.com/en-us/CompTIA+Advanced+Security+Practitioner+CASP%2B+Study+Guide%2C+2nd+Edition-p-9781119396582
NEW QUESTION # 134
A company that uses AD is migrating services from LDAP to secure LDAP. During the pilot phase, services are not connecting properly to secure LDAP. Block is an except of output from the troubleshooting session:
Which of the following BEST explains why secure LDAP is not working? (Select TWO.)
- A. The clients may not trust idapt by default.
- B. Secure LDAP should be running on UDP rather than TCP.
- C. Secure LDAP does not support wildcard certificates.
- D. The secure LDAP service is not started, so no connections can be made.
- E. The company is using the wrong port. It should be using port 389 for secure LDAP.
- F. The clients may not trust Chicago by default.
- G. Danvills.com is under a DDoS-inator attack and cannot respond to OCSP requests.
Answer: D,E
NEW QUESTION # 135
A security analyst needs to recommend a remediation to the following threat:
Which of the following actions should the security analyst propose to prevent this successful exploitation?
- A. Enable TLS 1.2.
- B. Install a host-based firewall.
- C. Update the antivirus.
- D. Patch the system.
Answer: A
NEW QUESTION # 136
A company is outsourcing to an MSSP that performs managed detection and response services. The MSSP requires a server to be placed inside the network as a log aggregate and allows remote access to MSSP analyst.
Critical devices send logs to the log aggregator, where data is stored for 12 months locally before being archived to a multitenant cloud. The data is then sent from the log aggregate to a public IP address in the MSSP datacenter for analysis.
A security engineer is concerned about the security of the solution and notes the following.
* The critical devise send cleartext logs to the aggregator.
* The log aggregator utilize full disk encryption.
* The log aggregator sends to the analysis server via port 80.
* MSSP analysis utilize an SSL VPN with MFA to access the log aggregator remotely.
* The data is compressed and encrypted prior to being achieved in the cloud.
Which of the following should be the engineer's GREATEST concern?
- A. Hardware vulnerabilities introduced by the log aggregate server
- B. Network bridging from a remote access VPN
- C. Encryption of data in transit
- D. Multinancy and data remnants in the cloud
Answer: C
Explanation:
Encryption of data in transit should be the engineer's greatest concern regarding the security of the solution.
Data in transit refers to data that is being transferred over a network or between devices. If data in transit is not encrypted, it can be intercepted, modified, or stolen by attackers who can exploit vulnerabilities in the network protocols or devices. The solution in the question sends logs from the critical devices to the aggregator in cleartext and from the aggregator to the analysis server via port 80, which are both insecure methods that expose the data to potential attacks. Verified References:
https://www.comptia.org/training/books/casp-cas-004-study-guide ,https://us-cert.cisa.gov/ncas/tips/ST04-019
NEW QUESTION # 137
A security is assisting the marketing department with ensuring the security of the organization's social media platforms. The two main concerns are:
The Chief marketing officer (CMO) email is being used department wide as the username The password has been shared within the department Which of the following controls would be BEST for the analyst to recommend?
- A. Ensue the password being shared is sufficiently and not written down anywhere.
- B. Have periodic, scheduled reviews to determine which OAuth configuration are set for each media platform.
- C. Configure MFA for all users to decrease their reliance on other authentication.
- D. Create multiple social media accounts for all marketing user to separate their actions.
Answer: C
NEW QUESTION # 138
To save time, a company that is developing a new VPN solution has decided to use the OpenSSL library within Its proprietary software. Which of the following should the company consider to maximize risk reduction from vulnerabilities introduced by OpenSSL?
- A. Implement an ongoing, third-party software and library review and regression testing.
- B. Compile third-party libraries into the main code statically instead of using dynamic loading.
- C. Ensure the third-party library implements the TLS and disable weak ciphers.
- D. Include stable, long-term releases of third-party libraries instead of using newer versions.
Answer: A
Explanation:
Implementing an ongoing, third-party software and library review and regression testing is the best way to maximize risk reduction from vulnerabilities introduced by OpenSSL. Third-party software and libraries are often used by developers to save time and resources, but they may also introduce security risks if they are not properly maintained and updated. By reviewing and testing the third-party software and library regularly, the company can ensure that they are using the latest and most secure version of OpenSSL, and that their proprietary software is compatible and functional with it.
NEW QUESTION # 139
A pharmaceutical company recently experienced a security breach within its customer-facing web portal. The attackers performed a SQL injection attack and exported tables from the company's managed database, exposing customer information.
The company hosts the application with a CSP utilizing the IaaS model. Which of the following parties is ultimately responsible for the breach?
- A. The web portal software vendor
- B. The database software vendor
- C. The pharmaceutical company
- D. The cloud software provider
Answer: C
NEW QUESTION # 140
A host on a company's network has been infected by a worm that appears to be spreading via SMB. A security analyst has been tasked with containing the incident while also maintaining evidence for a subsequent investigation and malware analysis.
Which of the following steps would be best to perform FIRST?
- A. Modify the smb.conf file of the host to prevent outgoing SMB connections.
- B. Run a full anti-malware scan on the infected host.
- C. Turn off the infected host immediately.
- D. Isolate the infected host from the network by removing all network connections.
Answer: D
Explanation:
Isolating the infected host is almost always the answer when asked "What to do first" after a breach/infection has occurred.
NEW QUESTION # 141
An organization thinks that its network has active, malicious activity on it. Which of the following capabilities would BEST help to expose the adversary?
- A. Performing a penetration test
- B. Installing a honeypot and other decoys
- C. Enumerating asset configurations
- D. Expanding SOC functions to include hunting
Answer: B
NEW QUESTION # 142
A security architect is tasked with scoping a penetration test that will start next month. The architect wants to define what security controls will be impacted. Which of the following would be the BEST document to consult?
- A. Master service agreement
- B. Statement of work
- C. Rules of engagement
- D. Target audience
Answer: B
NEW QUESTION # 143
......
Latest CAS-004 Actual Free Exam Questions Updated 445 Questions: https://www.itcertmagic.com/CompTIA/real-CAS-004-exam-prep-dumps.html
Free CAS-004 Exam Braindumps certification guide Q&A: https://drive.google.com/open?id=1cOsuemrJZWJk04uOcUgEyNh9Qst-jirq