(Dec-2024) Latest CAS-005 Dumps for Success in Actual CompTIA Certified [Q21-Q35]

CAS-005 CompTIA

admin -

December 4, 2024

4.2/5 - (5 votes)

(Dec-2024) Latest CAS-005 Dumps for Success in Actual CompTIA Certified

Changing the Concept of CAS-005 Exam Preparation 2024

QUESTION 21
An audit finding reveals that a legacy platform has not retained loos for more than 30 days The platform has been segmented due to its interoperability with newer technology. As a temporary solution, the IT department changed the log retention to 120 days. Which of the following should the security engineer do to ensure the logs are being properly retained?

Configure a scheduled task nightly to save the logs

Configure event-based triggers to export the logs at a threshold.

Configure the SIEM to aggregate the logs

Configure a Python script to move the logs into a SQL database.

To ensure that logs from a legacy platform are properly retained beyond the default retention period, configuring the SIEM to aggregate the logs is the best approach. SIEM solutions are designed to collect, aggregate, and store logs from various sources, providing centralized log management and retention. This setup ensures that logs are retained according to policy and can be easily accessed for analysis and compliance purposes.
References:
* CompTIA SecurityX Study Guide: Discusses the role of SIEM in log management and retention.
* NIST Special Publication 800-92, “Guide to Computer Security Log Management”: Recommends the use of centralized log management solutions, such as SIEM, for effective log retention and analysis.
* “Security Information and Event Management (SIEM) Implementation” by David Miller: Covers best practices for configuring SIEM systems to aggregate and retain logs from various sources.

QUESTION 22
A security analyst is reviewing suspicious log-in activity and sees the following data in the SICM:

Which of the following is the most appropriate action for the analyst to take?

Update the log configuration settings on the directory server that Is not being captured properly.

Have the admin account owner change their password to avoid credential stuffing.

Block employees from logging in to applications that are not part of their business area.

implement automation to disable accounts that nave been associated with high-risk activity.

The log-in activity indicates a security threat, particularly involving the ADMIN account with a high-risk failure status. This suggests that the account may be targeted by malicious activities such as credential stuffing or brute force attacks.
* Updating log configuration settings (A) may help in better logging future activities but does not
* address the immediate threat.
* Changing the admin account password (B) is a good practice but may not fully mitigate the ongoing threat if the account has already been compromised.
* Blocking employees (C) from logging into non-business applications might help in reducing attack surfaces but doesn’t directly address the compromised account issue.
Implementing automation to disable accounts associated with high-risk activities ensures an immediate response to the detected threat, preventing further unauthorized access and allowing time for thorough investigation and remediation.
References:
* CompTIA SecurityX guide on incident response and account management.
* Best practices for handling compromised accounts.
* Automation tools and techniques for security operations centers (SOCs).

QUESTION 23
A senior security engineer flags me following log file snippet as hawing likely facilitated an attacker’s lateral movement in a recent breach:

Which of the following solutions, if implemented, would mitigate the nsk of this issue reoccurnnp?

Disabling DNS zone transfers

Restricting DNS traffic to UDP’W

Implementing DNS masking on internal servers

Permitting only clients from internal networks to query DNS

The log snippet indicates a DNS AXFR (zone transfer) request, which can be exploited by attackers to gather detailed information about an internal network’s infrastructure. Disabling DNS zone transfers is the best solution to mitigate this risk. Zone transfers should generally be restricted to authorized secondary DNS servers and not be publicly accessible, as they can reveal sensitive network information that facilitates lateral movement during an attack.
References:
* CompTIA SecurityX Study Guide: Discusses the importance of securing DNS configurations, including restricting zone transfers.
* NIST Special Publication 800-81, “Secure Domain Name System (DNS) Deployment Guide”:
Recommends restricting or disabling DNS zone transfers to prevent information leakage.

QUESTION 24
An organization mat performs real-time financial processing is implementing a new backup solution Given the following business requirements?
* The backup solution must reduce the risk for potential backup compromise
* The backup solution must be resilient to a ransomware attack.
* The time to restore from backups is less important than the backup data integrity
* Multiple copies of production data must be maintained
Which of the following backup strategies best meets these requirement?

Creating a secondary, immutable storage array and updating it with live data on a continuous basis

Utilizing two connected storage arrays and ensuring the arrays constantly sync

Enabling remote journaling on the databases to ensure real-time transactions are mirrored

Setting up antitempering on the databases to ensure data cannot be changed unintentionally

* A. Creating a secondary, immutable storage array and updating it with live data on a continuous basis: An immutable storage array ensures that data, once written, cannot be altered or deleted. This greatly reduces the risk of backup compromise and provides resilience against ransomware attacks, as the ransomware cannot modify or delete the backup data. Maintaining multiple copies of production data with an immutable storage solution ensures data integrity and compliance with the requirement for multiple copies.
Other options:
* B. Utilizing two connected storage arrays and ensuring the arrays constantly sync: While this ensures data redundancy, it does not provide protection against ransomware attacks, as both arrays could be compromised simultaneously.
* C. Enabling remote journaling on the databases: This ensures real-time transaction mirroring but does not address the requirement for reducing the risk of backup compromise or resilience to ransomware.
* D. Setting up anti-tampering on the databases: While this helps ensure data integrity, it does not provide a comprehensive backup solution that meets all the specified requirements.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-209, “Security Guidelines for Storage Infrastructure”
* “Immutable Backup Architecture” by Veeam

QUESTION 25
A security administrator needs to automate alerting. The server generates structured log files that need to be parsed to determine whether an alarm has been triggered Given the following code function:

Which of the following is most likely the log input that the code will parse?

The code function provided in the question seems to be designed to parse JSON formatted logs to check for an alarm state. Option A is a JSON format that matches the structure likely expected by the code. The presence of the “error_log” and “InAlarmState” keys suggests that this is the correct input format.

QUESTION 26
A security analyst Detected unusual network traffic related to program updating processes The analyst collected artifacts from compromised user workstations. The discovered artifacts were binary files with the same name as existing, valid binaries but. with different hashes which of the following solutions would most likely prevent this situation from reoccurring?

Improving patching processes

Implementing digital signature

Performing manual updates via USB ports

Allowing only dies from internal sources

Implementing digital signatures ensures the integrity and authenticity of software binaries. When a binary is digitally signed, any tampering with the file (e.g., replacing it with a malicious version) would invalidate the signature. This allows systems to verify the origin and integrity of binaries before execution, preventing the execution of unauthorized or compromised binaries.
* A. Improving patching processes: While important, this does not directly address the issue of verifying the integrity of binaries.
* B. Implementing digital signatures: This ensures that only valid, untampered binaries are executed, preventing attackers from substituting legitimate binaries with malicious ones.
* C. Performing manual updates via USB ports: This is not practical and does not scale well, especially in large environments.
* D. Allowing only files from internal sources: This reduces the risk but does not provide a mechanism to verify the integrity of binaries.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-57, “Recommendation for Key Management”
* OWASP (Open Web Application Security Project) guidelines on code signing

QUESTION 27
A hospital provides tablets to its medical staff to enable them to more quickly access and edit patients’ charts.
The hospital wants to ensure that if a tablet is Identified as lost or stolen and a remote command is issued, the risk of data loss can be mitigated within seconds. The tablets are configured as follows to meet hospital policy
* Full disk encryption is enabled
* “Always On” corporate VPN is enabled
* ef-use-backed keystore is enabled’ready.
* Wi-Fi 6 is configured with SAE.
* Location services is disabled.
*Application allow list is configured

Revoking the user certificates used for VPN and Wi-Fi access

Performing cryptographic obfuscation

Using geolocation to find the device

Configuring the application allow list to only per mil emergency calls

Returning on the device’s solid-state media to zero

To mitigate the risk of data loss on a lost or stolen tablet quickly, the most effective strategy is to return the device’s solid-state media to zero, which effectively erases all data on the device. Here’s why:
* Immediate Data Erasure: Returning the solid-state media to zero ensures that all data is wiped instantly, mitigating the risk of data loss if the device is lost or stolen.
* Full Disk Encryption: Even though the tablets are already encrypted, physically erasing the data
* ensures that no residual data can be accessed if someone attempts to bypass encryption.
* Compliance and Security: This method adheres to best practices for data security and compliance, ensuring that sensitive patient data cannot be accessed by unauthorized parties.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-88: Guidelines for Media Sanitization
* ISO/IEC 27002:2013 – Information Security Management

QUESTION 28
Company A acquired Company B and needs to determine how the acquisition will impact the attack surface of the organization as a whole. Which of the following is the best way to achieve this goal? (Select two).
Implementing DLP controls preventing sensitive data from leaving Company B’s network

Documenting third-party connections used by Company B

Reviewing the privacy policies currently adopted by Company B

Requiring data sensitivity labeling tor all files shared with Company B

Forcing a password reset requiring more stringent passwords for users on Company B’s network

Performing an architectural review of Company B’s network

To determine how the acquisition of Company B will impact the attack surface, the following steps are crucial:
A: Documenting third-party connections used by Company B: Understanding all external connections is essential for assessing potential entry points for attackers and ensuring that these connections are secure.
E: Performing an architectural review of Company B’s network: This review will identify vulnerabilities and assess the security posture of the acquired company’s network, providing a comprehensive understanding of the new attack surface.
These actions will provide a clear picture of the security implications of the acquisition and help in developing a plan to mitigate any identified risks.
References:
* CompTIA SecurityX Study Guide: Emphasizes the importance of understanding third-party connections and conducting architectural reviews during acquisitions.
* NIST Special Publication 800-37, “Guide for Applying the Risk Management Framework to Federal Information Systems”: Recommends comprehensive reviews and documentation of third-party connections.
* “Mergers, Acquisitions, and Other Restructuring Activities” by Donald DePamphilis: Discusses the importance of security assessments during acquisitions.

QUESTION 29
A security review revealed that not all of the client proxy traffic is being captured. Which of the following architectural changes best enables the capture of traffic for analysis?

Adding an additional proxy server to each segmented VLAN

Setting up a reverse proxy for client logging at the gateway

Configuring a span port on the perimeter firewall to ingest logs

Enabling client device logging and system event auditing

Configuring a span port on the perimeter firewall to ingest logs is the best architectural change to ensure that all client proxy traffic is captured for analysis. Here’s why:
* Comprehensive Traffic Capture: A span port (or mirror port) on the perimeter firewall can capture all inbound and outbound traffic, including traffic that might bypass the proxy. This ensures that all network traffic is available for analysis.
* Centralized Logging: By capturing logs at the perimeter firewall, the organization can centralize logging and analysis, making it easier to detect and investigate anomalies.
* Minimal Disruption: Implementing a span port is a non-intrusive method that does not require significant changes to the network architecture, thus minimizing disruption to existing services.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-92: Guide to Computer Security Log Management
* OWASP Logging Cheat Sheet

QUESTION 30
A security officer received several complaints from users about excessive MPA push notifications at night The security team investigates and suspects malicious activities regarding user account authentication Which of the following is the best way for the security officer to restrict MI~A notifications”

Provisioning FID02 devices

Deploying a text message based on MFA

Enabling OTP via email

Configuring prompt-driven MFA

Excessive MFA push notifications can be a sign of an attempted push notification attack, where attackers repeatedly send MFA prompts hoping the user will eventually approve one by mistake. To mitigate this:
* A. Provisioning FIDO2 devices: While FIDO2 devices offer strong authentication, they may not be practical for all users and do not directly address the issue of excessive push notifications.
* B. Deploying a text message-based MFA: SMS-based MFA can still be vulnerable to similar spamming attacks and phishing.
* C. Enabling OTP via email: Email-based OTPs add another layer of security but do not directly solve the issue of excessive notifications.
* D. Configuring prompt-driven MFA: This option allows users to respond to prompts in a secure manner, often including features like time-limited approval windows, additional verification steps, or requiring specific actions to approve. This can help prevent users from accidentally approving malicious attempts.
Configuring prompt-driven MFA is the best solution to restrict unnecessary MFA notifications and improve security.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-63B, “Digital Identity Guidelines”
* “Multi-Factor Authentication: Best Practices” by Microsoft

QUESTION 31
After an incident occurred, a team reported during the lessons-learned review that the team.
* Lost important Information for further analysis.
* Did not utilize the chain of communication
* Did not follow the right steps for a proper response
Which of the following solutions is the best way to address these findinds?

Requesting budget for better forensic tools to Improve technical capabilities for Incident response operations

Building playbooks for different scenarios and performing regular table-top exercises

Requiring professional incident response certifications tor each new team member

Publishing the incident response policy and enforcing it as part of the security awareness program

Building playbooks for different scenarios and performing regular table-top exercises directly addresses the issues identified in the lessons-learned review. Here’s why:
* Lost important information for further analysis: Playbooks outline step-by-step procedures for incident response, ensuring that team members know exactly what to document and how to preserve evidence.
* Did not utilize the chain of communication: Playbooks include communication protocols, specifying who to notify and when. Regular table-top exercises reinforce these communication channels, ensuring they are followed during actual incidents.
* Did not follow the right steps for a proper response: Playbooks provide a clear sequence of actions to be taken during various types of incidents, helping the team to respond in a structured and effective manner. Regular exercises allow the team to practice these steps, identifying and correcting any deviations from the plan.
Investing in better forensic tools (Option A) or requiring certifications (Option C) are also valuable, but they do not directly address the procedural and communication gaps identified. Publishing and enforcing the incident response policy (Option D) is important but not as practical and hands-on as playbooks and exercises in ensuring the team is prepared.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-61 Rev. 2, “Computer Security Incident Handling Guide”
* SANS Institute, “Incident Handler’s Handbook”

QUESTION 32
A security analyst reviews the following report:

Which of the following assessments is the analyst performing?

System

Supply chain

Quantitative

Organizational

The table shows detailed information about products, including location, chassis manufacturer, OS, application developer, and vendor. This type of information is typically assessed in a supply chain assessment to evaluate the security and reliability of components and services from different suppliers.
Why Supply Chain Assessment?
* Component Evaluation: Assessing the origin and security of each component used in the products, including hardware, software, and third-party services.
* Vendor Reliability: Evaluating the security practices and reliability of vendors involved in providing components or services.
* Risk Management: Identifying potential risks associated with the supply chain, such as vulnerabilities in third-party components or insecure development practices.
Other types of assessments do not align with the detailed supplier and component information provided:
* A. System: Focuses on individual system security, not the broader supply chain.
* C. Quantitative: Focuses on numerical risk assessments, not supplier information.
* D. Organizational: Focuses on internal organizational practices, not external suppliers.
References:
* CompTIA SecurityX Study Guide
* NIST Special Publication 800-161, “Supply Chain Risk Management Practices for Federal Information Systems and Organizations”
* “Supply Chain Security Best Practices,” Gartner Research

QUESTION 33

An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.

Explanation:
A computer screen shot of a diagram Description automatically generated

A screenshot of a computer error Description automatically generated

QUESTION 34
A security engineer performed a code scan that resulted in many false positives. The security engineer must find a solution that improves the quality of scanning results before application deployment. Which of the following is the best solution?

Limiting the tool to a specific coding language and tuning the rule set

Configuring branch protection rules and dependency checks

Using an application vulnerability scanner to identify coding flaws in production

Performing updates on code libraries before code development

To improve the quality of code scanning results and reduce false positives, the best solution is to limit the tool to a specific coding language and fine-tune the rule set. By configuring the code scanning tool to focus on the specific language used in the application, the tool can more accurately identify relevant issues and reduce the number of false positives. Additionally, tuning the rule set ensures that the tool’s checks are appropriate for the application’s context, further improving the accuracy of the scan results.
References:
* CompTIA SecurityX Study Guide: Discusses best practices for configuring code scanning tools, including language-specific tuning and rule set adjustments.
* “Secure Coding: Principles and Practices” by Mark G. Graff and Kenneth R. van Wyk: Highlights the importance of customizing code analysis tools to reduce false positives.
* OWASP (Open Web Application Security Project): Provides guidelines for configuring and tuning code scanning tools to improve accuracy.

QUESTION 35
A systems administrator wants to introduce a newly released feature for an internal application. The administrate docs not want to test the feature in the production environment. Which of the following locations is the best place to test the new feature?

Staging environment

Testing environment

CI/CO pipeline

Development environment

The best location to test a newly released feature for an internal application, without affecting the production environment, is the staging environment. Here’s a detailed explanation:
* Staging Environment: This environment closely mirrors the production environment in terms of hardware, software, configurations, and settings. It serves as a final testing ground before deploying changes to production. Testing in the staging environment ensures that the new feature will behave as expected in the actual production setup.
* Isolation from Production: The staging environment is isolated from production, which means any issues arising from the new feature will not impact the live users or the integrity of the production data.
This aligns with best practices in change management and risk mitigation.
* Realistic Testing: Since the staging environment replicates the production environment, it provides realistic testing conditions. This helps in identifying potential issues that might not be apparent in a development or testing environment, which often have different configurations and workloads.
* References:
* CompTIA Security+ SY0-601 Official Study Guide by Quentin Docter, Jon Buhagiar
* NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations

Loading …