Free CAS-004 Exam Dumps Preview

A technician is reviewing the logs and notices a large number of files were transferred to remote sites over the course of three months. This activity then stopped. The files were transferred via TLS-protected HTTP sessions from systems that do not send traffic to those sites.

The technician will define this threat as:

Over the last 90 days, many storage services has been exposed in the cloud services environments, and the security team does not have the ability to see is creating these instance. Shadow IT is creating data services and instances faster than the small security team can keep up with them. The Chief information security Officer (CIASO) has asked the security officer (CISO) has asked the security lead architect to architect to recommend solutions to this problem.

Which of the following BEST addresses the problem best address the problem with the least amount of administrative effort?

A security engineer based in Iceland works in an environment requiring an on-premises and cloud-based storage solution. The solution should take into consideration the following:

1. The company has sensitive data.
2. The company has proprietary data.
3. The company has its headquarters in Iceland, and the data must always reside in that country.

Which cloud deployment model should be used?

A company wants to securely manage the APIs that were developed for its in-house applications. Previous penetration tests revealed that developers were embedding unencrypted passwords in the code.

Which of the following can the company do to address this finding? (Choose two.)

A security analyst is reviewing the following pseudo-output snippet after running the command less /tmp/ file,tmp.

The information above was obtained from a public-facing website and used to identify military assets.

Which of the following should be implemented to reduce the risk of a similar compromise?

A company wants to implement a new website that will be accessible via browsers with no mobile applications available. The new website will allow customers to submit sensitive medical information securely and receive online medical advice. The company already has multiple other websites where it provides various public health data and information. The new website must implement the following:

1. The highest form of web identity validation
2. Encryption of all web transactions
3. The strongest encryption in-transit
4. Logical separation based on data sensitivity

Other things that should be considered include:

1. The company operates multiple other websites that use encryption.
2. The company wants to minimize total expenditure.
3. The company wants to minimize complexity.

Which of the following should the company implement on its new website? (Choose two.)

An organization is deploying a container-based application that requires persistence of sensitive information on the filesystem. The filesystem will be deployed into a cloud environment. The information that will persist will include PHI (Protected Health Information).

Which of the following solutions would be best to ensure confidentiality of information at rest?

A home automation company just purchased and installed tools for its SOC to enable incident identification and response on software the company develops. The company would like to prioritize defenses against the following attack scenarios:
1. Unauthorized insertions into application development environments
2. Authorized insiders making unauthorized changes to environment configurations

Which of the following actions will enable the data feeds needed to detect these types of attacks on development environments? (Choose two.)

A security analyst is conducting an investigation regarding a potential insider threat. An unauthorized USB device might have been used to exfiltrate proprietary data from a Linux system.

Which of the following options would identify the IoCs and provide the appropriate response?

An analyst needs to evaluate all images and documents that are publicly shared on a website.

Which of the following would be the best tool to evaluate the metadata of these files?

A security engineer performed an assessment on a recently deployed web application. The engineer was able to exfiltrate a company report by visiting the following URL:

www.intranet.abc.com/get-files.jsp?

file=report.pdf Which of the following mitigation techniques would be BEST for the security engineer to recommend?

A security architect is implementing a web application that uses a database back end. Prior to the production, the architect is concerned about the possibility of XSS attacks and wants to identify security controls that could be put in place to prevent these attacks.

Which of the following sources could the architect consult to address this security concern?

A security engineer needs to ensure production containers are automatically scanned for vulnerabilities before they are accepted into the production environment.

Which of the following should the engineer use to automatically incorporate vulnerability scanning on every commit?

During the development process, the team identifies major components that need to be rewritten. As a result, the company hires a security consultant to help address major process issues.

Which of the following should the consultant recommend to best prevent these issues from reoccurring in the future?

Company A is merging with Company B. Company A is a small, local company. Company B has a large, global presence. The two companies have a lot of duplication in their IT systems processes, and procedures. On the new Chief Information Officer's (ClO's) first day, a fire breaks out at Company B's mam data center.

Which of the following actions should the CIO take first?

A financial institution has several that currently employ the following controls:

1. The severs follow a monthly patching cycle.
2. All changes must go through a change management process.
3. Developers and systems administrators must log into a jumpbox to access the servers hosting the data using two-factor authentication.
4. The servers are on an isolated VLAN and cannot be directly accessed from the internal production network.

An outage recently occurred and lasted several days due to an upgrade that circumvented the approval process. Once the security team discovered an unauthorized patch was installed, they were able to

resume operations within an hour.

Which of the following should the security administrator recommend to reduce the time to resolution if a similar incident occurs in the future?

A security engineer was auditing an organization's current software development practice and discovered that multiple open-source libraries were Integrated into the organization's software. The organization currently performs SAST and DAST on the software it develops.

Which of the following should the organization incorporate into the SDLC to ensure the security of the open-source libraries?

A company is migrating its data center to the cloud. Some hosts had been previously isolated, but a risk

assessment convinced the engineering team to reintegrate the systems. Because the systems were isolated, the risk associated with vulnerabilities was low.

Which of the following should the security team recommend be performed before migrating these servers to the cloud?

A security architect is advising the application team to implement the following controls in the application before it is released:

1. Least privilege
2. Blocklist input validation for the following characters: \<>;, ="#+

Based on the requirements, which of the following attacks is the security architect trying to prevent?

Which of the following is the best reason to maintain visibility into vendor supply chains?

A security solution uses a sandbox environment to execute zero-day software and collect indicators of compromise.

Which of the following should the organization do to BEST take advantage of this solution?

An online video shows a company's Chief Executive Officer (CEO) making a company announcement. The CEO, however, did not make the announcement.

Which of the following BEST describes this attack?

A company would like to move its payment card data to a cloud provider.

Which of the following solutions will best protect account numbers from unauthorized disclosure?

A development team created a mobile application that contacts a company's back-end APIs housed in a PaaS environment. The APIs have been experiencing high processor utilization due to scraping activities.
The security engineer needs to recommend a solution that will prevent and remedy the behavior.

Which of the following would BEST safeguard the APIs? (Choose two.)

In comparison to other types of alternative processing sites that may be invoked as a part of disaster recovery, cold sites are different because they:

An organization that develops military technology is considering expansion into a foreign country. The organization's owners want to understand the risks associated with such an expansion, and the organization does not want to fund an intensive assessment.

Which of the following approaches should be taken?

A company security engineer arrives at work to face the following scenario:
1. Website defacement
2. Calls from the company president indicating the website needs to be fixed Immediately because It Is
damaging the brand
3. A Job offer from the company's competitor

4. A security analyst's investigative report, based on logs from the past six months, describing how lateral
movement across the network from various IP addresses originating from a foreign adversary country resulted in exfiltrated data

Which of the following threat actors Is MOST likely involved?

Simulation

You are a security analyst tasked with interpreting an Nmap scan output from Company A's privileged network.

The company's hardening guidelines indicate the following:
1. There should be one primary server or service per device.
2. Only default ports should be used.
3. Non-secure protocols should be disabled.

INSTRUCTIONS

Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed. For each device found, add a device entry to the Devices Discovered list, with the following information:
1. The IP address of the device
2. The primary server or service of the device
3. The protocol(s) that should be disabled based on the hardening guidelines

To select multiple protocols, use CTRL+CLICK.

If at any time you would like to bring back the initial state of the simulation, please click the Reset
All button.

A security analyst detected a malicious PowerShell attack on a single server. The malware used the

Invoke-Expression function to execute an external malicious script. The security analyst scanned the disk with an antivirus application and did not find any IOCs. The security analyst now needs to deploy a protection solution against this type of malware.

Which of the following BEST describes the type of malware the solution should protect against?

The management team at a company with a large, aging server environment is conducting a server risk assessment in order to create a replacement strategy. The replacement strategy will be based upon the likelihood a server will fail, regardless of the criticality of the application running on a particular server.

Which of the following should be used to prioritize the server replacements?

A security analyst is investigating unapproved cloud services that are being used in the organization.

Which of the following would best allow for discovery of shadow IT?

In a shared responsibility model for PaaS, which of the following is a customer's responsibility?

A security analyst is evaluating all third-party software an organization uses. The analyst discovers that each department is violating the organization's policy by provisioning access to SaaS products without oversight from the security group and without using a centralized access control methodology.

Which of the following should the organization use to enforce its SaaS product access requirements?

A mobile device hardware manufacturer receives the following requirements from a company that wants to produce and sell a new mobile platform:

1. The platform should store biometric data.
2. The platform should prevent unapproved firmware from being loaded.
3. A tamper-resistant, hardware-based counter should track if unapproved firmware was loaded.

Which of the following should the hardware manufacturer implement? (Select three).

A company has instituted a new policy in which all outbound traffic must go over TCP ports 80 and 443 for all its managed mobile devices. No other IP traffic is allowed to be initiated from a device.

Which of the following should the organization consider implementing to ensure internet access continues without interruption?

A cyberanalyst has been tasked with recovering PDF files from a provided image file.

Which of the following is the BEST file-carving tool for PDF recovery?

A disaster recovery team learned of several mistakes that were made during the last disaster recovery parallel test. Computational resources ran out at 70% of restoration of critical services.

Which of the following should be modified to prevent the issue from reoccurring?

An internal user can send encrypted emails successfully to all recipients, except one. at an external organization.

When the internal user attempts to send encrypted emails to this external recipient, a security error message appears. The issue does not affect unencrypted emails. The external recipient can send encrypted emails to internal users.

Which of the following is the most likely cause of the issue?

A security engineer at a manufacturing facility is trying to determine whether any of the OT devices are susceptible to a recently announced vulnerability.

Which of the following is the best way for the engineer to detect exploitable vulnerabilities?

An IT department is currently working to implement an enterprise DLP solution. Due diligence and best practices must be followed in regard to mitigating risk.

Which of the following ensures that authorized modifications are well planned and executed?

A security is testing a server finds the following in the output of a vulnerability scan:

Which of the following will the security analyst most likely use NEXT to explore this further?

A user logged in to a web application. Later, a SOC analyst noticed the user logged in to systems after normal business hours. The end user confirms the log-ins after hours were unauthorized. Following an investigation, the SOC analyst determined that the web server was running an outdated version of OpenSSL. No other suspicious user log-ins were found.

Which of the following describes what happened and how to fix it?

A new web server must comply with new secure-by-design principles and PCI DSS. This includes mitigating the risk of an on-path attack. A security analyst is reviewing the following web server configuration:

Which of the following ciphers should the security analyst remove to support the business requirements?

A cybersecurity analyst created the following tables to help determine the maximum budget amount the business can justify spending on an improved email filtering system:

Which of the following meets the budget needs of the business?

A systems administrator is in the process of hardening the host systems before connecting to the network.
The administrator wants to add protection to the boot loader to ensure the hosts are secure before the OS fully boots.

Which of the following would provide the BEST boot loader protection?

A satellite communications ISP frequently experiences outages and degraded modes of operation over one of its legacy satellite links due to the use of deprecated hardware and software. Three days per week, on average, a contracted company must follow a checklist of 16 different high-latency commands that must be run in serial to restore nominal performance. The ISP wants this process to be automated.

Which of the following techniques would be BEST suited for this requirement?

A systems engineer is reviewing output from a web application vulnerability scan. The engineer has determined data is entenng the application from an untrusted source and is being used to construct a query dynamically.

Which of the following code snippets would BEST protect the application against an SQL injection attack?

A company is designing a new system that must have high security. This new system has the following requirements:

1. Permissions must be assigned based on role.
2. Fraud from a single person must be prevented.
3. A single entity must not have full access control.

Which of the following can the company use to meet these requirements?

A SOC analyst is reviewing malicious activity on an external, exposed web server. During the investigation, the analyst determines specific traffic is not being logged, and there is no visibility from the WAF for the web application.

Which of the following is the MOST likely cause?

After a cybersecurity incident, a judge found that a company did not conduct a proper forensic investigation. The company was ordered to pay penalties.

Which of the following forensic steps would be best to prevent this from happening again?

A customer requires secure communication of subscribed web services at all times, but the company currently signs its own certificate requests to an internal CA.

Which of the following approaches will best meet the customer's requirements?

A review of the past year's attack patterns shows that attackers stopped reconnaissance after finding a susceptible system to compromise. The company would like to find a way to use this information to protect the environment while still gaining valuable attack information.

Which of the following would be BEST for the company to implement?

A security architect is designing a solution for a new customer who requires significant security capabilities in its environment. The customer has provided the architect with the following set of requirements:

1. Capable of early detection of advanced persistent threats.
2. Must be transparent to users and cause no performance degradation.
3. Allow integration with production and development networks seamlessly.
4. Enable the security team to hunt and investigate live exploitation techniques.

Which of the following technologies BEST meets the customer's requirements for security capabilities?

A recent audit discovered that multiple employees had been using their badges to walk through the secured data center to get to the employee break room. Most of the employees were given access during a previous project, but the access was not removed in a timely manner when the project was complete.

Which of the following would reduce the likelihood of this scenario occurring again?

A high-severity vulnerability was found on a web application and introduced to the enterprise. The vulnerability could allow an unauthorized user to utilize an open-source library to view privileged user information. The enterprise is unwilling to accept the risk, but the developers cannot fix the issue right away.

Which of the following should be implemented to reduce the risk to an acceptable level until the issue can be fixed?

A development team needs terminal access to preproduction servers to verify settings and enter purchased license keys. To address the team's needs, the security administrator implements the following

requirements:

1. Only trusted accounts can access the preproduction servers.
2. Developers cannot access the preproduction servers directly from their workstations.
3. The trusted accounts should only have access to specific preproduction servers.

Which of the following are necessary to fulfill the security requirements? (Select two).

The general counsel at an organization has received written notice of upcoming litigation. The general counsel has issued a legal records hold.

Which of the following actions should the organization take to comply with the request?

A security team is concerned with attacks that are taking advantage of return-oriented programming against the company's public facing applications.

Which of the following should the company implement on the public-facing servers?

A pharmaceutical company uses a cloud provider to host thousands of independent resources in object storage. The company needs a practical and effective means of discovering data, monitoring changes, and identifying suspicious activity.

Which of the following would best meet these requirements?

A Chief Information Officer (CIO) wants to implement a cloud solution that will satisfy the following requirements:

1. Support all phases of the SDLC.
2. Use tailored website portal software.
3. Allow the company to build and use its own gateway software.
4. Utilize its own data management platform.
5. Continue using agent-based security tools.

Which of the following cloud-computing models should the CIO implement?

A company recently experienced a period of rapid growth, and it now needs to move to a more scalable cloud-based solution. Historically, salespeople have maintained separate systems for information on competing customers to prevent the inadvertent disclosure of one customer's information to another customer.

Which of the following would be the BEST method to provide secure data separation?

A network engineer is concerned about hosting web, SFTP. and email services in a single DMZ that is hosted in the same security zone This could potentially allow lateral movement within the environment.

Which of the following should the engineer implement to mitigate the risk?

The Chief information Officer (CIO) asks the system administrator to improve email security at the company based on the following requirements:

1. Transaction being requested by unauthorized individuals.
2. Complete discretion regarding client names, account numbers, and investment information.
3. Malicious attackers using email to malware and ransomeware.
4. Exfiltration of sensitive company information.

The cloud-based email solution will provide anti-malware reputation-based scanning, signature-based scanning, and sandboxing.

Which of the following is the BEST option to resolve the boar's concerns for this email migration?

A security engineer investigates an incident and determines that a rogue device is on the network. Further investigation finds that an employee's personal device has been set up to access company resources and does not comply with standard security controls.

Which of the following should the security engineer recommend to reduce the risk of future reoccurrence?

A security administrator at a global organization wants to update password complexity rules for a system containing personally identifiable information.

Which of the following would be the best resource for this information?

A company undergoing digital transformation is reviewing the resiliency of a CSP and is concerned about meeting SLA requirements in the event of a CSP incident.

Which of the following would be BEST to proceed with the transformation?

Simulation

As a security administrator, you are asked to harden a server running Red Hat Enterprise Server 5.5 64- bit.

This server is being used as a DNS and time server. It is not used as a database, web server, or print server. There are no wireless connections to the server, and it does not need to print.

The command window will be provided along with root access. You are connected via a secure shell with root access.

You may query help for a list of commands.

Instructions:

You need to disable and turn off unrelated services and processes.

It is possible to simulate a crash of your server session. The simulation can be reset, but the server cannot be rebooted.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

A company processes data subject to NDAs with partners that define the processing and storage constraints for the covered data. The agreements currently do not permit moving the covered data to the cloud, and the company would like to renegotiate the terms of the agreements.

Which of the following would MOST likely help the company gain consensus to move the data to the cloud?

All staff at a company have started working remotely due to a global pandemic. To transition to remote work, the company has migrated to SaaS collaboration tools. The human resources department wants to use these tools to process sensitive information but is concerned the data could be:

1. Leaked to the media via printing of the documents
2. Sent to a personal email address
3. Accessed and viewed by systems administrators
4. Uploaded to a file storage site

Which of the following would mitigate the department's concerns?

An organization is establishing a new software assurance program to vet applications before they are introduced into the production environment, Unfortunately. many Of the applications are provided only as compiled binaries.
Which Of the following should the organization use to analyze these applications?
(Select TWO).

A security administrator is confirming specific ports and IP addresses that are monitored by the IPS-IDS system as well as the firewall placement on the perimeter network between the company and a new business partner

Which of the following business documents defines the parameters the security administrator must confirm?

A security administrator configured the account policies per security implementation guidelines. However, the accounts still appear to be susceptible to brute-force attacks. The following settings meet the existing compliance guidelines:

1. Must have a minimum of 15 characters
2. Must use one number
3. Must use one capital letter
4. Must not be one of the last 12 passwords used

Which of the following policies should be added to provide additional security?

A security analyst for a managed service provider wants to implement the most up-to-date and effective security methodologies to provide clients with the best offerings.

Which of the following resources would the analyst MOST likely adopt?

A security analyst received a report that a suspicious flash drive was picked up in the office's waiting area, located beyond the secured door. The analyst investigated the drive and found malware designed to harvest and transmit credentials. Security cameras in the area where the flash drive was discovered showed a vendor representative dropping the drive.

Which of the following should the analyst recommend as an additional way to identify anyone who enters the building, in the event the camera system fails?

A technician accidentally deleted the secret key that was corresponding to the public key pinned to a busy online magazine. To remedy the situation, the technician obtained a new certificate with a different key.
However, paying subscribers were locked out of the website until the key-pinning policy expired.

Which of the following alternatives should the technician adopt to prevent a similar issue in the future?

A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP connections using the command line.

Which of the following commands would be the BEST to run to view only active Internet connections?

An organization is looking to establish more robust security measures by implementing PKI.

Which of the following should the security analyst implement when considering mutual authentication?

During a review of events, a security analyst notes that several log entries from the FIM system identify

changes to firewall rule sets. While coordinating a response to the FIM entries, the analyst receives alerts from the DLP system that indicate an employee is sending sensitive data to an external email address.

Which of the following would be the most relevant to review in order to gain a better understanding of whether these events are associated with an attack?

A company has identified a number of vulnerable, end-of-support systems with limited defensive capabilities.

Which of the following would be the first step in reducing the attack surface in this environment?

As part of the customer registration process to access a new bank account, customers are required to upload a number of documents, including their passports and driver's licenses. The process also requires customers to take a current photo of themselves to be compared against provided documentation.

Which of the following BEST describes this process?

A security technician is trying to connect a remote site to the central office over a site-to-site VPN. The technician has verified the source and destination IP addresses are correct, but the technician is unable to get the remote site to connect.
The following error message keeps repeating:

An error has occurred during Phase 1 handshake. Deleting keys and retrying...

Which of the following is most likely the reason the connection is failing?

A security architect is designing a solution for a new customer who requires significant security capabilities in its environment. The customer has provided the architect with the following set of requirements:

Capable of early detection of advanced persistent threats. Must be transparent to users and cause no performance degradation. Allow integration with production and development networks seamlessly. Enable the security team to hunt and investigate live exploitation techniques.

Which of the following technologies BEST meets the customer's requirements for security capabilities?

A security analyst notices a number of SIEM events that show the following activity:

Which of the following response actions should the analyst take FIRST?

While traveling to another state, the Chief Financial Officer (CFO) forgot to submit payroll for the company
The CFO quickly gained access to the corporate network through the high-speed wireless network provided by the hotel and completed the task. Upon returning from the business trip, the CFO was told no one received their weekly pay due to a malware attack on the system.

Which of the following is the MOST likely cause of the secunty breach?

An information security officer reviews a report and notices a steady increase in outbound network traffic over the past ten months. There is no clear explanation for the increase. The security officer interviews several business units and discovers an unsanctioned cloud storage provider was used to share marketing materials with potential customers.

Which of the following services would be BEST for the security officer to recommend to the company?

A security analyst is reading the results of a successful exploit that was recently conducted by third-party penetration testers. The testers reverse engineered a privileged executable. In the report, the planning and execution of the exploit is detailed using logs and outputs from the test However, the attack vector of the exploit is missing, making it harder to recommend remediation's. Given the following output:

The penetration testers MOST likely took advantage of:

A company recently deployed a SIEM and began importing logs from a firewall, a file server, a domain controller, a web server, and a laptop. A security analyst receives a series of SIEM alerts and prepares to respond. The following is the alert information:

Which of the following should the security analyst do FIRST?

An internal security audit determines that Telnet is currently being used within the environment to manage network switches.

Which of the following tools should be utilized to identify credentials in plaintext that are used to log in to these devices?

A company's finance department acquired a new payment system that exports data to an unencrypted file on the system. The company implemented controls on the file so only appropriate personnel are allowed access.

Which of the following risk techniques did the department use in this situation?

A company Is adopting a new artificial-intelligence-based analytics SaaS solution. This Is the company's first attempt at using a SaaS solution, and a security architect has been asked to determine any future risks.

Which of the following would be the GREATEST risk In adopting this solution?

A security analyst is reviewing SIEM events and is uncertain how to handle a particular event. The file is reviewed with the security vendor who is aware that this type of file routinely triggers this alert. Based on this information, the security analyst acknowledges this alert.

Which of the following event classifications is MOST likely the reason for this action?

Which of the following best describes a risk associated with using facial recognition to locally authenticate to a mobile device?

A company recently deployed new servers to create an additional cluster to support a new application. The corporate security policy states that all new servers must be resilient. The new cluster has a high-availability configuration for a smooth failover. The failover was successful following a recent power outage, but both clusters lost critical data, which impacted recovery time.

Which of the following needs to be configured to help ensure minimal delays when power outages occur in the future?

After establishing coding standards and integrating software assurance tools into CI/CD pipelines, an architect continues to find too many different coding styles throughout the team.

Which of the following additional measures can the architect take to help improve consistency?

A company hired a third-party consultant to run a cybersecurity incident simu-lation in order to identify security gaps and prepare stakeholders for a potential incident.

Which of the following best describes this activity?

A company has decided to purchase a license for software that is used to operate a mission-critical process. The third-party developer is new to the industry but is delivering what the company needs at this time.

Which of the following BEST describes the reason why utilizing a source code escrow will reduce the operational risk to the company if the third party stops supporting the application?

A web application server is running a legacy operating system with an unpatched RCE (Remote Code Execution) vulnerability. The server cannot be upgraded until the corresponding application code is updated.

Which of the following compensating controls would prevent successful exploitation?

An organization's load balancers have reached end of life and have a vulnerability that will require them to be replaced. The load balancers are scheduled to be decommissioned within the next month. The management team has decided not to resolve this risk and instead allow the load balancers to remain in place until their decommission date.

Which of the following risk handling techniques is the management team using?

An internal security assessor identified large gaps in a company's IT asset inventory system during a monthly asset review. The assessor is aware of an external audit that is underway. In an effort to avoid external findings, the assessor chooses not to report the gaps in the inventory system.

Which of the following legal considerations is the assessor directly violating?

A software development company needs to mitigate third-party risks to its software supply chain.

Which of the following techniques should the company use in the development environment to best meet this objective?