CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 201:

  A breach was caused by an insider threat in which customer PII was compromised. Following the breach, a lead security analyst is asked to determine which vulnerabilities the attacker used to access company resources. Which of the following should the analyst use to remediate the vulnerabilities?

  A. Protocol analyzer
  B. Root cause analysis
  C. Behavioral analytics
  D. Data leak prevention
  D. Data leak prevention

• Question 202:

  An application developer is including third-party background security fixes in an application. The fixes seem to resolve a currently identified security issue. However, when the application is released to the public, report come In that a previously vulnerability has returned. Which of the following should the developer integrate into the process to BEST prevent this type of behavior?

  A. Peer review
  B. Regression testing
  C. User acceptance
  D. Dynamic analysis
  A. Peer review

• Question 203:

  Which of the following technologies prevents an unauthorized HBA from viewing iSCSI target information?

  A. Deduplication
  B. Data snapshots
  C. LUN masking
  D. Storage multipaths
  C. LUN masking

  ---

  A logical unit number (LUN) is a unique identifier that designates individual hard disk devices or grouped devices for address by a protocol associated with a SCSI, iSCSI, Fibre Channel (FC) or similar interface. LUNs are central to the management of block storage arrays shared over a storage area network (SAN).

  LUN masking subdivides access to a given port. Then, even if several LUNs are accessed through the same port, the server masks can be set to limit each server's access to the appropriate LUNs. LUN masking is typically conducted at the host bus adapter (HBA) or switch level.

• Question 204:

  Company XYZ finds itself using more cloud-based business tools, and password management is becoming onerous. Security is important to the company; as a result, password replication and shared accounts are not acceptable. Which of the following implementations addresses the distributed login with centralized authentication and has wide compatibility among SaaS vendors?

  A. Establish a cloud-based authentication service that supports SAML.
  B. Implement a new Diameter authentication server with read-only attestation.
  C. Install a read-only Active Directory server in the corporate DMZ for federation.
  D. Allow external connections to the existing corporate RADIUS server.
  A. Establish a cloud-based authentication service that supports SAML.

  ---

  There is widespread adoption of SAML standards by SaaS vendors for single sign-on identity management, in response to customer demands for fast, simple and secure employee, customer and partner access to applications in their environments.

  By eliminating all passwords and instead using digital signatures for authentication and authorization of data access, SAML has become the Gold Standard for single sign-on into cloud applications. SAML-enabled SaaS applications are easier and quicker to user provision in complex enterprise environments, are more secure and help simplify identity management across large and diverse user communities.

  Security Assertion Markup Language (SAML) is an XML-based, open-standard data format for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider.

  The SAML specification defines three roles: the principal (typically a user), the Identity provider (IdP), and the service provider (SP). In the use case addressed by SAML, the principal requests a service from the service provider. The service provider requests and obtains an identity assertion from the identity provider. On the basis of this assertion, the service provider can make an access control decision ?in other words it can decide whether to perform some service for the connected principal.

• Question 205:

  A security analyst is reviewing logs and discovers that a company-owned computer issued to an employee is generating many alerts and analyst continues to review the log events and discovers that a non-company-owned device from a different, unknown IP address is general same events. The analyst informs the manager of these finding, and the manager explains that these activities are already known and . . . ongoing simulation. Given this scenario, which of the following roles are the analyst, the employee, and the manager fillings?

  A. The analyst is red team The employee is blue team The manager is white team
  B. The analyst is white team The employee is red team The manager is blue team
  C. The analyst is red team The employee is white team The manager is blue team
  D. The analyst is blue team The employee is red team The manager is white team
  D. The analyst is blue team The employee is red team The manager is white team

• Question 206:

  A Chief Information Security Officer (CISO) recently changed jobs into a new industry. The CISO's first task is to write a new, relevant risk assessment for the organization. Which of the following help to the CISO find relevant risks to the organization? (Choose two.)

  A. Perform a penetration test.
  B. Conduct a regulatory audit.
  C. Hire a third-party consultant.
  D. Define the threat model.
  E. Review the existing BIA.
  F. Perform an attack path analysis.
  C. Hire a third-party consultant.
  E. Review the existing BIA.

• Question 207:

  A network engineer is upgrading the network perimeter and installing a new firewall, IDS, and external edge router. The IDS is reporting elevated UDP traffic, and the internal routers are reporting high utilization. Which of the following is the BEST solution?

  A. Reconfigure the firewall to block external UDP traffic.
  B. Establish a security baseline on the IDS.
  C. Block echo reply traffic at the firewall.
  D. Modify the edge router to not forward broadcast traffic.
  B. Establish a security baseline on the IDS.

• Question 208:

  A recent assessment identified that several users' mobile devices are running outdated versions of endpoint security software that do not meet the company's security policy. Which of the following should be performed to ensure the users can access the network and meet the company's security requirements?

  A. Vulnerability assessment
  B. Risk assessment
  C. Patch management
  D. Device quarantine
  E. Incident management
  C. Patch management

• Question 209:

  The government is concerned with remote military missions being negatively being impacted by the use of technology that may fail to protect operational security. To remediate this concern, a number of solutions have been implemented, including the following:

  1.

  End-to-end encryption of all inbound and outbound communication, including personal email and chat sessions that allow soldiers to securely communicate with families.

  2.

  Layer 7 inspection and TCP/UDP port restriction, including firewall rules to only allow TCP port 80 and 443 and approved applications

  3.

  A host-based whitelist of approved websites and applications that only allow mission-related tools and sites

  4.

  The use of satellite communication to include multiple proxy servers to scramble the source IP address

  Which of the following is of MOST concern in this scenario?

  A. Malicious actors intercepting inbound and outbound communication to determine the scope of the mission
  B. Family members posting geotagged images on social media that were received via email from soldiers
  C. The effect of communication latency that may negatively impact real-time communication with mission control
  D. The use of centrally managed military network and computers by soldiers when communicating with external parties
  B. Family members posting geotagged images on social media that were received via email from soldiers

• Question 210:

  A security analyst is reviewing weekly email reports and finds an average of 1.000 emails received daily from the internal security alert email address. Which of the following should be implemented?

  A. Tuning the network monitoring service
  B. Separation of duties for systems administrators
  C. Machine learning algorithms
  D. DoS attack prevention
  D. DoS attack prevention

  ---

  Reference: https://www.mimecast.com/bloq/what-is-dos-attack-and-how-to-Drevent-it/