CompTIA CompTIA Certifications CAS-003 Questions & Answers

• Question 241:

  A large industrial system's smart generator monitors the system status and sends alerts to third-party maintenance personnel when critical failures occur. While reviewing the network logs, the company's security manager notices the generator's IP is sending packets to an internal file server's IP. Which of the following mitigations would be BEST for the security manager to implement while maintaining alerting capabilities?

  A. Segmentation

  B. Firewall whitelisting

  C. Containment

  D. Isolation

  Correct Answer: A

• Question 242:

  The SOC is reviewing processes and procedures after a recent incident. The review indicates it took more than 30 minutes to determine that quarantining an infected host was the best course of action. This allowed the malware to spread to additional hosts before it was contained. Which of the following would BEST to improve the incident response process?

  A. Updating the playbook with better decision points

  B. Dividing the network into trusted and untrusted zones

  C. Providing additional end-user training on acceptable use

  D. Implementing manual quarantining of infected hosts

  Correct Answer: C

• Question 243:

  Which of the following may indicate a configuration item has reached end-of-life?

  A. The device will no longer turn on and indicated an error.

  B. The vendor has not published security patches recently.

  C. The object has been removed from the Active Directory.

  D. Logs show a performance degradation of the component.

  Correct Answer: B

• Question 244:

  Which of the following attacks can be mitigated by proper data retention policies?

  A. Dumpster diving

  B. Man-in-the browser

  C. Spear phishing

  D. Watering hole

  Correct Answer: A

• Question 245:

  An organization is struggling to differentiate threats from normal traffic and access to systems. A security engineer has been asked to recommend a system that will aggregate data and provide metrics that will assist in identifying malicious actors or other anomalous activity throughout the environment. Which of the following solutions should the engineer recommend?

  A. Web application firewall

  B. SIEM

  C. IPS

  D. UTM

  E. File integrity monitor

  Correct Answer: B

• Question 246:

  Which of the following attacks can be used to exploit a vulnerability that was created by untrained users?

  A. A spear-phishing email with a file attachment

  B. A DoS using IoT devices

  C. An evil twin wireless access point

  D. A domain hijacking of a bank website

  Correct Answer: A

• Question 247:

  A smart switch has the ability to monitor electrical levels and shut off power to a building in the event of power surge or other fault situation. The switch was installed on a wired network in a hospital and is monitored by the facilities department via a cloud application. The security administrator isolated the switch on a separate VLAN and set up a patching routine. Which of the following steps should also be taken to harden the smart switch?

  A. Set up an air gap for the switch.

  B. Change the default password for the switch.

  C. Place the switch in a Faraday cage.

  D. Install a cable lock on the switch.

  Correct Answer: B

• Question 248:

  A financial institution would like to store its customer data in a cloud but still allow the data to be accessed and manipulated while encrypted. Doing so would prevent the cloud service provider from being able to decipher the data due to its sensitivity. The financial institution is not concerned about computational overheads and slow speeds. Which of the following cryptographic techniques would BEST meet the requirement?

  A. Asymmetric

  B. Symmetric

  C. Homomorphic

  D. Ephemeral

  Correct Answer: A

• Question 249:

  A Chief Information Security Officer (CISO) needs to create a policy set that meets international standards for data privacy and sharing. Which of the following should the CISO read and understand before writing the policies?

  A. PCI DSS

  B. GDPR

  C. NIST

  D. ISO 31000

  Correct Answer: B

• Question 250:

  A government contracting company issues smartphones to employees to enable access to corporate resources. Several employees will need to travel to a foreign country for business purposes and will require access to their phones. However, the company recently received intelligence that its intellectual property is highly desired by the same country's government. Which of the following MDM configurations would BEST reduce the risk of compromise while on foreign soil?

  A. Disable firmware OTA updates.

  B. Disable location services.

  C. Disable push notification services.

  D. Disable wipe

  Correct Answer: B