CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 241:

  While traveling to another state, the Chief Financial Officer (CFO) forgot to submit payroll for the company The CFO quickly gained access to the corporate network through the high-speed wireless network provided by the hotel and

  completed the task. Upon returning from the business trip, the CFO was told no one received their weekly pay due to a malware attack on the system.

  Which of the following is the MOST likely cause of the secunty breach?

  A. The security manager did not enforce automatic VPN connection.
  B. The company's server did not have endpoint security enabled.
  C. The hotel did not require a wireless password to authenticate.
  D. The laptop did not have the host-based firewall properly configured.
  A. The security manager did not enforce automatic VPN connection.

• Question 242:

  The Chief Information Security Officer (CISO) of a new company is looking for a comprehensive assessment of the company's application services Which of the following would provide the MOST accurate number of weaknesses?

  A. White-box penetration test
  B. Internal vulnerability scanning
  C. Internal controls audit
  D. Third-party red-team engagement
  A. White-box penetration test

• Question 243:

  A security analyst has received the following requirements for the implementation of enterprise credential management software.

  1.

  The software must have traceability back to an individual

  2.

  Credentials must remain unknown to the vendor at all times

  3.

  There must be forced credential changes upon ID checkout

  4.

  Complexity requirements must be enforced.

  5.

  The software must be quickly and easily scalable with max mum availability

  Which of the following vendor configurations would BEST meet these requirements?

  A. Credentials encrypted in transit and then stored, hashed and salted in a vendor's cloud, where the vendor handles key management
  B. Credentials stored, hashed, and salted on each local machine
  C. Credentials encrypted in transit and stored in a vendor's cloud, where the enterprise retains the keys
  D. Credentials encrypted in transit and stored on an internal network server with backups that are taken on a weekly basis
  B. Credentials stored, hashed, and salted on each local machine

• Question 244:

  SIMULATION

  Check the answer in explanation.

  

  

  Please see the explanation below

  Step 1: Verify that the certificate is valid or not. In case of any warning message, cancel the download.

  Step 2: If certificate issue is not there then, download the file in your system.

  Step 3: Calculate the hash value of the downloaded file.

  Step 4: Match the hash value of the downloaded file with the one which you selected on the website.

  Step 5: Install the file if the hash value matches.

• Question 245:

  A company has deployed MFA Some employees, however, report they ate not gelling a notification on their mobile device Other employees report they downloaded a common authenticates application but when they tap the code in the application it just copies the code to memory instead of confirming the authentication attempt Which of the following are the MOST likely explanations for these scenarios? (Select TWO)

  A. The company is using a claims-based authentication system for MFA
  B. These are symptoms of known compatibility issues with OAuth 1 0
  C. OpenID Connect requires at least one factor to be a biometric
  D. The company does not allow an SMS authentication method
  E. The WAYF method requires a third factor before the authentication process can complete
  F. A vendor-specific authenticator application is needed for push notifications
  C. OpenID Connect requires at least one factor to be a biometric
  E. The WAYF method requires a third factor before the authentication process can complete

• Question 246:

  An application developer has been informed of a web application that is susceptible to a clickjacking vulnerability Which of the following code snippets would be MOST applicable to resolve this vulnerability?

  A. Content-Security-Policy frame-ancestors: 'none'
  B. $escaped_command = escapeshellcmd(Sargs); exec ($escaped_command, Soutput, $return_var);
  C. sqlQuery= 'SELECT * FROM custTable WHERE User=? AND Pass=?' parameters.add("User", username)
  D. require 'digest/sha2' sha256 = Digest::SHA2.new(256)
  A. Content-Security-Policy frame-ancestors: 'none'

  ---

  Content-Security-Policy: frame-ancestors 'none’;

  This prevents any domain from framing the content This setting is recommended unless a specific need has been identified for framing

• Question 247:

  A security analyst has been assigned incident response duties and must instigate the response on a Windows device that appears to be compromised. Which of the following commands should be executed on the client FIRST?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  A. Option A

• Question 248:

  IT staff within a company often conduct remote desktop sharing sessions with vendors to troubleshoot vendor product-related issues. Drag and drop the following security controls to match the associated security concern. Options may be used once or not at all.

  Select and Place:

  

  

  ---

  Vendor may accidentally or maliciously make changes to the IT system - Allow view-only access.

  With view-only access, the third party can view the desktop but cannot interact with it. In other words, they cannot control the keyboard or mouse to make any changes.

  Desktop sharing traffic may be intercepted by network attackers - Use SSL for remote sessions.

  SSL (Secure Sockets Layer) encrypts data in transit between computers. If an attacker intercepted the traffic, the data would be encrypted and therefore unreadable to the attacker.

  No guarantees that shoulder surfing attacks are not occurring at the vendor - Identified control gap.

  Shoulder surfing is where someone else gains information by looking at your computer screen. This should be identified as a risk. A control gap occurs when there are either insufficient or no actions taken to avoid or mitigate a significant risk.

  Vendor may inadvertently see confidential material from the company such as email and IMs - Limit desktop session to certain windows.

  The easiest way to prevent a third party from viewing your emails and IMs is to close the email and IM application windows for the duration of the desktop sharing session.

• Question 249:

  Ann, a security administrator, is conducting an assessment on a new firewall, which was placed at the perimeter of a network containing PII. Ann runs the following commands on a server (10.0.1.19) behind the firewall:

  

  From her own workstation (192.168.2.45) outside the firewall, Ann then runs a port scan against the server and records the following packet capture of the port scan:

  

  Connectivity to the server from outside the firewall worked as expected prior to executing these commands.

  Which of the following can be said about the new firewall?

  A. It is correctly dropping all packets destined for the server.
  B. It is not blocking or filtering any traffic to the server.
  C. Iptables needs to be restarted.
  D. The IDS functionality of the firewall is currently disabled.
  A. It is correctly dropping all packets destined for the server.

• Question 250:

  An insurance company has an online quoting system for insurance premiums. It allows potential customers to fill in certain details about their car and obtain a quote. During an investigation, the following patterns were detected:

  Pattern 1 -Analysis of the logs identifies that insurance premium forms are being filled in but only single fields are incrementally being updated.

  Pattern 2 -For every quote completed, a new customer number is created; due to legacy systems, customer numbers are running out.

  Which of the following is the attack type the system is susceptible to, and what is the BEST way to defend against it? (Select TWO).

  A. Apply a hidden field that triggers a SIEM alert
  B. Cross site scripting attack
  C. Resource exhaustion attack
  D. Input a blacklist of all known BOT malware IPs into the firewall
  E. SQL injection
  F. Implement an inline WAF and integrate into SIEM
  G. Distributed denial of service
  H. Implement firewall rules to block the attacking IP addresses
  C. Resource exhaustion attack
  F. Implement an inline WAF and integrate into SIEM

  ---

  A resource exhaustion attack involves tying up predetermined resources on a system, thereby making the resources unavailable to others.

  Implementing an inline WAF would allow for protection from attacks, as well as log and alert admins to what's going on. Integrating in into SIEM allows for logs and other security-related documentation to be collected for analysis.