CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 251:

  Using SSL, an administrator wishes to secure public facing server farms in three subdomains:

  dc1.east.company.com, dc2.central.company.com, and dc3.west.company.com. Which of the following is the number of wildcard SSL certificates that should be purchased?

  B. 1
  C. 3
  D. 6
  C. 3

  ---

  You would need three wildcard certificates:

  *. east.company.com

  *. central.company.com

  *. west.company.com

  The common domain in each of the domains is company.com. However, a wildcard covers only one level of subdomain. For example: *. company.com will cover ".company.com" but it won't cover

  "..company.com".

  You can only have one wildcard in a domain. For example: *.company.com. You cannot have *.*.company.com. Only the leftmost wildcard (*) is counted.

• Question 252:

  Users have been reporting unusual automated phone calls, including names and phone numbers, that appear to come from devices internal to the company. Which of the following should the systems administrator do to BEST address this problem?

  A. Add an ACL to the firewall to block VoIP.
  B. Change the settings on the phone system to use SIP-TLS.
  C. Have the phones download new configurations over TFTP.
  D. Enable QoS configuration on the phone VLAN.
  B. Change the settings on the phone system to use SIP-TLS.

• Question 253:

  An organization that develops military technology is considering expansion into a foreign country. The organization's owners want to understand the risks associated with such an expansion, and the organization does not want to fund an intensive assessment. Which of the following approaches should be taken?

  A. Penetration test
  B. Tabletop assessment
  C. Compliance assessment
  D. Configuration security test
  B. Tabletop assessment

• Question 254:

  An information security manager conducted a gap analysis, which revealed a 75% implementation of security controls for high-risk vulnerabilities, 90% for medium vulnerabilities, and 10% for low-risk vulnerabilities. To create a road map to close the identified gaps, the assurance team reviewed the likelihood of exploitation of each vulnerability and the business impact of each associated control. To determine which controls to implement, which of the following is the MOST important to consider?

  A. KPI
  B. KRI
  C. GRC
  D. BIA
  A. KPI

• Question 255:

  A technician is validating compliance with organizational policies. The user and machine accounts in the AD are not set to expire, which is non-compliant. Which of the following network tools would provide this type of information?

  A. SIEM server
  B. IDS appliance
  C. SCAP scanner
  D. HTTP interceptor
  B. IDS appliance

• Question 256:

  The security engineer receives an incident ticket from the helpdesk stating that DNS lookup requests are no longer working from the office. The network team has ensured that Layer 2 and Layer 3 connectivity are working. Which of the following tools would a security engineer use to make sure the DNS server is listening on port 53?

  A. PING
  B. NESSUS
  C. NSLOOKUP
  D. NMAP
  D. NMAP

  ---

  NMAP works as a port scanner and is used to check if the DNS server is listening on port 53.

• Question 257:

  A security analyst, who is working in a Windows environment, has noticed a significant amount of IPv6 traffic originating from a client, even though IPv6 is not currently in use. The client is a stand-alone device, not connected to the AD that manages a series of SCADA devices used for manufacturing.

  Which of the following is the appropriate command to disable the client's IPv6 stack?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

• Question 258:

  The latest independent research shows that cyber attacks involving SCADA systems grew an average of 15% per year in each of the last four years, but that this year's growth has slowed to around 7%. Over the same time period, the number of attacks against applications has decreased or stayed flat each year. At the start of the measure period, the incidence of PC boot loader or BIOS based attacks was negligible. Starting two years ago, the growth in the number of PC boot loader attacks has grown exponentially. Analysis of these trends would seem to suggest which of the following strategies should be employed?

  A. Spending on SCADA protections should stay steady; application control spending should increase substantially and spending on PC boot loader controls should increase substantially.
  B. Spending on SCADA security controls should stay steady; application control spending should decrease slightly and spending on PC boot loader protections should increase substantially.
  C. Spending all controls should increase by 15% to start; spending on application controls should be suspended, and PC boot loader protection research should increase by 100%.
  D. Spending on SCADA security controls should increase by 15%; application control spending should increase slightly, and spending on PC boot loader protections should remain steady.
  B. Spending on SCADA security controls should stay steady; application control spending should decrease slightly and spending on PC boot loader protections should increase substantially.

  ---

  Spending on the security controls should stay steady because the attacks are still ongoing albeit reduced in occurrence Due to the incidence of BIOS-based attacks growing exponentially as the application attacks being decreased or staying flat spending should increase in this field.

• Question 259:

  The Chief Executive Officer (CEO) of a company has considered implementing a cost-saving measure that might result in new risk to the company. When deciding whether to implement this measure, which of the following would be the BEST course of action to manage the organization's risk?

  A. Present the detailed risk resulting from the change to the company's board of directors
  B. Pilot new mitigations that cost less than the total amount saved by the change
  C. Modify policies and standards to discourage future changes that increase risk
  D. Capture the risk in a prioritized register that is shared routinely with the CEO
  D. Capture the risk in a prioritized register that is shared routinely with the CEO

• Question 260:

  A security engineer is investigating a compromise that occurred between two internal computers. The engineer has determined during the investigation that one computer infected another. While reviewing the IDS logs, the engineer can view the outbound callback traffic, but sees no traffic between the two computers. Which of the following would BEST address the IDS visibility gap?

  A. Install network taps at the edge of the network.
  B. Send syslog from the IDS into the SIEM.
  C. Install HIDS on each computer.
  D. SPAN traffic form the network core into the IDS.
  D. SPAN traffic form the network core into the IDS.