CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 261:

  A security technician is incorporating the following requirements in an RFP for a new SIEM:

  New security notifications must be dynamically implemented by the SIEM engine The SIEM must be able to identify traffic baseline anomalies Anonymous attack data from all customers must augment attack detection and risk scoring

  Based on the above requirements, which of the following should the SIEM support? (Choose two.)

  A. Autoscaling search capability
  B. Machine learning
  C. Multisensor deployment
  D. Big Data analytics
  E. Cloud-based management
  F. Centralized log aggregation
  B. Machine learning
  D. Big Data analytics

• Question 262:

  Company A is establishing a contractual with Company B. The terms of the agreement are formalized in a document covering the payment terms, limitation of liability, and intellectual property rights. Which of the following documents will MOST likely contain these elements

  A. Company A-B SLA v2.docx
  B. Company A OLA v1b.docx
  C. Company A MSA v3.docx
  D. Company A MOU v1.docx
  E. Company A-B NDA v03.docx
  A. Company A-B SLA v2.docx

• Question 263:

  The senior security administrator wants to redesign the company DMZ to minimize the risks associated with both external and internal threats. The DMZ design must support security in depth, change management and configuration processes, and support incident reconstruction. Which of the following designs BEST supports the given requirements?

  A. A dual firewall DMZ with remote logging where each firewall is managed by a separate administrator.
  B. A single firewall DMZ where each firewall interface is managed by a separate administrator and logging to the cloud.
  C. A SaaS based firewall which logs to the company's local storage via SSL, and is managed by the change control team.
  D. A virtualized firewall, where each virtual instance is managed by a separate administrator and logging to the same hardware.
  A. A dual firewall DMZ with remote logging where each firewall is managed by a separate administrator.

  ---

  Security in depth is the concept of creating additional layers of security. The traditional approach of securing the IT infrastructure is no longer enough. Today's threats are multifaceted and often persistent, and traditional network perimeter security controls cannot effectively mitigate them. Organizations need to implement more effective, multi-level security controls that are embedded with their electronic assets. They need to protect key assets from both external and internal threats. This security in depth approach is meant to sustain attacks even when perimeter and traditional controls have been breached.

  In this question, using two firewalls to secure the DMZ from both external and internal attacks is the best approach. Having each firewall managed by a separate administrator will reduce the chance of a configuration error being made on both firewalls. The remote logging will enable incident reconstruction.

• Question 264:

  A security architect is designing a new infrastructure using both type 1 and type 2 virtual machines. In addition to the normal complement of security controls (e.g. antivirus, host hardening, HIPS/NIDS) the security architect needs to implement a mechanism to securely store cryptographic keys used to sign code and code modules on the VMs. Which of the following will meet this goal without requiring any hardware pass-through implementations?

  A. vTPM
  B. HSM
  C. TPM
  D. INE
  A. vTPM

  ---

  A Trusted Platform Module (TPM) is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is usually installed on the motherboard of a computer, and it communicates with the

  remainder of the system by using a hardware bus.

  A vTPM is a virtual Trusted Platform Module.

  IBM extended the current TPM V1.2 command set with virtual TPM management commands that allow us to create and delete instances of TPMs. Each created instance of a TPM holds an association with a virtual machine (VM) throughout

  its lifetime on the platform.

• Question 265:

  An organization designs and develops safety-critical embedded firmware (inclusive of embedded OS and services) for the automotive industry. The organization has taken great care to exercise secure software development practices for the firmware Of paramount importance is the ability to defeat attacks aimed at replacing or corrupting running firmware once the vehicle leaves production and is in the field Integrating, which of the following host and OS controls would BEST protect against this threat?

  A. Configure the host to require measured boot with attestation using platform configuration registers extended through the OS and into application space.
  B. Implement out-of-band monitoring to analyze the state of running memory and persistent storage and, in a failure mode, signal a check-engine light condition for the operator.
  C. Perform reverse engineering of the hardware to assess for any implanted logic or other supply chain integrity violations
  D. Ensure the firmware includes anti-malware services that will monitor and respond to any introduction of malicious logic.
  E. Require software engineers to adhere to a coding standard, leverage static and dynamic analysis within the development environment, and perform exhaustive state space analysis before deployment
  D. Ensure the firmware includes anti-malware services that will monitor and respond to any introduction of malicious logic.

• Question 266:

  A member of the software development team has requested advice from the security team to implement a new secure lab for testing malware. Which of the following is the NEXT step that the security team should take?

  A. Purchase new hardware to keep the malware isolated.
  B. Develop a policy to outline what will be required in the secure lab.
  C. Construct a series of VMs to host the malware environment.
  D. Create a proposal and present it to management for approval.
  D. Create a proposal and present it to management for approval.

  ---

  Before we can create a solution, we need to motivate why the solution needs to be created and plan the best implementation with in the company's business operations. We therefore need to create a proposal that explains the intended implementation and allows for the company to budget for it.

• Question 267:

  While the code is still in the development environment, a security architect is testing the code stored in the code repository to ensure the top ten OWASP secure coding practices are being followed. Which of the following code analyzers will produce the desired results?

  A. Static
  B. Dynamic
  C. Fuzzer
  D. Peer review
  A. Static

• Question 268:

  A storage as a service company implements both encryption at rest as well as encryption in transit of customers' data. The security administrator is concerned with the overall security of the encrypted customer data stored by the company servers and wants the development team to implement a solution that will strengthen the customer's encryption key. Which of the following, if implemented, will MOST increase the time an offline password attack against the customers' data would take?

  A. key = NULL ; for (int i=0; i
  B. password = NULL ; for (int i=0; i
  C. password = password + sha(password+salt) + aes256(password+salt)
  D. key = aes128(sha256(password), password))
  A. key = NULL ; for (int i=0; i

  ---

  References: http://stackoverflow.com/questions/4948322/fundamental-difference-between-hashing-and-encryption-algorithms

• Question 269:

  An enterprise solution requires a central monitoring platform to address the growing networks of various departments and agencies that connect to the network. The current vendor products are not adequate due to the growing number of

  heterogeneous devices.

  Which of the following is the primary concern?

  A. Scalability
  B. Usability
  C. Accountability
  D. Performance
  A. Scalability

• Question 270:

  An insurance company has two million customers and is researching the top transactions on its customer portal. It identifies that the top transaction is currently password reset. Due to users not remembering their secret questions, a large number of calls are consequently routed to the contact center for manual password resets. The business wants to develop a mobile application to improve customer engagement in the future, continue with a single factor of authentication, minimize management overhead of the solution, remove passwords, and eliminate to the contact center.

  Which of the following techniques would BEST meet the requirements? (Choose two.)

  A. Magic link sent to an email address
  B. Customer ID sent via push notification
  C. SMS with OTP sent to a mobile number
  D. Third-party social login
  E. Certificate sent to be installed on a device
  F. Hardware tokens sent to customers
  C. SMS with OTP sent to a mobile number
  E. Certificate sent to be installed on a device