CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 281:

  A developer needs to provide feedback on a peer's work during the SDLC. While reviewing the code changes, the developer discovers session ID tokens for a web application will be transmitted over an unsecure connection. Which of the following code snippets should the developer recommend implementing to correct the vulnerability?

  A. Cookie cookie = new Cookie ("primary"); cookie.secure(true);
  B. String input = request.getParameter ("input"); String character Pattern = "[./a-zA-ZO-9? "=" and]"; If (! input.matches (character Pattern)} { out.println ("Invalid Input"); )
  C. 15
  A. Cookie cookie = new Cookie ("primary"); cookie.secure(true);

• Question 282:

  The Chief Information Security Officer (CISO) is preparing a requirements matrix scorecard for a new security tool the company plans to purchase Feedback from which of the following documents will provide input for the requirements matrix scorecard during the vendor selection process?

  A. MSA
  B. RFQ
  C. RFI D. RFP
  D

• Question 283:

  The Information Security Officer (ISO) believes that the company has been targeted by cybercriminals and it is under a cyber attack. Internal services that are normally available to the public via the Internet are inaccessible, and employees in the office are unable to browse the Internet. The senior security engineer starts by reviewing the bandwidth at the border router, and notices that the incoming bandwidth on the router's external interface is maxed out. The security engineer then inspects the following piece of log to try and determine the reason for the downtime, focusing on the company's external router's IP which is 128.20.176.19:

  11:16:22.110343 IP 90.237.31.27.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110351 IP 23.27.112.200.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110358 IP 192.200.132.213.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110402 IP 70.192.2.55.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110406 IP 112.201.7.39.19 > 128.20.176.19.19: UDP, length 1400 Which of the following describes the findings the senior security engineer should report to the ISO and the BEST solution for service restoration?

  A. After the senior engineer used a network analyzer to identify an active Fraggle attack, the company's ISP should be contacted and instructed to block the malicious packets.
  B. After the senior engineer used the above IPS logs to detect the ongoing DDOS attack, an IPS filter should be enabled to block the attack and restore communication.
  C. After the senior engineer used a mirror port to capture the ongoing amplification attack, a BGP sinkhole should be configured to drop traffic at the source networks.
  D. After the senior engineer used a packet capture to identify an active Smurf attack, an ACL should be placed on the company's external router to block incoming UDP port 19 traffic.
  A. After the senior engineer used a network analyzer to identify an active Fraggle attack, the company's ISP should be contacted and instructed to block the malicious packets.

  ---

  The exhibit displays logs that are indicative of an active fraggle attack. A Fraggle attack is similar to a smurf attack in that it is a denial of service attack, but the difference is that a fraggle attack makes use of ICMP and UDP ports 7 and 19. Thus when the senior engineer uses a network analyzer to identify the attack he should contact the company's ISP to block those malicious packets.

• Question 284:

  A company wants to implement a cloud-based security solution that will sinkhole malicious DNS requests. The security administrator has implemented technical controls to direct DNS requests to the cloud servers but wants to extend the solution to all managed and unmanaged endpoints that may have user-defined DNS manual settings Which of the following should the security administrator implement to ensure the solution will protect all connected devices?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  D. Option D

• Question 285:

  A security analyst is reviewing the following pseudo-output snippet after running the command less /tmp/file,tmp.

  

  The information above was obtained from a public-facing website and used to identify military assets. Which of the following should be implemented to reduce the risk of a similar compromise?

  A. Deploy a solution to sanitize geotagging information
  B. Install software to wipe data remnants on servers
  C. Enforce proper input validation on mission-critical software
  D. Implement a digital watermarking solution
  B. Install software to wipe data remnants on servers

• Question 286:

  A video-game developer has received reports of players who are cheating. All game players each have five capabilities that are ranked on a scale of 1 to 10 points, with 10 total points available for balance. Players can move these points between capabilities at any time The programming logic is as follows:

  1.

  A player asks to move points from one capability to another

  2.

  The source capability must have enough points to allow the move

  3.

  The destination capability must not exceed 10 after the move

  4.

  The move from source capability to destination capability is then completed

  The time stamps of the game logs show each step of the transfer process takes about 900ms However, the time stamps of the cheating players show capability transfers at the exact same time. The cheating players have 10 points in multiple capabilities. Which of the following is MOST likely being exploited to allow these capability transfers?

  A. TOC/TOU
  B. CSRF
  C. Memory leak
  D. XSS
  E. SQL injection
  F. Integer overflow
  A. TOC/TOU

• Question 287:

  An organization has recently deployed an EDR solution across its laptops, desktops, and server infrastructure. The organization's server infrastructure is deployed in an IaaS environment. A database within the non-production environment has been misconfigured with a routable IP and is communicating with a command and control server.

  Which of the following procedures should the security responder apply to the situation? (Choose two.)

  A. Contain the server.
  B. Initiate a legal hold.
  C. Perform a risk assessment.
  D. Determine the data handling standard.
  E. Disclose the breach to customers.
  F. Perform an IOC sweep to determine the impact.
  A. Contain the server.
  F. Perform an IOC sweep to determine the impact.

• Question 288:

  A pharmacy gives its clients online access to their records and the ability to review bills and make payments. A new SSL vulnerability on a specific platform was discovered, allowing an attacker to capture the data between the end user and the web server providing these services. After the new vulnerability, it was determined that web services provided are being impacted by this new threat. Which of the following data types MOST likely at risk of exposure based on this new threat? (Select Two)

  A. Cardholder data
  B. Intellectual property
  C. Personal health information
  D. Employee records
  E. Corporate financial data
  A. Cardholder data
  C. Personal health information

• Question 289:

  A security administrator was doing a packet capture and noticed a system communicating with an unauthorized address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network.

  Which of the following is the BEST course of action?

  A. Investigate the network traffic and block UDP port 3544 at the firewall
  B. Remove the system from the network and disable IPv6 at the router
  C. Locate and remove the unauthorized 6to4 relay from the network
  D. Disable the switch port and block the 2001::/32 traffic at the firewall
  A. Investigate the network traffic and block UDP port 3544 at the firewall

  ---

  The 2001::/32 prefix is used for Teredo tunneling.

  Teredo is a transition technology that gives full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 Internet but have no native connection to an IPv6 network. Unlike similar protocols, it can perform its function even from behind

  network address translation (NAT) devices such as home routers.

  Teredo provides IPv6 (Internet Protocol version 6) connectivity by encapsulating IPv6 datagram packets within IPv4 User Datagram Protocol (UDP) packets. Teredo routes these datagrams on the IPv4 Internet and through NAT devices.

  Teredo nodes elsewhere on the IPv6 network (called Teredo relays) receive the packets, decapsulate them, and pass them on. The Teredo server listens on UDP port 3544.

  Teredo clients are assigned an IPv6 address that starts with the Teredo prefix (2001::/32).

  In this question, the BEST course of action would be to block UDP port 3544 at the firewall. This will block the unauthorized communication. You can then investigate the traffic within the network.

• Question 290:

  A researcher is working to identify what appears to be a new variant of an existing piece of malware commonly used in ransomware attacks While it is not identical to the malware previously evaluated. it has a number of similarities including language, payload. and algorithms. Which of the following would help the researcher safely compare the code base of the two variants?

  A. Virtualized sandbox
  B. Vulnerability scanner
  C. Software-defined network
  D. HTTP interceptor
  A. Virtualized sandbox