CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 301:

  An engineer maintains a corporate-owned mobility infrastructure, and the organization requires that all web browsing using corporate-owned resources be monitored. Which of the following would allow the organization to meet its requirement? (Choose two.)

  A. Exempt mobile devices from the requirement, as this will lead to privacy violations
  B. Configure the devices to use an always-on IPSec VPN
  C. Configure all management traffic to be tunneled into the enterprise via TLS
  D. Implement a VDI solution and deploy supporting client apps to devices
  E. Restrict application permissions to establish only HTTPS connections outside of the enterprise boundary
  B. Configure the devices to use an always-on IPSec VPN
  E. Restrict application permissions to establish only HTTPS connections outside of the enterprise boundary

• Question 302:

  When reviewing KRIs of the email security appliance with the Chief Information Security Officer (CISO) of an insurance company, the security engineer notices the following:

  

  Which of the following measures should the security engineer take to ensure PII is not intercepted in transit while also preventing interruption to business?

  A. Quarantine emails sent to external domains containing PII and release after inspection.
  B. Prevent PII from being sent to domains that allow users to sign up for free webmail.
  C. Enable transport layer security on all outbound email communications and attachments.
  D. Provide security awareness training regarding transmission of PII.
  C. Enable transport layer security on all outbound email communications and attachments.

• Question 303:

  Within change management, which of the following ensures functions are earned out by multiple employees?

  A. Least privilege
  B. Mandatory vacation
  C. Separation of duties
  D. Job rotation
  C. Separation of duties

  ---

  Reference: https://www aihr com/bloa/job-rotation/

• Question 304:

  A development team releases updates to an application regularly. The application is compiled with several standard open-source security products that require a minimum version for compatibility. During the security review portion of the development cycle, which of the following should be done to minimize possible application vulnerabilities?

  A. The developers should require an exact version of the open-source security products, preventing the introduction of new vulnerabilities.
  B. The application development team should move to an Agile development approach to identify security concerns faster
  C. The change logs for the third-party libraries should be reviewed for security patches, which may need to be included in the release.
  D. The application should eliminate the use of open-source libraries and products to prevent known vulnerabilities from being included.
  C. The change logs for the third-party libraries should be reviewed for security patches, which may need to be included in the release.

• Question 305:

  A company has entered into a business agreement with a business partner for managed human resources services. The Chief Information Security Officer (CISO) has been asked to provide documentation that is required to set up a business-to-business VPN between the two organizations.

  Which of the following is required in this scenario?

  A. ISA
  B. BIA
  C. SLA
  D. RA
  A. ISA

• Question 306:

  An organization is evaluating options related to moving organizational assets to a cloud-based environment using an IaaS provider. One engineer has suggested connecting a second cloud environment within the organization's existing facilities to capitalize on available datacenter space and resources. Other project team members are concerned about such a commitment of organizational assets, and ask the Chief Security Officer (CSO) for input. The CSO explains that the project team should work with the engineer to evaluate the risks associated with using the datacenter to implement:

  A. a hybrid cloud.
  B. an on-premises private cloud.
  C. a hosted hybrid cloud.
  D. a private cloud.
  A. a hybrid cloud.

• Question 307:

  A company is developing requirements for a customized OS build that will be used in an embedded environment. The company procured hardware that is capable of reducing the likelihood of successful buffer overruns while executables are processing. Which of the following capabilities must be included for the OS to take advantage of this critical hardware-based countermeasure?

  A. Application whitelisting
  B. NX/XN bit
  C. ASLR
  D. TrustZone
  E. SCP
  B. NX/XN bit

• Question 308:

  An administrator is working with management to develop policies related to the use of the cloud-based resources that contain corporate data. Management plans to require some control over organizational data stored on personal devices, such as tablets. Which of the following controls would BEST support management's policy?

  A. MDM
  B. Sandboxing
  C. Mobile tokenization
  D. FDE
  E. MFA
  A. MDM

• Question 309:

  While traveling to another state, the Chief Financial (CFO) forgot to submit payroll for the company. The CFO quickly gained to the corporate through the high-speed wireless network provided by the hotel and completed the desk. Upon returning from the business trip, the CFO was told no one received their weekly pay due to a malware on attack on the system. Which of the following is the MOST likely of the security breach?

  A. The security manager did not enforce automate VPN connection.
  B. The company's server did not have endpoint security enabled.
  C. The hotel and did require a wireless password to authenticate.
  D. The laptop did not have the host-based firewall properly configured.
  A. The security manager did not enforce automate VPN connection.

• Question 310:

  A developer emails the following output to a security administrator for review:

  

  Which of the following tools might the security administrator use to perform further security assessment of this issue?

  A. Port scanner
  B. Vulnerability scanner
  C. Fuzzer
  D. HTTP interceptor
  D. HTTP interceptor