CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 331:

  An organization's mobile device inventory recently provided notification that a zero-day vulnerability was identified in the code used to control the baseband of the devices. The device manufacturer is expediting a patch, but the rollout will take several months Additionally several mobile users recently returned from an overseas trip and report their phones now contain unknown applications, slowing device performance Users have been unable to uninstall these applications, which persist after wiping the devices Which of the following MOST likely occurred and provides mitigation until the patches are released?

  A. Unauthentic firmware was installed, disable OTA updates and carrier roaming via MDM.
  B. Users opened a spear-phishing email: disable third-party application stores and validate all signed code prior to execution.
  C. An attacker downloaded monitoring applications; perform a full factory reset of the affected devices.
  D. Users received an improperly encoded emergency broadcast message, leading to an integrity loss condition; disable emergency broadcast messages
  A. Unauthentic firmware was installed, disable OTA updates and carrier roaming via MDM.

• Question 332:

  An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the penetration tester to MOST efficiently use any obtained administrative credentials on the client organization's other systems, without impacting the integrity of any of the systems?

  A. Use the pass the hash technique
  B. Use rainbow tables to crack the passwords
  C. Use the existing access to change the password
  D. Use social engineering to obtain the actual password
  A. Use the pass the hash technique

  ---

  With passing the hash you can grab NTLM credentials and you can manipulate the Windows logon sessions maintained by the LSA component. This will allow you to operate as an administrative user and not impact the integrity of any of the systems when running your tests.

• Question 333:

  During a recent incident, sensitive data was disclosed and subsequently destroyed through a properly secured, cloud-based storage platform. An incident response technician is working with management to develop an after action report that conveys critical metrics regarding the incident.

  Which of the following would be MOST important to senior leadership to determine the impact of the breach?

  A. The likely per-record cost of the breach to the organization
  B. The legal or regulatory exposure that exists due to the breach
  C. The amount of downtime required to restore the data
  D. The number of records compromised
  A. The likely per-record cost of the breach to the organization

• Question 334:

  A completely new class of web-based vulnerabilities has been discovered. Claims have been made that all common web-based development frameworks are susceptible to attack. Proof-of-concept details have emerged on the Internet. A security advisor within a company has been asked to provide recommendations on how to respond quickly to these vulnerabilities. Which of the following BEST describes how the security advisor should respond?

  A. Assess the reliability of the information source, likelihood of exploitability, and impact to hosted data. Attempt to exploit via the proof-of-concept code. Consider remediation options.
  B. Hire an independent security consulting agency to perform a penetration test of the web servers. Advise management of any `high' or `critical' penetration test findings and put forward recommendations for mitigation.
  C. Review vulnerability write-ups posted on the Internet. Respond to management with a recommendation to wait until the news has been independently verified by software vendors providing the web application software.
  D. Notify all customers about the threat to their hosted data. Bring the web servers down into "maintenance mode" until the vulnerability can be reliably mitigated through a vendor patch.
  A. Assess the reliability of the information source, likelihood of exploitability, and impact to hosted data. Attempt to exploit via the proof-of-concept code. Consider remediation options.

  ---

  The first thing you should do is verify the reliability of the claims. From there you can assess the likelihood of the vulnerability affecting your systems. If it is determined that your systems are likely to be affected by the exploit, you need to determine what impact an attack will have on your hosted data. Now that you know what the impact will be, you can test the exploit by using the proof-of-concept code. That should help you determine your options for dealing with the threat (remediation).

• Question 335:

  The Chief information Officer (CIO) of a large bank, which uses multiple third-party organizations to deliver a service, is concerned about the handling and security of customer data by the parties. Which of the following should be implemented to BEST manage the risk?

  A. Establish a review committee that assesses the importance of suppliers and ranks them according to contract renewals. At the time of contract renewal, incorporate designs and operational controls into the contracts and a right-to-audit clause. Regularly assess the supplier's post-contract renewal with a dedicated risk management team.
  B. Establish a team using members from first line risk, the business unit, and vendor management to assess only design security controls of all suppliers. Store findings from the reviews in a database for all other business units and risk teams to reference.
  C. Establish an audit program that regularly reviews all suppliers regardless of the data they access, how they access the data, and the type of data, Review all design and operational controls based on best practice standard and report the finding back to upper management.
  D. Establish a governance program that rates suppliers based on their access to data, the type of data, and how they access the data Assign key controls that are reviewed and managed based on the supplier's rating. Report finding units that rely on the suppliers and the various risk teams.
  A. Establish a review committee that assesses the importance of suppliers and ranks them according to contract renewals. At the time of contract renewal, incorporate designs and operational controls into the contracts and a right-to-audit clause. Regularly assess the supplier's post-contract renewal with a dedicated risk management team.

• Question 336:

  The information security manager of an e-commerce company receives an alert over the weekend that all the servers in a datacenter have gone offline Upon discussing this situation with the facilities manager, the information security manager learns there was planned electrical maintenance. The information security manager is upset at not being part of the maintenance planning, as this could have resulted in a loss of:

  A. data confidentiality.
  B. data security.
  C. PCI compliance
  D. business availability.
  D. business availability.

• Question 337:

  A security engineer reviews the table below:

  

  The engineer realizes there is an active attack occurring on the network. Which of the following would BEST reduce the risk of this attack reoccurring the future?

  A. Upgrading device firmware
  B. Enabling port security
  C. Increasing DHCP pool size
  D. Disabling dynamic trucking
  E. Reducing DHCP lease length
  B. Enabling port security

• Question 338:

  An organization's network engineering team recently deployed a new software encryption solution to ensure the confidentiality of data at rest, which was found to add 300ms of latency to data read-write requests in storage, impacting business operations.

  Which of the following alternative approaches would BEST address performance requirements while meeting the intended security objective?

  A. Employ hardware FDE or SED solutions.
  B. Utilize a more efficient cryptographic hash function.
  C. Replace HDDs with SSD arrays.
  D. Use a FIFO pipe a multithreaded software solution.
  A. Employ hardware FDE or SED solutions.

• Question 339:

  An organization just merged with an organization in another legal jurisdiction and must improve its network security posture in ways that do not require additional resources to implement data isolation. One recommendation is to block communication between endpoint PCs. Which of the following would be the BEST solution?

  A. Installing HIDS
  B. Configuring a host-based firewall
  C. Configuring EDR
  D. Implementing network segmentation
  D. Implementing network segmentation

• Question 340:

  A newly hired Chief Information Security Officer (CISO) wants to understand how the organization's CIRT handles issues brought to their attention, but needs to be very cautious about impacting any systems. The MOST appropriate method to use would be:

  A. an internal vulnerability assessment.
  B. a red-team threat-hunt exercise.
  C. a white-box penetration test.
  D. a guided tabletop exercise.
  D. a guided tabletop exercise.