CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 381:

  The Chief information Officer (CIO) asks the system administrator to improve email security at the company based on the following requirements:

  1.

  Transaction being requested by unauthorized individuals.

  2.

  Complete discretion regarding client names, account numbers, and investment information.

  3.

  Malicious attackers using email to malware and ransomeware.

  4.

  Exfiltration of sensitive company information.

  The cloud-based email solution will provide anti-malware reputation-based scanning, signature-based scanning, and sandboxing. Which of the following is the BEST option to resolve the boar's concerns for this email migration?

  A. Data loss prevention
  B. Endpoint detection response
  C. SSL VPN
  D. Application whitelisting
  A. Data loss prevention

• Question 382:

  A security engineer is working on a large software development project. As part of the design of the project, various stakeholder requirements were gathered and decomposed to an implementable and testable level.

  Various security requirements were also documented.

  Organize the following security requirements into the correct hierarchy required for an SRTM.

  Requirement 1: The system shall provide confidentiality for data in transit and data at rest.

  Requirement 2: The system shall use SSL, SSH, or SCP for all data transport.

  Requirement 3: The system shall implement a file-level encryption scheme.

  Requirement 4: The system shall provide integrity for all data at rest.

  Requirement 5: The system shall perform CRC checks on all files.

  A. Level 1: Requirements 1 and 4; Level 2: Requirements 2, 3, and 5
  B. Level 1: Requirements 1 and 4; Level 2: Requirements 2 and 3 under 1, Requirement 5 under 4
  C. Level 1: Requirements 1 and 4; Level 2: Requirement 2 under 1, Requirement 5 under 4; Level 3: Requirement 3 under 2
  D. Level 1: Requirements 1, 2, and 3; Level 2: Requirements 4 and 5
  B. Level 1: Requirements 1 and 4; Level 2: Requirements 2 and 3 under 1, Requirement 5 under 4

  ---

  Confidentiality and integrity are two of the key facets of data security. Confidentiality ensures that sensitive information is not disclosed to unauthorized users; while integrity ensures that data is not altered by unauthorized users. These are

  Level 1 requirements.

  Confidentiality is enforced through encryption of data at rest, encryption of data in transit, and access control. Encryption of data in transit is accomplished by using secure protocols such as PSec, SSL, PPTP, SSH, and SCP, etc.

  Integrity can be enforced through hashing, digital signatures and CRC checks on the files.

  In the SRTM hierarchy, the enforcement methods would fall under the Level requirement.

  References:

  Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley and Sons, Indianapolis, 2012, pp. 17-19, 20, 27-29

• Question 383:

  An internal application has been developed to increase the efficiency of an operational process of a global manufacturer. New code was implemented to fix a security bug, but it has caused operations to halt. The executive team has decided fixing the security bug is less important than continuing operations.

  Which of the following would BEST support immediate rollback of the failed fix? (Choose two.)

  A. Version control
  B. Agile development
  C. Waterfall development
  D. Change management
  E. Continuous integration
  A. Version control
  D. Change management

• Question 384:

  A company contracts a security consultant to perform a remote white-box penetration test. The company wants the consultant to focus on Internet-facing services without negatively impacting production services Which of the following is the consultant MOST likely to use to identify the company's attack surface? (Select TWO)

  A. Web crawler
  B. WHOIS registry
  C. DNS records
  D. Company's firewall ACL
  E. Internal routing tables
  F. Directory service queries
  B. WHOIS registry
  C. DNS records

• Question 385:

  The Chief Information Security Officer (CISO) of an established security department, identifies a customer who has been using a fraudulent credit card. The CISO calls the local authorities, and when they arrive on-site, the authorities ask a

  security engineer to create a point-in-time copy of the running database in their presence.

  This is an example of:

  A. creating a forensic image
  B. deploying fraud monitoring
  C. following a chain of custody
  D. analyzing the order of volatility
  C. following a chain of custody

• Question 386:

  Following a recent security incident on a web server the security analyst takes HTTP traffic captures for further investigation The analyst suspects certain jpg files have important data hidden within them. Which of the following tools will help get all the pictures from within the HTTP traffic captured to a specified folder?

  A. tshark
  B. memdump
  C. nbtstat
  D. dd
  A. tshark

• Question 387:

  Security policies that are in place at an organization prohibit USB drives from being utilized across the entire enterprise, with adequate technical controls in place to block them. As a way to still be able to work from various locations on different computing resources, several sales staff members have signed up for a web-based storage solution without the consent of the IT department. However, the operations department is required to use the same service to transmit certain business partner documents.

  Which of the following would BEST allow the IT department to monitor and control this behavior?

  A. Enabling AAA
  B. Deploying a CASB
  C. Configuring an NGFW
  D. Installing a WAF
  E. Utilizing a vTPM
  B. Deploying a CASB

• Question 388:

  A web services company is planning a one-time high-profile event to be hosted on the corporate website. An outage, due to an attack, would be publicly embarrassing, so Joe, the Chief Executive Officer (CEO), has requested that his security engineers put temporary preventive controls in place. Which of the following would MOST appropriately address Joe's concerns?

  A. Ensure web services hosting the event use TCP cookies and deny_hosts.
  B. Configure an intrusion prevention system that blocks IPs after detecting too many incomplete sessions.
  C. Contract and configure scrubbing services with third-party DDoS mitigation providers.
  D. Purchase additional bandwidth from the company's Internet service provider.
  C. Contract and configure scrubbing services with third-party DDoS mitigation providers.

  ---

  Scrubbing is an excellent way of dealing with this type of situation where the company wants to stay connected no matter what during the one-time high profile event. It involves deploying a multi-layered security approach backed by extensive threat research to defend against a variety of attacks with a guarantee of always-on.

• Question 389:

  Confidential information related to Application A. Application B and Project X appears to have been leaked to a competitor. After consulting with the legal team, the IR team is advised to take immediate action to preserve evidence for possible litigation and criminal charges.

  While reviewing the rights and group ownership of the data involved in the breach, the IR team inspects the following distribution group access lists:

  

  Which of the following actions should the IR team take FIRST?

  A. Remove all members from the distribution groups immediately
  B. Place the mailbox for jsmith on legal hold
  C. Implement a proxy server on the network to inspect all outbound SMTP traffic for the DevOps group
  D. Install DLP software on all developer laptops to prevent data from leaving the network.
  A. Remove all members from the distribution groups immediately

• Question 390:

  A cybersecurity analyst is hired to review the security the posture of a company. The cybersecurity analyst notice a very high network bandwidth consumption due to SYN floods from a small number of IP addresses. Which of the following would be the BEST action to take to support incident response?

  A. Increase the company's bandwidth.
  B. Apply ingress filters at the routers.
  C. Install a packet capturing tool.
  D. Block all SYN packets.
  B. Apply ingress filters at the routers.