CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 31:

  A company's user community is being adversely affected by various types of emails whose authenticity cannot be trusted. The Chief Information Security Officer (CISO) must address the problem.

  Which of the following solutions would BEST support trustworthy communication solutions?

  A. Enabling spam filtering and DMARC.
  B. Using MFA when logging into email clients and the domain.
  C. Enforcing HTTPS everywhere so web traffic, including email, is secure.
  D. Enabling SPF and DKIM on company servers.
  E. Enforcing data classification labels before an email is sent to an outside party.
  A. Enabling spam filtering and DMARC.

• Question 32:

  A recent CRM upgrade at a branch office was completed after the desired deadline. Several technical issues were found during the upgrade and need to be discussed in depth before the next branch office is upgraded.

  Which of the following should be used to identify weak processes and other vulnerabilities?

  A. Gap analysis
  B. Benchmarks and baseline results
  C. Risk assessment
  D. Lessons learned report
  D. Lessons learned report

• Question 33:

  A medical device company is implementing a new COTS antivirus solution in its manufacturing plant. All validated machines and instruments must be retested for interoperability with the new software. Which of the following would BEST ensure the software and instruments are working as designed?

  A. System design documentation
  B. User acceptance testing
  C. Peer review
  D. Static code analysis testing
  E. Change control documentation
  A. System design documentation

• Question 34:

  ABC Corporation uses multiple security zones to protect systems and information, and all of the VM hosts are part of a consolidated VM infrastructure. Each zone has different VM administrators. Which of the following restricts different zone administrators from directly accessing the console of a VM host from another zone?

  A. Ensure hypervisor layer firewalling between all VM hosts regardless of security zone.
  B. Maintain a separate virtual switch for each security zone and ensure VM hosts bind to only the correct virtual NIC(s).
  C. Organize VM hosts into containers based on security zone and restrict access using an ACL.
  D. Require multi-factor authentication when accessing the console at the physical VM host.
  C. Organize VM hosts into containers based on security zone and restrict access using an ACL.

  ---

  Access Control Lists (ACLs) are used to restrict access to the console of a virtual host. Virtual hosts are often managed by centralized management servers (for example: VMware vCenter Server). You can create logical containers that can contain multiple hosts and you can configure ACLs on the containers to provide access to the hosts within the container.

• Question 35:

  The audit team was only provided the physical and logical addresses of the network without any type of access credentials.

  Which of the following methods should the audit team use to gain initial access during the security assessment? (Choose two.)

  A. Tabletop exercise
  B. Social engineering
  C. Runtime debugging
  D. Reconnaissance
  E. Code review
  F. Remote access tool
  B. Social engineering
  D. Reconnaissance

• Question 36:

  A senior network security engineer has been tasked to decrease the attack surface of the corporate network. Which of the following actions would protect the external network interfaces from external attackers performing network scanning?

  A. Remove contact details from the domain name registrar to prevent social engineering attacks.
  B. Test external interfaces to see how they function when they process fragmented IP packets.
  C. Enable a honeynet to capture and facilitate future analysis of malicious attack vectors.
  D. Filter all internal ICMP message traffic, forcing attackers to use full-blown TCP port scans against external network interfaces.
  B. Test external interfaces to see how they function when they process fragmented IP packets.

  ---

  Fragmented IP packets are often used to evade firewalls or intrusion detection systems.

  Port Scanning is one of the most popular reconnaissance techniques attackers use to discover services they can break into. All machines connected to a Local Area Network (LAN) or Internet run many services that listen at well-known and not so well known ports. A port scan helps the attacker find which ports are available (i.e., what service might be listing to a port). One problem, from the perspective of the attacker attempting to scan a port, is that services listening on these ports log scans. They see an incoming connection, but no data, so an error is logged. There exist a number of stealth scan

  techniques to avoid this. One method is a fragmented port scan. Fragmented packet Port Scan The scanner splits the TCP header into several IP fragments. This bypasses some packet filter firewalls because they cannot see a complete TCP header that can match their filter rules. Some packet filters and firewalls do queue all IP

  fragments, but many networks cannot afford the performance loss caused by the queuing.

• Question 37:

  Wireless users are reporting issues with the company's video conferencing and VoIP systems. The security administrator notices internal DoS attacks from infected PCs on the network causing the VoIP system to drop calls. The security administrator also notices that the SIP servers are unavailable during these attacks. Which of the following security controls will MOST likely mitigate the VoIP DoS attacks on the network? (Select TWO).

  A. Install a HIPS on the SIP servers
  B. Configure 802.1X on the network
  C. Update the corporate firewall to block attacking addresses
  D. Configure 802.11e on the network
  E. Configure 802.1q on the network
  A. Install a HIPS on the SIP servers
  D. Configure 802.11e on the network

  ---

  Host-based intrusion prevention system (HIPS) is an installed software package that will monitor a single host for suspicious activity by analyzing events taking place within that host. IEEE 802.11e is deemed to be of significant consequence for delay-sensitive applications, such as Voice over Wireless LAN and streaming multimedia.

• Question 38:

  A security controls assessor intends to perform a holistic configuration compliance test of networked assets. The assessor has been handed a package of definitions provided in XML format, and many of the files have two common tags within them: "