CompTIA CompTIA Certifications CAS-003 Questions & Answers

• Question 391:

  An analyst has noticed unusual activities in the SIEM to a .cn domain name. Which of the following should the analyst use to identify the content of the traffic?

  A. Log review

  B. Service discovery

  C. Packet capture

  D. DNS harvesting

  Correct Answer: D

• Question 392:

  During a security event investigation, a junior analyst fails to create an image of a server's hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from the analysis is not usable in the prosecution of the attackers due to the uncertainty of tampering. Which of the following should the junior analyst have followed?

  A. Continuity of operations

  B. Chain of custody

  C. Order of volatility

  D. Data recovery

  Correct Answer: C

• Question 393:

  An engineer maintains a corporate-owned mobility infrastructure, and the organization requires that all web browsing using corporate-owned resources be monitored. Which of the following would allow the organization to meet its requirement? (Choose two.)

  A. Exempt mobile devices from the requirement, as this will lead to privacy violations

  B. Configure the devices to use an always-on IPSec VPN

  C. Configure all management traffic to be tunneled into the enterprise via TLS

  D. Implement a VDI solution and deploy supporting client apps to devices

  E. Restrict application permissions to establish only HTTPS connections outside of the enterprise boundary

  Correct Answer: BE

• Question 394:

  A security engineer has implemented an internal user access review tool so service teams can baseline user accounts and group memberships. The tool is functional and popular among its initial set of onboarded teams. However, the tool has not been built to cater to a broader set of internal teams yet. The engineer has sought feedback from internal stakeholders, and a list of summarized requirements is as follows:

  The tool needs to be responsive so service teams can query it, and then perform an automated response action.

  The tool needs to be resilient to outages so service teams can perform the user access review at any point in time and meet their own SLAs. The tool will become the system-of-record for approval, reapproval, and removal life cycles of group

  memberships and must allow for data retrieval after failure.

  Which of the following need specific attention to meet the requirements listed above? (Choose three.)

  A. Scalability

  B. Latency

  C. Availability

  D. Usability

  E. Recoverability

  F. Maintainability

  Correct Answer: BCE

• Question 395:

  During a security assessment, activities were divided into two phases; internal and external exploitation. The security assessment team set a hard time limit on external activities before moving to a compromised box within the enterprise perimeter.

  Which of the following methods is the assessment team most likely to employ NEXT?

  A. Pivoting from the compromised, moving laterally through the enterprise, and trying to exfiltrate data and compromise devices.

  B. Conducting a social engineering attack attempt with the goal of accessing the compromised box physically.

  C. Exfiltrating network scans from the compromised box as a precursor to social media reconnaissance

  D. Open-source intelligence gathering to identify the network perimeter and scope to enable further system compromises.

  Correct Answer: A

• Question 396:

  A security architect is implementing security measures in response to an external audit that found vulnerabilities in the corporate collaboration tool suite. The report identified the lack of any mechanism to provide confidentiality for electronic correspondence between users and between users and group mailboxes. Which of the following controls would BEST mitigate the identified vulnerability?

  A. Issue digital certificates to all users, including owners of group mailboxes, and enable S/MIME

  B. Federate with an existing PKI provider, and reject all non-signed emails

  C. Implement two-factor email authentication, and require users to hash all email messages upon receipt

  D. Provide digital certificates to all systems, and eliminate the user group or shared mailboxes

  Correct Answer: A

• Question 397:

  Ann, a member of the finance department at a large corporation, has submitted a suspicious email she received to the information security team. The team was not expecting an email from Ann, and it contains a PDF file inside a ZIP compressed archive. The information security learn is not sure which files were opened. A security team member uses an air-gapped PC to open the ZIP and PDF, and it appears to be a social engineering attempt to deliver an exploit.

  Which of the following would provide greater insight on the potential impact of this attempted attack?

  A. Run an antivirus scan on the finance PC.

  B. Use a protocol analyzer on the air-gapped PC.

  C. Perform reverse engineering on the document.

  D. Analyze network logs for unusual traffic.

  E. Run a baseline analyzer against the user's computer.

  Correct Answer: B

• Question 398:

  A company has entered into a business agreement with a business partner for managed human resources services. The Chief Information Security Officer (CISO) has been asked to provide documentation that is required to set up a business-to-business VPN between the two organizations.

  Which of the following is required in this scenario?

  A. ISA

  B. BIA

  C. SLA

  D. RA

  Correct Answer: A

• Question 399:

  Security policies that are in place at an organization prohibit USB drives from being utilized across the entire enterprise, with adequate technical controls in place to block them. As a way to still be able to work from various locations on different computing resources, several sales staff members have signed up for a web-based storage solution without the consent of the IT department. However, the operations department is required to use the same service to transmit certain business partner documents.

  Which of the following would BEST allow the IT department to monitor and control this behavior?

  A. Enabling AAA

  B. Deploying a CASB

  C. Configuring an NGFW

  D. Installing a WAF

  E. Utilizing a vTPM

  Correct Answer: B

• Question 400:

  Following the successful response to a data-leakage incident, the incident team lead facilitates an exercise that focuses on continuous improvement of the organization's incident response capabilities. Which of the following activities has the incident team lead executed?

  A. Lessons learned review

  B. Root cause analysis

  C. Incident audit

  D. Corrective action exercise

  Correct Answer: A