CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 401:

  Drag and drop the cloud deployment model to the associated use-case scenario. Options may be used only once or not at all.

  Select and Place:

  

  

• Question 402:

  A government organization operates and maintains several ICS environments. The categorization of one of the ICS environments led to a moderate baseline. The organization has complied a set of applicable security controls based on this categorization.

  Given that this is a unique environment, which of the following should the organization do NEXT to determine if other security controls should be considered?

  A. Check for any relevant or required overlays.
  B. Review enhancements within the current control set.
  C. Modify to a high-baseline set of controls.
  D. Perform continuous monitoring.
  C. Modify to a high-baseline set of controls.

• Question 403:

  A security architect has designated that a server segment of an enterprise network will require each server to have secure and measured boot capabilities. The architect now wishes to ensure service consumers and peers can verify the integrity of hosted services. Which of the following capabilities must the architect consider for enabling the verification?

  A. Centralized attestation server
  B. Enterprise HSM
  C. vTPM
  D. SIEM
  B. Enterprise HSM

• Question 404:

  An application has been through a peer review and regression testing and is prepared for release. A security engineer is asked to analyze an application binary to look for potential vulnerabilities prior to wide release. After thoroughly analyzing the application, the engineer informs the developer it should include additional input sanitation in the application to prevent overflows. Which of the following tools did the security engineer MOST likely use to determine this recommendation?

  A. Fuzzer
  B. HTTP interceptor
  C. Vulnerability scanner
  D. SCAP scanner
  A. Fuzzer

• Question 405:

  At 9:00 am each morning, all of the virtual desktops in a VDI implementation become extremely slow and/or unresponsive. The outage lasts for around 10 minutes, after which everything runs properly again. The administrator has traced the problem to a lab of thin clients that are all booted at 9:00 am each morning. Which of the following is the MOST likely cause of the problem and the BEST solution? (Select TWO).

  A. Add guests with more memory to increase capacity of the infrastructure.
  B. A backup is running on the thin clients at 9am every morning.
  C. Install more memory in the thin clients to handle the increased load while booting.
  D. Booting all the lab desktops at the same time is creating excessive I/O.
  E. Install 10-Gb uplinks between the hosts and the lab to increase network capacity.
  F. Install faster SSD drives in the storage system used in the infrastructure.
  G. The lab desktops are saturating the network while booting.
  H. The lab desktops are using more memory than is available to the host systems.
  D. Booting all the lab desktops at the same time is creating excessive I/O.
  F. Install faster SSD drives in the storage system used in the infrastructure.

  ---

  The problem lasts for 10 minutes at 9am every day and has been traced to the lab desktops. This question is asking for the MOST likely cause of the problem. The most likely cause of the problem is that the lab desktops being started at the same time at the beginning of the day is causing excessive disk I/O as the operating systems are being read and loaded from disk storage.

  The solution is to install faster SSD drives in the storage system that contains the desktop operating systems.

• Question 406:

  A developer implement the following code snippet.

  

  Which of the following vulnerabilities does the code snippet resolve?

  A. SQL inject
  B. Buffer overflow
  C. Missing session limit
  D. Information leakage
  D. Information leakage

• Question 407:

  A new employee is plugged into the network on a BYOD machine but cannot access the network Which of the following must be configured so the employee can connect to the network?

  A. Port security
  B. Firewall
  C. Remote access
  D. VPN
  A. Port security

• Question 408:

  A company is deploying a DIP solution and scanning workstations and network drives for documents that contain potential Pll and payment card data. The results of the first scan are as follows:

  

  The security learn is unable to identify the data owners for the specific files in a timely manner and does not suspect malicious activity with any of the detected files. Which of the following would address the inherent risk until the data owners can be formally identified?

  A. Move the files from the marketing share to a secured drive.
  B. Search the metadata for each file to locate the file's creator and transfer the files to the personal drive of the listed creator.
  C. Configure the DLP tool to delete the files on the shared drives
  D. Remove the access for the internal audit group from the accounts payable and payroll shares
  A. Move the files from the marketing share to a secured drive.

• Question 409:

  Following the merger of two large companies the newly combined security team is overwhelmed by the volume of logs flowing from the IT systems The company's data retention schedule complicates the issue by requiring detailed logs to be collected and available for months Which of the following designs BEST meets the company's security and retention requirement?

  A. Forward logs to both a SlEM and a cheaper longer-term storage and then delete logs from the SlEM after 14 days
  B. Reduce the log volume by disabling logging of routine maintenance activities or failed authentication attempts
  C. Send logs to a SlEM that correlates security data and store only the alerts and relevant data arising from that system.
  D. Maintain both companies' logging and SlEM solutions separately but merge the resulting alerts and reports.
  C. Send logs to a SlEM that correlates security data and store only the alerts and relevant data arising from that system.

• Question 410:

  An organization is struggling to differentiate threats from normal traffic and access to systems. A security engineer has been asked to recommend a system that will aggregate data and provide metrics that will assist in identifying malicious actors or other anomalous activity throughout the environment. Which of the following solutions should the engineer recommend?

  A. Web application firewall
  B. SIEM
  C. IPS
  D. UTM
  E. File integrity monitor
  B. SIEM