CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 431:

  A company is repeatedly being breached by hackers who valid credentials. The company's Chief information Security Officer (CISO) has installed multiple controls for authenticating users, including biometric and token-based factors. Each successive control has increased overhead and complexity but has failed to stop further breaches. An external consultant is evaluating the process currently in place to support the authentication controls. Which of the following recommendation would MOST likely reduce the risk of unauthorized access?

  A. Implement strict three-factor authentication.
  B. Implement least privilege policies
  C. Switch to one-time or all
  D. Strengthen identify-proofing procedures
  A. Implement strict three-factor authentication.

• Question 432:

  A security analyst is trying to identify the source of a recent data loss incident The analyst has reviewed all the logs for the time surrounding the incident and identified all the assets on the network at the time of the data loss. The analyst suspects the key to finding the source was obfuscated in an application.

  Which of the following tools should the analyst use NEXT?

  A. Software decompiler
  B. Network enumerator
  C. Log reduction and analysis tool
  D. Static code analysis
  A. Software decompiler

• Question 433:

  Designing a system in which only information that is essential for a particular job task is allowed to be viewed can be accomplished successfully by using:

  A. mandatory vacations.
  B. job rotations
  C. role-based access control
  D. discretionary access
  E. separation of duties
  C. role-based access control

• Question 434:

  A database administrator is required to adhere to and implement privacy principles when executing daily tasks. A manager directs the administrator to reduce the number of unique instances of PII stored within an organization's systems to the greatest extent possible. Which of the following principles is being demonstrated?

  A. Administrator accountability
  B. PII security
  C. Record transparency
  D. Data minimization
  D. Data minimization

• Question 435:

  A large company is preparing to merge with a smaller company. The smaller company has been very profitable, but the smaller company's main applications were created in-house. Which of the following actions should the large company's security administrator take in preparation for the merger?

  A. A review of the mitigations implemented from the most recent audit findings of the smaller company should be performed.
  B. An ROI calculation should be performed to determine which company's application should be used.
  C. A security assessment should be performed to establish the risks of integration or co-existence.
  D. A regression test should be performed on the in-house software to determine security risks associated with the software.
  C. A security assessment should be performed to establish the risks of integration or co-existence.

  ---

  With any merger regardless of the monetary benefit there is always security risks and prior to the merger the security administrator should assess the security risks to as to mitigate these.

• Question 436:

  Ann, a member of the finance department at a large corporation, has submitted a suspicious email she received to the information security team. The team was not expecting an email from Ann, and it contains a PDF file inside a ZIP compressed archive. The information security learn is not sure which files were opened. A security team member uses an air-gapped PC to open the ZIP and PDF, and it appears to be a social engineering attempt to deliver an exploit.

  Which of the following would provide greater insight on the potential impact of this attempted attack?

  A. Run an antivirus scan on the finance PC.
  B. Use a protocol analyzer on the air-gapped PC.
  C. Perform reverse engineering on the document.
  D. Analyze network logs for unusual traffic.
  E. Run a baseline analyzer against the user's computer.
  B. Use a protocol analyzer on the air-gapped PC.

• Question 437:

  The risk manager has requested a security solution that is centrally managed, can easily be updated, and protects end users' workstations from both known and unknown malicious attacks when connected to either the office or home network. Which of the following would BEST meet this requirement?

  A. HIPS
  B. UTM
  C. Antivirus
  D. NIPS
  E. DLP
  A. HIPS

  ---

  In this question, we need to protect the workstations when connected to either the office or home network. Therefore, we need a solution that stays with the workstation when the user takes the computer home.

  A HIPS (Host Intrusion Prevention System) is software installed on a host which monitors the host for suspicious activity by analyzing events occurring within that host with the aim of detecting and preventing intrusion.

  Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it.

  Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent/block intrusions that are detected. More specifically, IPS can take such actions as sending an alarm, dropping the malicious packets, resetting the connection and/ or blocking the traffic from the offending IP address.

• Question 438:

  A security engineer on a large enterprise network needs to schedule maintenance within a fixed window of time. A total outage period of four hours is permitted for servers. Workstations can undergo maintenance from

  8:00

  pm to 6:00 am daily. Which of the following can specify parameters for the maintenance work? (Select TWO).

  A. Managed security service
  B. Memorandum of understanding
  C. Quality of service
  D. Network service provider
  E. Operating level agreement
  B. Memorandum of understanding
  E. Operating level agreement

  ---

  B: A memorandum of understanding (MOU) documents conditions and applied terms for outsourcing partner organizations that must share data and information resources. It must be signed by a re presentative from each organization that has the legal authority to sign and are typically secured, as they are considered confidential.

  E: An operating level agreement (O LA) defines the responsibilities of each partner's internal support group and what group and resources are used to meet the specified goal. It is used in conjunction with service level agreements (SLAs).

• Question 439:

  A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame for whose fault it was that the incident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner?

  A. During the Identification Phase
  B. During the Lessons Learned phase
  C. During the Containment Phase
  D. During the Preparation Phase
  B. During the Lessons Learned phase

  ---

  The Lessons Learned phase is the final step in the Incident Response process, when everyone involved reviews what happened and why.

• Question 440:

  A security administrator was informed that a server unexpectedly rebooted. The administrator received an export of syslog entries for analysis:

  

  Which of the following does the log sample indicate? (Choose two.)

  A. A root user performed an injection attack via kernel module
  B. Encrypted payroll data was successfully decrypted by the attacker
  C. Jsmith successfully used a privilege escalation attack
  D. Payroll data was exfiltrated to an attacker-controlled host
  E. Buffer overflow in memory paging caused a kernel panic
  F. Syslog entries were lost due to the host being rebooted
  C. Jsmith successfully used a privilege escalation attack
  E. Buffer overflow in memory paging caused a kernel panic