CompTIA CompTIA Advanced Security Practitioner CAS-003 Questions & Answers

• Question 41:

  An organization has been notified of a breach related to its sensitive data The point of compromise is the use of weak encryption algorithms on a web server that provides access to a legacy API The organization had previously decided to

  accept the nsk of using weak algorithms due to the cost to continually develop the legacy platform.

  Other system owners need to be aware of the increased likelihood of this threat.

  Which of the following should be reviewed by the CERT and presented to system owners to ensure a proper nsk analysis is performed?

  A. Lessons learned

  B. Incident log

  C. Risk register

  D. Root-cause analysis

  E. Gap analysis

  Correct Answer: A

• Question 42:

  Over the last 90 days, many private storage services have been exposed in the cloud services environments, and the security team does not have the ability to see who is creating these instances. Shadow IT is creating data services and instances faster than the email security team can keep up with them. The Chief Information Security Officer (CISO) has asked the security lead architect to recommend solutions to this problem.

  Which of the following BEST addresses the problem with the least amount of administrative effort?

  A. Compile a list of firewall requests and compare them against interesting cloud services

  B. Implement a CASB solution and track cloud service use cases for greater visibility

  C. Implement a user-behavior analytics system to associate user events with cloud service creation events

  D. Capture all logs and feed them to a SIEM. and then analyze for cloud service events.

  Correct Answer: D

• Question 43:

  An application developer has been informed of a web application that is susceptible to a clickjacking vulnerability Which of the following code snippets would be MOST applicable to resolve this vulnerability?

  A. Content-Security-Policy frame-ancestors: 'none'

  B. $escaped_command = escapeshellcmd(Sargs); exec ($escaped_command, Soutput, $return_var);

  C. sqlQuery= 'SELECT * FROM custTable WHERE User=? AND Pass=?' parameters.add("User", username)

  D. require 'digest/sha2' sha256 = Digest::SHA2.new(256)

  Correct Answer: A

  Content-Security-Policy: frame-ancestors 'none’;

  This prevents any domain from framing the content This setting is recommended unless a specific need has been identified for framing

• Question 44:

  During the migration of a company's human resources application to a PaaS provider, the Chief Privacy Officer (CPO) expresses concern the vendor's staff may be able to access data within the migrating application The application stack

  includes a multitier architecture and uses commercially available, vendor-supported software packages.

  Which of the following BEST addresses the CPO's concerns?

  A. Execute non-disclosure agreements and background checks on vendor staff

  B. Ensure the platform vendor implements data-at-rest encryption on its storage

  C. Enable MFA to the vendor's tier of the architecture

  D. Implement a CASB that tokenizes company data in transit to the migrated applications.

  Correct Answer: D

  Reference: https://www.omo.orQ/cloud/deliverables/CSCC-Miqratino-ApDlications-to-Public-Cloud-Sefvices-Roadmap-for-Success.pdf

• Question 45:

  Within change management, which of the following ensures functions are earned out by multiple employees?

  A. Least privilege

  B. Mandatory vacation

  C. Separation of duties

  D. Job rotation

  Correct Answer: C

  Reference: https://www aihr com/bloa/job-rotation/

• Question 46:

  An employee decides to log into an authorized system The system does not prompt the employee for authentication prior to granting access to the console, and it cannot authenticate the network resources. Which of the following attack types can this lead to if it is not mitigated?

  A. Memory leak

  B. Race condition

  C. Smurf

  D. Deadlock

  Correct Answer: C

  Reference: https://www imperva com/learn/ddos/smurf-attack-ddos/

• Question 47:

  A cybersecunty analyst receives a ticket that indicates a potential incident is occurring. There has been a large increase in log files generated by a website containing a ‘Contact Us' form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign or if this is a potential incident.

  Which of the following would BEST assist the analyst?

  A. Ensuring proper input validation is configured on the ‘Contact Us' form

  B. Deploying a WAF in front of the public website

  C. Checking for new rules from the inbound network IPS vendor

  D. Running the website log files through a log reduction and analysis tool

  Correct Answer: B

  By deploying a WAF in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects a client machine's identity by using an intermediary, a WAF is a type of reverse-proxy, protecting the server from exposure by having clients pass through the WAF before reaching the server

• Question 48:

  A developer implement the following code snippet.

  

  Which of the following vulnerabilities does the code snippet resolve?

  A. SQL inject

  B. Buffer overflow

  C. Missing session limit

  D. Information leakage

  Correct Answer: D

• Question 49:

  A security engineer at a company is designing a system to mitigate recent setbacks caused competitors that are beating the company to market with the new products. Several of the products incorporate propriety enhancements developed by the engineer's company. The network already includes a SEIM and a NIPS and requires 2FA for all user access. Which of the following system should the engineer consider NEXT to mitigate the associated risks?

  A. DLP

  B. Mail gateway

  C. Data flow enforcement

  D. UTM

  Correct Answer: A

• Question 50:

  Company A is establishing a contractual with Company B. The terms of the agreement are formalized in a document covering the payment terms, limitation of liability, and intellectual property rights. Which of the following documents will MOST likely contain these elements

  A. Company A-B SLA v2.docx

  B. Company A OLA v1b.docx

  C. Company A MSA v3.docx

  D. Company A MOU v1.docx

  E. Company A-B NDA v03.docx

  Correct Answer: A