CompTIA CompTIA Certifications CAS-003 Questions & Answers

• Question 511:

  A malware infection spread to numerous workstations within the marketing department. The workstations were quarantined and replaced with machines. Which of the following represents a FINAL step in the prediction of the malware?

  A. The workstations should be isolated from the network.

  B. The workstations should be donated for refuse.

  C. The workstations should be reimaged

  D. The workstations should be patched and scanned.

  Correct Answer: C

• Question 512:

  A security engineer is designing a system in which offshore, outsourced staff can push code from the development environment to the production environment securely. The security engineer is concerned with data loss, while the business does not want to slow down its development process. Which of the following solutions BEST balances security requirements with business need?

  A. Set up a VDI environment that prevents copying and pasting to the local workstations of outsourced staff members

  B. Install a client-side VPN on the staff laptops and limit access to the development network

  C. Create an IPSec VPN tunnel from the development network to the office of the outsourced staff

  D. Use online collaboration tools to initiate workstation-sharing sessions with local staff who have access to the development network

  Correct Answer: B

• Question 513:

  After multiple service interruptions caused by an older datacenter design, a company decided to migrate away from its datacenter. The company has successfully completed the migration of all datacenter servers and services to a cloud provider. The migration project includes the following phases:

  1.

  Selection of a cloud provider

  2.

  Architectural design

  3.

  Microservice segmentation

  4.

  Virtual private cloud

  5.

  Geographic service redundancy

  6.

  Service migration

  The Chief Information Security Officer (CISO) is still concerned with the availability requirements of critical company applications.

  Which of the following should the company implement NEXT?

  A. Multicloud solution

  B. Single-tenancy private cloud

  C. Hybrid cloud solution

  D. Cloud access security broker

  Correct Answer: D

• Question 514:

  The Chief Information Security Officer (CISO) suspects that a database administrator has been tampering with financial data to the administrator's advantage. Which of the following would allow a third-party consultant to conduct an on-site review of the administrator's activity?

  A. Separation of duties

  B. Job rotation

  C. Continuous monitoring

  D. Mandatory vacation

  Correct Answer: A

• Question 515:

  A business is growing and starting to branch out into other locations. In anticipation of opening an office in a different country, the Chief Information Security Officer (CISO) and legal team agree they need to meet the following criteria regarding data to open the new office:

  Store taxation-related documents for five years Store customer addresses in an encrypted format Destroy customer information after one year Keep data only in the customer's home country

  Which of the following should the CISO implement to BEST meet these requirements? (Choose three.)

  A. Capacity planning policy

  B. Data retention policy

  C. Data classification standard

  D. Legal compliance policy

  E. Data sovereignty policy

  F. Backup policy

  G. Acceptable use policy

  H. Encryption standard

  Correct Answer: BCH

• Question 516:

  During a criminal investigation, the prosecutor submitted the original hard drive from the suspect's computer as evidence. The defense objected during the trial proceedings, and the evidence was rejected. Which of the following practices should the prosecutor's forensics team have used to ensure the suspect's data would be admissible as evidence? (Select TWO.)

  A. Follow chain of custody best practices

  B. Create an identical image of the original hard drive, store the original securely, and then perform forensics only on the imaged drive.

  C. Use forensics software on the original hard drive and present generated reports as evidence

  D. Create a tape backup of the original hard drive and present the backup as evidence

  E. Create an exact image of the original hard drive for forensics purposes, and then place the original back in service

  Correct Answer: AB

• Question 517:

  A cybersecurity analyst has received an alert that well-known "call home" messages are continuously observed by network sensors at the network boundary. The proxy firewall successfully drops the massages. After determining the alert was a true positive, which of the following represents OST likely cause?

  A. Attackers are running reconnaissance on company resources.

  B. An outside command and control system is attempting to reach an infected system.

  C. An insider trying to exfiltrate information to a remote network.

  D. Malware is running on a company system

  Correct Answer: B

• Question 518:

  An insurance company has two million customers and is researching the top transactions on its customer portal. It identifies that the top transaction is currently password reset. Due to users not remembering their secret questions, a large number of calls are consequently routed to the contact center for manual password resets. The business wants to develop a mobile application to improve customer engagement in the future, continue with a single factor of authentication, minimize management overhead of the solution, remove passwords, and eliminate to the contact center.

  Which of the following techniques would BEST meet the requirements? (Choose two.)

  A. Magic link sent to an email address

  B. Customer ID sent via push notification

  C. SMS with OTP sent to a mobile number

  D. Third-party social login

  E. Certificate sent to be installed on a device

  F. Hardware tokens sent to customers

  Correct Answer: CE

• Question 519:

  A newly hired systems administrator is trying to connect a new and fully updated, but very customized, Android device to access corporate resources. However, the MDM enrollment process continually fails. The administrator asks a security team member to look into the issue.

  Which of the following is the MOST likely reason the MDM is not allowing enrollment?

  A. The OS version is not compatible

  B. The OEM is prohibited

  C. The device does not support FDE

  D. The device is rooted

  Correct Answer: D

• Question 520:

  Given the following information about a company's internal network:

  User IP space: 192.168.1.0/24

  Server IP space: 192.168.192.0/25

  A security engineer has been told that there are rogue websites hosted outside of the proper server space, and those websites need to be identified. Which of the following should the engineer do?

  A. Use a protocol analyzer on 192.168.1.0/24

  B. Use a port scanner on 192.168.1.0/24

  C. Use an HTTP interceptor on 192.168.1.0/24

  D. Use a port scanner on 192.168.192.0/25

  E. Use a protocol analyzer on 192.168.192.0/25

  F. Use an HTTP interceptor on 192.168.192.0/25

  Correct Answer: B