CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 511:

  A security is assisting the marketing department with ensuring the security of the organization's social media platforms. The two main concerns are:

  1.

  The Chief marketing officer (CMO) email is being used department wide as the username

  2.

  The password has been shared within the department

  Which of the following controls would be BEST for the analyst to recommend?

  A. Configure MFA for all users to decrease their reliance on other authentication.
  B. Have periodic, scheduled reviews to determine which OAuth configuration are set for each media platform.
  C. Create multiple social media accounts for all marketing user to separate their actions.
  D. Ensue the password being shared is sufficiently and not written down anywhere.
  A. Configure MFA for all users to decrease their reliance on other authentication.

• Question 512:

  An analyst discovers the following while reviewing some recent activity logs:

  

  Which of the following tools would MOST likely identify a future incident in a timely manner?

  A. DDoS protection
  B. File integrity monitoring
  C. SCAP scanner
  D. Protocol analyzer
  A. DDoS protection

  ---

  Reference: https7%ww cloudflare com/lp/DDc/ddos-m/?and bt=545481184035and bk=ddos%20protectionand bm=eand bn=qand bq=107086992232and placement=and tarqet=and loc=9076927and dv=candawsearchcpc=1andQclid=C|0KCQ [wv5uKBhD6ARIsAGv9a-xs25kzPU42pMSSkiJt03hbOoC8mxs4MIGe9rG9UDbakhBhBs30YaAikQEALwwcBandaclsrc=aw ds

• Question 513:

  It has come to the IT administrator's attention that the "post your comment" field on the company blog page has been exploited, resulting in cross-site scripting attacks against customers reading the blog. Which of the following would be the MOST effective at preventing the "post your comment" field from being exploited?

  A. Update the blog page to HTTPS
  B. Filter metacharacters
  C. Install HIDS on the server
  D. Patch the web application
  E. Perform client side input validation
  B. Filter metacharacters

  ---

  A general rule of thumb with regards to XSS is to "Never trust user input and always filter meta-characters."

• Question 514:

  Since the implementation of IPv6 on the company network, the security administrator has been unable to identify the users associated with certain devices utilizing IPv6 addresses, even when the devices are centrally managed. en1: flags=8863 mtu 1500 ether f8:1e:af:ab:10:a3 inet6 fw80::fa1e:dfff:fee6:9d8%en1 prefixlen 64 scopeid 0x5 inet 192.168.1.14 netmask 0xffffff00 broadcast 192.168.1.255 inet6 2001:200:5:922:1035:dfff:fee6:9dfe prefixlen 64 autoconf inet6 2001:200:5:922:10ab:5e21:aa9a:6393 prefixlen 64 autoconf temporary nd6 options=1 media: autoselect status: active Given this output, which of the following protocols is in use by the company and what can the system administrator do to positively map users with IPv6 addresses in the future? (Select TWO).

  A. The devices use EUI-64 format
  B. The routers implement NDP
  C. The network implements 6to4 tunneling
  D. The router IPv6 advertisement has been disabled
  E. The administrator must disable IPv6 tunneling
  F. The administrator must disable the mobile IPv6 router flag
  G. The administrator must disable the IPv6 privacy extensions
  H. The administrator must disable DHCPv6 option code 1
  B. The routers implement NDP
  G. The administrator must disable the IPv6 privacy extensions

  ---

  IPv6 makes use of the Neighbor Discovery Protocol (NDP). Thus if your routers implement NDP you will be able to map users with IPv6 addresses. However to be able to positively map users with IPv6 addresses you will need to disable IPv6 privacy extensions.

• Question 515:

  A consulting firm was hired to conduct assessment for a company. During the first stage, a penetration tester used a tool that provided the following output: TCP 80 open TCP 443 open TCP 1434 filtered The penetration tester then used a different tool to make the following requests: GET / script/login.php?token=45$MHT000MND876 GET / script/login.php?token=@#984DCSPQ%091DF Which of the following tools did the penetration tester use?

  A. Protocol analyzer
  B. Port scanner
  C. Fuzzer
  D. Brute forcer
  E. Log analyzer
  F. HTTP interceptor
  C. Fuzzer

• Question 516:

  A financial institution would like to store its customer data in a cloud but still allow the data to be accessed and manipulated while encrypted. Doing so would prevent the cloud service provider from being able to decipher the data due to its sensitivity. The financial institution is not concerned about computational overheads and slow speeds. Which of the following cryptographic techniques would BEST meet the requirement?

  A. Asymmetric
  B. Symmetric
  C. Homomorphic
  D. Ephemeral
  A. Asymmetric

• Question 517:

  An information security officer reviews a report and notices a steady increase in outbound network traffic over the past ten months. There is no clear explanation for the increase. The security officer interviews several business units and

  discovers an unsanctioned cloud storage provider was used to share marketing materials with potential customers.

  Which of the following services would be BEST for the security officer to recommend to the company?

  A. NIDS
  B. HIPS
  C. CASB
  D. SFTP
  C. CASB

• Question 518:

  Joe, a penetration tester, is tasked with testing the security robustness of the protocol between a mobile web application and a RESTful application server. Which of the following security tools would be required to assess the security between the mobile web application and the RESTful application server? (Select TWO).

  A. Jailbroken mobile device
  B. Reconnaissance tools
  C. Network enumerator
  D. HTTP interceptor
  E. Vulnerability scanner
  F. Password cracker
  D. HTTP interceptor
  E. Vulnerability scanner

  ---

  Communications between a mobile web application and a RESTful application server will use the HTTP protocol. To capture the HTTP communications for analysis, you should use an HTTP Interceptor.

  To assess the security of the application server itself, you should use a vulnerability scanner.

  A vulnerability scan is the automated process of proactively identifying security vulnerabilities of computing systems in a network in order to determine if and where a system can be exploited and/or threatened. While public servers are

  important for communication and data transfer over the Internet, they open the door to potential security breaches by threat agents, such as malicious hackers.

  Vulnerability scanning employs software that seeks out security flaws based on a database of known flaws, testing systems for the occurrence of these flaws and generating a report of the findings that an individual or an enterprise can use to

  tighten the network's security.

  Vulnerability scanning typically refers to the scanning of systems that are connected to the Internet but can also refer to system audits on internal networks that are not connected to the Internet in order to assess the threat of rogue software

  or malicious employees in an enterprise.

• Question 519:

  Ann, a systems engineer, is working to identify an unknown node on the corporate network. To begin her investigative work, she runs the following nmap command string: user@hostname:~$ sudo nmap 192.168.1.54 Based on the output, nmap is unable to identify the OS running on the node, but the following ports are open on the device: TCP/22 TCP/111 TCP/512-514 TCP/2049 TCP/32778 Based on this information, which of the following operating systems is MOST likely running on the unknown node?

  A. Linux
  B. Windows
  C. Solaris
  D. OSX
  C. Solaris

  ---

  TCP/22 is used for SSH; TCP/111 is used for Sun RPC; TCP/512-514 is used by CMD like exec, but automatic authentication is performed as with a login server, etc. These are all ports that are used when making use of the Sun Solaris operating system.

• Question 520:

  Several recent ransomware outbreaks at a company have cost a significant amount of lost revenue. The security team needs to find a technical control mechanism that will meet the following requirements and aid in preventing these outbreaks:

  Stop malicious software that does not match a signature Report on instances of suspicious behavior Protect from previously unknown threats Augment existing security capabilities

  Which of the following tools would BEST meet these requirements?

  A. Host-based firewall
  B. EDR
  C. HIPS
  D. Patch management
  C. HIPS