CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 551:

  A security architect has been assigned to a new digital transformation program. The objectives are to provide better capabilities to customers and reduce costs. The program has highlighted the following requirements:

  Long-lived sessions are required, as users do not log in very often.

  The solution has multiple SPs, which include mobile and web applications.

  A centralized IdP is utilized for all customer digital channels.

  The applications provide different functionality types such as forums and customer portals.

  The user experience needs to be the same across both mobile and web-based applications.

  Which of the following would BEST improve security while meeting these requirements?

  A. Social login to IdP, securely store the session cookies, and implement one-time passwords sent to the mobile device
  B. Create-based authentication to IdP, securely store access tokens, and implement secure push notifications.
  C. Username and password authentication to IdP, securely store refresh tokens, and implement context-aware authentication.
  D. Username and password authentication to SP, securely store Java web tokens, and implement SMS OTPs.
  A. Social login to IdP, securely store the session cookies, and implement one-time passwords sent to the mobile device

• Question 552:

  A security administrator wants to implement an MDM solution to secure access to company email and files in a BYOD environment The solution must support the following requirements:

  1.

  Company administrators should not have access to employee's personal information.

  2.

  A rooted or jailbroken device should not have access to company sensitive information. Which of the following BEST addresses the associated risks?

  A. Codesigning
  B. VPN
  C. FDE
  D. Containerization
  D. Containerization

• Question 553:

  A legacy web application, which is being used by a hospital, cannot be upgraded for 12 months. A new vulnerability is found in the legacy application, and the networking team is tasked with mitigation. Middleware for mitigation will cost $100,000 per year. Which of the following must be calculated to determine ROI? (Choose two.)

  A. ALE
  B. RTO
  C. MTBF
  D. ARO
  E. RPO
  A. ALE
  D. ARO

• Question 554:

  The email administrator must reduce the number of phishing emails by utilizing more appropriate security controls. The following configurations already are in place:

  1.

  Keyword blocking based on word lists

  2.

  URL rewnting and protection

  3.

  Stopping executable files from messages

  Which of the following is the BEST configuration change for the administrator to make?

  A. Configure more robust word lists for blocking suspicious emails
  B. Configure appropriate regular expression rules per suspicious email received
  C. Configure Bayesian filtering to block suspicious inbound email
  D. Configure the mail gateway to strip any attachments.
  B. Configure appropriate regular expression rules per suspicious email received

  ---

  Reference: https://www ibm.com/docs/en/rsoa-and-rD/36?tODic=Darsing-extension-customization

• Question 555:

  An organization relies heavily on third-party mobile applications for official use within a BYOD deployment scheme An excerpt from an approved text-based-chat client application AndroidManifest xml is as follows:

  

  Which of the following would restrict application permissions while minimizing the impact to normal device operations?

  A. Add the application to the enterprise mobile whitelist.
  B. Use the MDM to disable the devices' recording microphones and SMS.
  C. Wrap the application before deployment.
  D. Install the application outside of the corporate container.
  B. Use the MDM to disable the devices' recording microphones and SMS.

• Question 556:

  An intruder was recently discovered inside the data center, a highly sensitive area. To gain access, the intruder circumvented numerous layers of physical and electronic security measures. Company leadership has asked for a thorough review of physical security controls to prevent this from happening again. Which of the following departments are the MOST heavily invested in rectifying the problem? (Select THREE).

  A. Facilities management
  B. Human resources
  C. Research and development
  D. Programming
  E. Data center operations
  F. Marketing
  G. Information technology
  A. Facilities management
  E. Data center operations
  G. Information technology

  ---

  A: Facilities management is responsible for the physical security measures in a facility or building.

  E: The breach occurred in the data center, therefore the Data center operations would be greatly concerned.

  G: Data centers are important aspects of information technology (IT) in large corporations. Therefore the IT department would be greatly concerned.

• Question 557:

  Which of the following provides the BEST risk calculation methodology?

  A. Annual Loss Expectancy (ALE) x Value of Asset
  B. Potential Loss x Event Probability x Control Failure Probability
  C. Impact x Threat x Vulnerability
  D. Risk Likelihood x Annual Loss Expectancy (ALE)
  B. Potential Loss x Event Probability x Control Failure Probability

  ---

  Of the options given, the BEST risk calculation methodology would be Potential Loss x Event Probability x Control Failure Probability. This exam is about computer and data security so `loss' caused by risk is not necessarily a monetary value.

  For example:

  Potential Loss could refer to the data lost in the event of a data storage failure.

  Event probability could be the risk a disk drive or drives failing.

  Control Failure Probability could be the risk of the storage RAID not being able to handle the number of failed hard drives without losing data.

• Question 558:

  A security researcher at an organization is reviewing potential threats to the VoIP phone system infrastructure, which uses a gigabit Internet connection. The researcher finds a vulnerability and knows placing an IPS in front of the phone system will mitigate the risk. The researcher gathers the following information about various IPS systems:

  

  The organization is concerned about cost, but call quality is critical to its operations. Which of the following vendors would be BEST for the organization to choose?

  A. Vendor 1
  B. Vendor 2
  C. Vendor 3
  D. Vendor 4
  E. Vendor 5
  C. Vendor 3

• Question 559:

  A security engineer is working with a software development team. The engineer is tasked with ensuring all security requirements are adhered to by the developers. Which of the following BEST describes the contents of the supporting document the engineer is creating?

  A. A series of ad-hoc tests that each verify security control functionality of the entire system at once.
  B. A series of discrete tasks that, when viewed in total, can be used to verify and document each individual constraint from the SRTM.
  C. A set of formal methods that apply to one or more of the programing languages used on the development project.
  D. A methodology to verify each security control in each unit of developed code prior to committing the code.
  D. A methodology to verify each security control in each unit of developed code prior to committing the code.

• Question 560:

  The Chief Information Officer (CIO) is reviewing the IT centric BIA and RA documentation. The documentation shows that a single 24 hours downtime in a critical business function will cost the business $2.3 million. Additionally, the business unit which depends on the critical business function has determined that there is a high probability that a threat will materialize based on historical data. The CIO's budget does not allow for full system hardware replacement in case of a catastrophic failure, nor does it allow for the purchase of additional compensating controls. Which of the following should the CIO recommend to the finance director to minimize financial loss?

  A. The company should mitigate the risk.
  B. The company should transfer the risk.
  C. The company should avoid the risk.
  D. The company should accept the risk.
  B. The company should transfer the risk.

  ---

  To transfer the risk is to deflect it to a third party, by taking out insurance for example.