CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 51:

  A Chief Information Security Officer (CISO) has created a survey that will be distributed to managers of mission-critical functions across the organization The survey requires the managers to determine how long their respective units can operate in the event of an extended IT outage before the organization suffers monetary losses from the outage To which of the following is the survey question related? (Select TWO)

  A. Risk avoidance
  B. Business impact
  C. Risk assessment
  D. Recovery point objective
  E. Recovery time objective
  F. Mean time between failures
  B. Business impact
  D. Recovery point objective

• Question 52:

  An organization has been notified of a breach related to its sensitive data The point of compromise is the use of weak encryption algorithms on a web server that provides access to a legacy API The organization had previously decided to

  accept the nsk of using weak algorithms due to the cost to continually develop the legacy platform.

  Other system owners need to be aware of the increased likelihood of this threat.

  Which of the following should be reviewed by the CERT and presented to system owners to ensure a proper nsk analysis is performed?

  A. Lessons learned
  B. Incident log
  C. Risk register
  D. Root-cause analysis
  E. Gap analysis
  A. Lessons learned

• Question 53:

  The email administrator must reduce the number of phishing emails by utilizing more appropriate security controls The following configurations already are in place

  1.

  Keyword Mocking based on word lists

  2.

  URL rewriting and protection

  3.

  Stopping executable files from messages

  Which of the following is the BEST configuration change for the administrator to make?

  A. Configure more robust word lists for blocking suspicious emails
  B. Configure appropriate regular expression rules per suspicious email received
  C. Configure Bayesian filtering to block suspicious inbound email
  D. Configure the mail gateway to strip any attachments
  B. Configure appropriate regular expression rules per suspicious email received

• Question 54:

  Given the following code snippet:

  

  Of which of the following is this snippet an example?

  A. Data execution prevention
  B. Buffer overflow
  C. Failure to use standard libraries
  D. Improper filed usage
  E. Input validation
  D. Improper filed usage

• Question 55:

  A project manager is working with system owners to develop maintenance windows for system pathing and upgrades in a cloud-based PaaS environment. Management has indicated one maintenance windows will be authorized per month, but clients have stated they require quarterly maintenance windows to meet their obligations. Which of the following documents should the project manager review?

  A. MOU
  B. SOW
  C. SRTM
  D. SLA
  D. SLA

• Question 56:

  A security engineer is helping the web developers assess a new corporate web application The application will be Internet facing so the engineer makes the following recommendation:

  In an htaccess file or the site config add:

  or add to the location block:

  

  Which of the following is the security engineer trying to accomplish via cookies? (Select TWO)

  A. Ensure session IDs are generated dynamically with each cookie request
  B. Prevent cookies from being transmitted to other domain names
  C. Create a temporary space on the user's drive root for ephemeral cookie storage
  D. Enforce the use of plain text HTTP transmission with secure local cookie storage
  E. Add a sequence ID to the cookie session ID while in transit to prevent CSRF.
  F. Allow cookie creation or updates only over TLS connections
  A. Ensure session IDs are generated dynamically with each cookie request
  D. Enforce the use of plain text HTTP transmission with secure local cookie storage

• Question 57:

  An organization is concerned with potential data loss in the event of a disaster, and created a backup datacenter as a mitigation strategy. The current storage method is a single NAS used by all servers in both datacenters. Which of the following options increases data availability in the event of a datacenter failure?

  A. Replicate NAS changes to the tape backups at the other datacenter.
  B. Ensure each server has two HBAs connected through two routes to the NAS.
  C. Establish deduplication across diverse storage paths.
  D. Establish a SAN that replicates between datacenters.
  D. Establish a SAN that replicates between datacenters.

  ---

  A SAN is a Storage Area Network. It is an alternative to NAS storage. SAN replication is a technology that replicates the data on one SAN to another SAN; in this case, it would replicate the data to a SAN in the backup datacenter. In the event of a disaster, the SAN in the backup datacenter would contain all the data on the original SAN.

  Array-based replication is an approach to data backup in which compatible storage arrays use built-in software to automatically copy data from one storage array to another. Array-based replication software runs on one or more storage controllers resident in disk storage systems, synchronously or asynchronously replicating data between similar storage array models at the logical unit number (LUN) or volume block level. The term can refer to the creation of local copies of data within the same array as the source data, as well as the creation of remote copies in an array situated off site.

• Question 58:

  Due to a recent breach, the Chief Executive Officer (CEO) has requested the following activities be conducted during incident response planning:

  Involve business owners and stakeholders Create an applicable scenario Conduct a biannual verbal review of the incident response plan Report on the lessons learned and gaps identified

  Which of the following exercises has the CEO requested?

  A. Parallel operations
  B. Full transition
  C. Internal review
  D. Tabletop
  E. Partial simulation
  C. Internal review

• Question 59:

  A server was compromised recently, and two unauthorized daemons were set up to listen for incoming connections. In addition, CPU cycles were being used by an additional unauthorized cron job. Which of the following would have prevented the breach if it was properly configured?

  A. Set up log forwarding and utilize a SIEM for centralized management and alerting.
  B. Use a patch management system to close the vulnerabilities in a shorter time frame.
  C. Implement a NIDS/NIPS.
  D. Deploy SELinux using the system baseline as the starting point.
  E. Configure the host firewall to block unauthorized inbound connections.
  C. Implement a NIDS/NIPS.

• Question 60:

  An organization is preparing to develop a business continuity plan. The organization is required to meet regulatory requirements relating to confidentiality and availability, which are well-defined. Management has expressed concern following initial meetings that the organization is not fully aware of the requirements associated with the regulations.

  Which of the following would be MOST appropriate for the project manager to solicit additional resources for during this phase of the project?

  A. After-action reports
  B. Gap assessment
  C. Security requirements traceability matrix
  D. Business impact assessment
  E. Risk analysis
  B. Gap assessment