CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 61:

  An assessor identifies automated methods for identifying security control compliance through validating sensors at the endpoint and at Tier 2. Which of the following practices satisfy continuous monitoring of authorized information systems?

  A. Independent verification and validation
  B. Security test and evaluation
  C. Risk assessment
  D. Ongoing authorization
  D. Ongoing authorization

  ---

  Ongoing assessment and authorization is often referred to as continuous monitoring. It is a process that determines whether the set of deployed security controls in an information system continue to be effective with regards to planned and unplanned changes that occur in the system and its environment over time.

  Continuous monitoring allows organizations to evaluate the operating effectiveness of controls on or near a real-time basis. Continuous monitoring enables the enterprise to detect control failures quickly because it transpires immediately or closely after events in which the key controls are utilized.

• Question 62:

  A security analyst has requested network engineers integrate sFlow into the SOC's overall monitoring picture. For this to be a useful addition to the monitoring capabilities, which of the following must be considered by the engineering team?

  A. Effective deployment of network taps
  B. Overall bandwidth available at Internet PoP
  C. Optimal placement of log aggregators
  D. Availability of application layer visualizers
  D. Availability of application layer visualizers

• Question 63:

  Click on the exhibit buttons to view the four messages.

  

  

  A security architect is working with a project team to deliver an important service that stores and processes customer banking details. The project, internally known as ProjectX, is due to launch its first set of features publicly within a week, but the team has not been able to implement encryption-at-rest of the customer records. The security architect is drafting an escalation email to senior leadership.

  Which of the following BEST conveys the business impact for senior leadership?

  A. Message 1
  B. Message 2
  C. Message 3
  D. Message 4
  D. Message 4

• Question 64:

  Legal authorities notify a company that its network has been compromised for the second time in two years. The investigation shows the attackers were able to use the same vulnerability on different systems in both attacks. Which of the following would have allowed the security team to use historical information to protect against the second attack?

  A. Key risk indicators
  B. Lessons learned
  C. Recovery point objectives
  D. Tabletop exercise
  A. Key risk indicators

• Question 65:

  The Chief Executive Officer (CEO) of a large prestigious enterprise has decided to reduce business costs by outsourcing to a third party company in another country. Functions to be outsourced include: business analysts, testing, software development and back office functions that deal with the processing of customer data. The Chief Risk Officer (CRO) is concerned about the outsourcing plans. Which of the following risks are MOST likely to occur if adequate controls are not implemented?

  A. Geographical regulation issues, loss of intellectual property and interoperability agreement issues
  B. Improper handling of client data, interoperability agreement issues and regulatory issues
  C. Cultural differences, increased cost of doing business and divestiture issues
  D. Improper handling of customer data, loss of intellectual property and reputation damage
  D. Improper handling of customer data, loss of intellectual property and reputation damage

  ---

  The risk of security violations or compromised intellectual property (IP) rights is inherently elevated when working internationally. A key concern with outsourcing arrangements is making sure that there is sufficient protection and security in place for personal information being transferred and/or accessed under an outsourcing agreement.

• Question 66:

  A penetration test is being scoped for a set of web services with API endpoints. The APIs will be hosted on existing web application servers. Some of the new APIs will be available to unauthenticated users, but some will only be available to authenticated users. Which of the following tools or activities would the penetration tester MOST likely use or do during the engagement? (Select TWO.)

  A. Static code analyzer
  B. Intercepting proxy
  C. Port scanner
  D. Reverse engineering
  E. Reconnaissance gathering
  F. User acceptance testing
  B. Intercepting proxy
  E. Reconnaissance gathering

• Question 67:

  A new corporate policy requires that all employees have access to corporate resources on personal mobile devices The information assurance manager is concerned about the potential for inadvertent and malicious data disclosure if a device is lost, while users are concerned about corporate overreach. Which of the following controls would address these concerns and should be reflected in the company's mobile device policy?

  A. Place corporate applications in a container
  B. Enable geolocation on all devices
  C. install remote wiping capabilities
  D. Ensure all company communications use a VPN
  A. Place corporate applications in a container

• Question 68:

  A security is testing a server finds the following in the output of a vulnerability scan:

  

  Which of the following will the security analyst most likely use NEXT to explore this further?

  A. Exploitation framework
  B. Reverse engineering tools
  C. Vulnerability scanner
  D. Visualization tool
  A. Exploitation framework

• Question 69:

  A penetration tester is inspecting traffic on a new mobile banking application and sends the following web request:

  POST

  http://www.example.com/resources/NewBankAccount HTTP/1.1

  Content-type: application/json

  {

  "account":

  [

  { "creditAccount":"Credit Card Rewards account"}

  { "salesLeadRef":"www.example.com/badcontent/exploitme.exe"}

  ],

  "customer":

  [

  { "name":"Joe Citizen"}

  { "custRef":"3153151"}

  ]

  }

  The banking website responds with:

  HTTP/1.1 200 OK

  {

  "newAccountDetails":

  [

  { "cardNumber":"1234123412341234"}

  { "cardExpiry":"2020-12-31"}

  { "cardCVV":"909"}

  ],

  "marketingCookieTracker":"JSESSIONID=000000001"

  "returnCode":"Account added successfully"

  }

  Which of the following are security weaknesses in this example? (Select TWO).

  A. Missing input validation on some fields
  B. Vulnerable to SQL injection
  C. Sensitive details communicated in clear-text
  D. Vulnerable to XSS
  E. Vulnerable to malware file uploads
  F. JSON/REST is not as secure as XML
  A. Missing input validation on some fields
  C. Sensitive details communicated in clear-text

  ---

  The SalesLeadRef field has no input validation. The penetration tester should not be able to enter "www.example.com/badcontent/exploitme.exe" in this field. The credit card numbers are communicated in clear text which makes it vulnerable to an attacker. This kind of information should be encrypted.

• Question 70:

  Following a merger, the number of remote sites for a company has doubled to 52. The company has decided to secure each remote site with an NGFW to provide web filtering, NIDS/NIPS, and network antivirus. The Chief Information Officer (CIO) has requested that the security engineer provide recommendations on sizing for the firewall with the requirements that it be easy to manage and provide capacity for growth.

  The tables below provide information on a subset of remote sites and the firewall options: Which of the following would be the BEST option to recommend to the CIO?

  

  A. Vendor C for small remote sites, and Vendor B for large sites.
  B. Vendor B for all remote sites
  C. Vendor C for all remote sites
  D. Vendor A for all remote sites
  E. Vendor D for all remote sites
  D. Vendor A for all remote sites