CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 761:

  A new piece of ransomware got installed on a company's backup server which encrypted the hard drives containing the OS and backup application configuration but did not affect the deduplication data hard drives. During the incident response, the company finds that all backup tapes for this server are also corrupt. Which of the following is the PRIMARY concern?

  A. Determining how to install HIPS across all server platforms to prevent future incidents
  B. Preventing the ransomware from re-infecting the server upon restore
  C. Validating the integrity of the deduplicated data
  D. Restoring the data will be difficult without the application configuration
  D. Restoring the data will be difficult without the application configuration

  ---

  Ransomware is a type of malware that restricts access to a computer system that it infects in some way, and demands that the user pay a ransom to the operators of the malware to remove the restriction.

  Since the backup application configuration is not accessible, it will require more effort to recover the data.

  Eradication and Recovery is the fourth step of the incident response. It occurs before preventing future problems.

• Question 762:

  A government agency considers confidentiality to be of utmost importance and availability issues to be of least importance. Knowing this, which of the following correctly orders various vulnerabilities in the order of MOST important to LEAST important?

  A. Insecure direct object references, CSRF, Smurf
  B. Privilege escalation, Application DoS, Buffer overflow
  C. SQL injection, Resource exhaustion, Privilege escalation
  D. CSRF, Fault injection, Memory leaks
  A. Insecure direct object references, CSRF, Smurf

  ---

  Insecure direct object references are used to access data. CSRF attacks the functions of a web site which could access data. A Smurf attack is used to take down a system.

  A direct object reference is likely to occur when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key without any validation mechanism which will allow attackers to manipulate these references to access unauthorized data.

  Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious Web site, email, blog, instant message, or program causes a user's Web browser to perform an unwanted action on a trusted site for which the user is currently authenticated. The impact of a successful cross-site request forgery attack is limited to the capabilities exposed by the vulnerable application. For example, this attack could result in a transfer of funds, changing a password, or purchasing an item in the user's context. In effect, CSRF attacks are used by an attacker to make a target system perform a function (funds Transfer, form submission etc.) via the target's browser without knowledge of the target user, at least until the unauthorized function has been committed.

  A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the subnet. Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the attacker's victim. All the hosts receiving the PING request reply to this victim's address instead of the real sender's address. A single attacker sending hundreds or thousands of these PING messages per second can fill the victim's T-1 (or even T-3) line with ping replies, bring the entire Internet service to its knees.

  Smurfing falls under the general category of Denial of Service attacks -- security attacks that don't try to steal information, but instead attempt to disable a computer or network.

• Question 763:

  Ann, a security manager, is reviewing a threat feed that provides information about attacks that allow a malicious user to gain access to private contact lists. Ann receives a notification that the vulnerability can be exploited within her environment. Given this information, Ann can anticipate an increase in:

  A. vishing attacks
  B. SQL injections attacks
  C. web application attacks
  D. brute-force attacks
  B. SQL injections attacks

• Question 764:

  The Chief Information Security Officer (CISO) at a company knows that many users store business documents on public cloud-based storage, and realizes this is a risk to the company. In response, the CISO implements a mandatory training course in which all employees are instructed on the proper use of cloud-based storage. Which of the following risk strategies did the CISO implement?

  A. Avoid
  B. Accept
  C. Mitigate
  D. Transfer
  C. Mitigate

  ---

  Mitigation means that a control is used to reduce the risk. In this case, the control is training.

• Question 765:

  A developer has executed code for a website that allows users to search for employees' phone numbers by last name. The query string sent by the browser is as follows:

  http://www.companywebsite.com/search.php?q=SMITH

  The developer has implemented a well-known JavaScript sanitization library and stored procedures, but a penetration test shows the website is vulnerable to XSS. Which of the following should the developer implement NEXT to prevent XSS? (Choose two.)

  A. Sanitization library
  B. Secure cookies
  C. TLS encryption
  D. Input serialization
  E. Output encoding
  F. PUT form submission
  A. Sanitization library
  E. Output encoding

• Question 766:

  In the past, the risk committee at Company A has shown an aversion to even minimal amounts of risk acceptance. A security engineer is preparing recommendations regarding the risk of a proposed introducing legacy ICS equipment. The project will introduce a minor vulnerability into the enterprise. This vulnerability does not significantly expose the enterprise to risk and would be expensive against.

  Which of the following strategies should the engineer recommended be approved FIRST?

  A. Avoid
  B. Mitigate
  C. Transfer
  D. Accept
  B. Mitigate

• Question 767:

  Following the most recent patch deployment, a security engineer receives reports that the ERP application is no longer accessible. The security engineer reviews the situation and determines a critical security patch that was applied to the ERP server is the cause. The patch is subsequently backed out Which of the following security controls would be BEST to implement to mitigate the threat caused by the missing patch?

  A. Anti-malware
  B. Patch testing
  C. HIPS
  D. Vulnerability scanner
  B. Patch testing

• Question 768:

  A Chief Information Security Officer (CISO) implemented MFA for all accounts in parallel with the BYOD policy. After the implementation, employees report the increased authentication method is causing increased time to tasks. This applies both to accessing the email client on the workstation and the online collaboration portal. Which of the following should be the CISO implement to address the employees' concerns?

  A. Create an exception for the company's IPs.
  B. Implement always-on VPN.
  C. Configure the use of employee PKI authentication for email.
  D. Allow the use of SSO.
  D. Allow the use of SSO.

• Question 769:

  A development team is testing an in-house-developed application for bugs. During the test, the application crashes several times due to null pointer exceptions. Which of the following tools, if integrated into an IDE during coding, would identify these bugs routinely?

  A. Issue tracker
  B. Static code analyzer
  C. Source code repository
  D. Fuzzing utility
  D. Fuzzing utility

• Question 770:

  A penetration tester is given an assignment to gam physical access to a secure facility with perimeter cameras. The secure facility does not accept visitors, and entry is available only through a door protected by an RFID key and a guard stationed inside the door.

  Which of the following would be BEST for the penetration tester to attempt?

  A. Gain entry into the building by posing as a contractor who is performing routine building maintenance
  B. Tailgate into the facility with an employee who has a valid RFID badge to enter
  C. Duplicate an employee's RFID badge and use an IR camera to see when the guard leaves the post
  D. Look for an open window that can be used to gain unauthorized entry into the facility.
  C. Duplicate an employee's RFID badge and use an IR camera to see when the guard leaves the post