CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 101:

  A SOC analyst received an alert about a potential compromise and is reviewing the following SIEM logs:

  

  Which of the following is the most appropriate action for the SOC analyst to recommend?

  A. Disabling account JDoe to prevent further lateral movement
  B. Isolating laptop314 from the network
  C. Alerting JDoe about the potential account compromise
  D. Creating HIPS and NIPS rules to prevent logins
  B. Isolating laptop314 from the network

  ---

  Explanation

  The SIEM logs indicate suspicious behavior that could be a sign of a compromise, such as the launching of cmd.exe after Outlook.exe, which is atypical user behavior and could indicate that a machine has been compromised to perform lateral movement within the network. Isolating laptop314 from the network would contain the threat and prevent any potential spread to other systems while further investigation takes place.

• Question 102:

  A mobile device hardware manufacturer receives the following requirements from a company that wants to produce and sell a new mobile platform:

  1.The platform should store biometric data.

  2.The platform should prevent unapproved firmware from being loaded.

  3.A tamper-resistant, hardware-based counter should track if unapproved firmware was loaded.

  Which of the following should the hardware manufacturer implement? (Select three).

  A. ASLR
  B. NX
  C. eFuse
  D. SED
  E. SELinux
  F. Secure boot
  G. Shell restriction
  H. Secure enclave
  C. eFuse
  F. Secure boot
  H. Secure enclave

  ---

  Explanation

  To meet the mobile platform security requirements, the manufacturer should implement the following technologies:

  eFuse: This hardware feature helps track and prevent unauthorized firmware by physically "blowing" fuses to record events, such as firmware tampering, making it impossible to revert to older, unapproved firmware. Secure boot: This ensures

  that only trusted and authorized firmware can be loaded during the boot process, preventing malicious or unauthorized software from running. Secure enclave: A secure enclave is used to store sensitive information like biometric data in a

  hardware-isolated environment, protecting it from tampering or unauthorized access. These three solutions provide the tamper resistance, secure firmware validation, and protection of sensitive data required for the platform. CASP+

  emphasizes the use of hardware-based security features for protecting sensitive information and enforcing secure boot processes in embedded and mobile systems.

  References:

  CASP+ CAS-004 Exam Objectives: Domain 3.0

  Enterprise Security Architecture (Secure Hardware and Firmware Protection)

  CompTIA CASP+ Study Guide: Hardware Security Features (eFuse, Secure Boot, Secure Enclave)

• Question 103:

  A company would like to obfuscate PII data accessed by an application that is housed in a database to prevent unauthorized viewing. Which of the following should the company do to accomplish this goal?

  A. Use cell-level encryption.
  B. Mask the data.
  C. Implement a DLP solution.
  D. Utilize encryption at rest.
  B. Mask the data.

  ---

  Explanation

• Question 104:

  An auditor needs to scan documents at rest for sensitive text. These documents contain both text and Images. Which of the following software functionalities must be enabled in the DLP solution for the auditor to be able to fully read these documents? (Select TWO).

  A. Document interpolation
  B. Regular expression pattern matching
  C. Optical character recognition functionality
  D. Baseline image matching
  E. Advanced rasterization
  F. Watermarking
  B. Regular expression pattern matching
  C. Optical character recognition functionality

  ---

  Explanation

• Question 105:

  A forensic investigator would use the foremost command for:

  A. cloning disks.
  B. analyzing network-captured packets.
  C. recovering lost files.
  D. extracting features such as email addresses.
  C. recovering lost files.

  ---

  Explanation

  https://www.networkworld.com/article/2333727/foremost--a-linux-computer-forensics-tool.html

• Question 106:

  A bank has multiple subsidiaries that have independent infrastructures. The bank's support teams manage all these environments and want to use a single set of credentials. Which of the following is the BEST way to achieve this goal?

  A. SSO
  B. Federation
  C. Cross-domain
  D. Shared credentials
  B. Federation

  ---

  Explanation

  This is federation. SSO is single credentials to access multiple applications or resources within a single domain/org, whereas federation allows single sign on to application across multiple domains or organization. Since the subsidiaries have independent infrastructures, this is federation. https://www.pingidentity.com/en/resources/blog/post/sso-vs-federated-identity-management.html

• Question 107:

  When managing and mitigating SaaS cloud vendor risk, which of the following responsibilities belongs to the client?

  A. Data
  B. Storage
  C. Physical security
  D. Network
  A. Data

  ---

  Explanation

  In a SaaS cloud service model, the client is typically responsible for the data, including its security and compliance aspects. The SaaS provider would handle the infrastructure, including physical security and network security, but the client must ensure the data they input into the SaaS application is protected in line with their own security policies and compliance requirements.

• Question 108:

  A pharmaceutical company uses a cloud provider to host thousands of independent resources in object storage. The company needs a practical and effective means of discovering data, monitoring changes, and identifying suspicious activity. Which of the following would best meet these requirements?

  A. A machine-learning-based data security service
  B. A file integrity monitoring service
  C. A cloud configuration assessment and compliance service
  D. A cloud access security broker
  D. A cloud access security broker

  ---

  Explanation

  A cloud access security broker, often abbreviated (CASB), is a security policy enforcement point positioned between enterprise users and cloud service providers.

  CASBs can combine multiple different security policies, from authentication and credential mapping to encryption, malware detection, and more, offering flexible enterprise solutions that help ensure cloud app security across authorized and

  unauthorized applications, and managed and unmanaged devices.

  Key benefits of CASBs

  CASBs offer a range of security benefits that allow enterprises to mitigate risk, enforce policies across various applications and devices, and maintain regulatory compliance.

  1. Shadow IT assessment and management 2.Granular cloud usage control

  3.Data loss prevention (DLP)

  4.Risk visibility

  5.Threat prevention

• Question 109:

  DRAG DROP

  IT staff within a company often conduct remote desktop sharing sessions with vendors to troubleshoot vendor product-related issues. Drag and drop the following security controls to match the associated security concern. Options may be used once or not at all.

  Select and Place:

  

  

  Explanation

  Vendor may accidentally or maliciously make changes to the IT system - Allow view-only access.

  With view-only access, the third party can view the desktop but cannot interact with it. In other words, they cannot control the keyboard or mouse to make any changes.

  Desktop sharing traffic may be intercepted by network attackers - Use SSL for remote sessions.

  SSL (Secure Sockets Layer) encrypts data in transit between computers. If an attacker intercepted the traffic, the data would be encrypted and therefore unreadable to the attacker.

  No guarantees that shoulder surfing attacks are not occurring at the vendor - Identified control gap.

  Shoulder surfing is where someone else gains information by looking at your computer screen. This should be identified as a risk. A control gap occurs when there are either insufficient or no actions taken to avoid or mitigate a significant risk.

  Vendor may inadvertently see confidential material from the company such as email and IMs - Limit desktop session to certain windows.

  The easiest way to prevent a third party from viewing your emails and IMs is to close the email and IM application windows for the duration of the desktop sharing session.

• Question 110:

  A company is designing a new system that must have high security. This new system has the following requirements:

  1.Permissions must be assigned based on role.

  2.Fraud from a single person must be prevented.

  3.A single entity must not have full access control.

  Which of the following can the company use to meet these requirements?

  A. Dual responsibility
  B. Separation of duties
  C. Need to know
  D. Least privilege
  B. Separation of duties

  ---

  Explanation