CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 161:

  A developer wants to develop a secure external-facing web application. The developer is looking for an online community that produces tools, methodologies, articles, and documentation in the field of web-application security

  Which of the following is the BEST option?

  A. ICANN
  B. PCI DSS
  C. OWASP
  D. CSA
  E. NIST
  C. OWASP

  ---

  Explanation

• Question 162:

  A security officer at an organization that makes and sells digital artwork must ensure the integrity of the artwork can be maintained. Which of the following are the best ways for the security officer to accomplish this task? (Choose two.)

  A. Hashing
  B. ECC
  C. IPSec
  D. Tokenization
  E. Watermarking
  F. Print blocking
  A. Hashing
  E. Watermarking

  ---

  Explanation

  Implementing hashing and watermarking provides a comprehensive approach to maintaining the integrity of digital artwork. Hashing allows for verification of file integrity through checksums, while watermarking embeds ownership and authenticity information directly into the artwork, deterring unauthorized use and providing proof of ownership. Together, these measures help protect the organization's digital assets and ensure that customers receive genuine and unaltered digital artwork.

• Question 163:

  An organization recently started processing, transmitting, and storing its customers' credit card information. Within a week of doing so, the organization suffered a massive breach that resulted in the exposure of the customers' information. Which of the following provides the BEST guidance for protecting such information while it is at rest and in transit?

  A. NIST
  B. GDPR
  C. PCI DSS
  D. ISO
  C. PCI DSS

  ---

  Explanation

  https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard

• Question 164:

  Technicians have determined that the current server hardware is outdated, so they have decided to throw it out. Prior to disposal, which of the following is the BEST method to use to ensure no data remnants can be recovered?

  A. Drive wiping
  B. Degaussing
  C. Purging
  D. Physical destruction
  D. Physical destruction

  ---

  Explanation

• Question 165:

  An organization performed a risk assessment and discovered that less than 50% of its employees have been completing security awareness training.

  Which of the following should the Chief Information Security Officer highlight as an area of Increased vulnerability in a report to the management team?

  A. Social engineering
  B. Third-party compromise
  C. APT targeting
  D. Pivoting
  A. Social engineering

  ---

  Explanation

  The Chief Information Security Officer (CISO) should highlight social engineering as an area of increased vulnerability due to the lack of completion of security awareness training by employees. Social engineering attacks exploit human

  behavior, and employees who are not adequately trained are more likely to fall victim to phishing, pretexting, and other types of social engineering tactics. Increasing awareness and training helps employees recognize and respond

  appropriately to these threats.

  References:

  CompTIA CASP+ CAS-004 Exam Objectives: Section 4.3: Understand how to conduct risk management activities.

  CompTIA CASP+ Study Guide, Chapter 9: Risk Management and Incident Response.

• Question 166:

  A company recently migrated all its workloads to the cloud and implemented a transit VPC with a managed firewall. The cloud infrastructure implements a 10.0.0.0/16 network, and the firewall implements the following ACLs:

  

  The Chief Information Security Officer wants to monitor relevant traffic for signs of data exfiltration. Which of the following should the organization place in its monitoring tool to BEST detect data exfiltration while reducing log size and the time to search logs?

  A. FROM UDP 10.0.0.0/16 ANY TO 0.0.0.0/0 ANY
  B. FROM TCP 10.0.0.0/16 80,443 TO 0.0.0.0/0 ANY
  C. FROM TCP 0.0.0.0/0 ANY TO 10.0.0.0/16 80,443,22
  D. FROM IP 10.0.0.0/16 ANY TO 0.0.0.0/0 ANY
  E. FROM IP 0.0.0.0/0 ANY TO TCP 0.0.0.0/0 ANY
  F. FROM UDP 0.0.0.0/0 ANY TO 0.0.0.0/0 ANY
  B. FROM TCP 10.0.0.0/16 80,443 TO 0.0.0.0/0 ANY

  ---

  Explanation

• Question 167:

  A company hired a third-party consultant to run a cybersecurity incident simu-lation in order to identify security gaps and prepare stakeholders for a potential incident.

  Which of the following best describes this activity?

  A. Tabletop exercise
  B. Walk-through review
  C. Lessons learned
  D. Business impact analysis
  A. Tabletop exercise

• Question 168:

  An engineering team has deployed a new VPN service that requires client certificates to be used in order to successfully connect. On iOS devices, however, the following error occurs after importing the .p12 certificate file:

  mbedTLS: ca certificate is undefined

  Which of the following is the root cause of this issue?

  A. iOS devices have an empty root certificate chain by default.
  B. OpenSSL is not configured to support PKCS#12 certificate files.
  C. The VPN client configuration is missing the CA private key.
  D. The iOS keychain imported only the client public and private keys.
  D. The iOS keychain imported only the client public and private keys.

  ---

  Explanation

  Using the iOS keychain to store your private key has the added security advantage of leveraging on the hardware-backed keystores that exist on many iOS devices, allowing the key to be protected by the iOS-level device password, and preventing key compromise even if the device is rooted.

  If you already have your client certificate and private key bundled into a PKCS#12 file (extension .p12 or .pfx), you can import it into the app private section of the iOS Keychain using Mail, Safari or iTunes. Note sure that the file extension has to be changed to .ovpn12 for the file to be picked up by the OpenVPN Connect App (and not by iOS).

  Note that on iOS, when you import a PKCS#12 file into the Keychain, only the client certificate and private key are imported. The CA (certificate authority) certificates are NOT imported (unless you manually extract the CA certificates and import them separately, one-at-a-time). Therefore, the CA list must be given in the profile using the ca directive. If you already have a PKCS#12 file, the CA list may be extracted from the file using this openssl command, where the CA certs in client.p12 are written to ca.crt

• Question 169:

  A hospitality company experienced a data breach that included customer PII. The hacker used social engineering to convince an employee to grant a third-party application access to some company documents within a cloud file storage service Which of the following is the BEST solution to help prevent this type of attack in the future?

  A. NGFW for web traffic inspection and activity monitoring
  B. CSPM for application configuration control
  C. Targeted employee training and awareness exercises
  D. CASB for OAuth application permission control
  C. Targeted employee training and awareness exercises

  ---

  Explanation

• Question 170:

  A compliance officer is responsible for selecting the right governance framework to protect individuals' data. Which of the following is the appropriate framework for the company to consult when collecting international user data for the purpose of processing credit cards?

  A. ISO 27001
  B. COPPA
  C. NIST 800-53
  D. PCI DSS
  D. PCI DSS

  ---

  Explanation

  PCI DSS (Payment Card Industry Data Security Standard) is the most appropriate governance framework when collecting and processing credit card data, including international user data. PCI DSS establishes security standards for organizations that handle payment card transactions and ensures the protection of cardholder data globally. The other options, such as ISO 27001 and NIST 800-53, provide general security frameworks, but PCI DSS is specifically designed for payment card security, which is critical when handling credit card information. CASP+ emphasizes the role of PCI DSS in ensuring the secure handling of payment data.

  References: CASP+ CAS-004 Exam Objectives: Domain 1.0 Risk Management (PCI DSS Compliance for Payment Systems) CompTIA CASP+ Study Guide: Payment Systems Security and PCI DSS