CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 231:

  Which of the following testing plans is used to discuss disaster recovery scenarios with representatives from multiple departments within an incident response team but without taking any invasive actions?

  A. Disaster recovery checklist
  B. Tabletop exercise
  C. Full interruption test
  D. Parallel test
  B. Tabletop exercise

  ---

  Explanation

  A tabletop exercise is a type of testing plan that is used to discuss disaster recovery scenarios with representatives from multiple departments within an incident response team but without taking any invasive actions. A tabletop exercise is a

  simulation of a potential disaster or incident that involves a verbal or written discussion of how each department would respond to it. The purpose of a tabletop exercise is to identify gaps, weaknesses, or conflicts in the disaster recovery plan,

  and to improve communication and coordination among the team members.

  References: [CompTIA CASP+ Study Guide, Second Edition, page 455]

• Question 232:

  The Chief Information Security Officer of a startup company has asked a security engineer to implement a software security program in an environment that prev that previously had little oversight. Which of the following testing methods would be BEST for the engineer to utilize in this situation?

  A. Software composition analysis
  B. Code obfuscation
  C. Static analysis
  D. Dynamic analysis
  C. Static analysis

  ---

  Explanation

• Question 233:

  Which of the following best describes a risk associated with using facial recognition to locally authenticate to a mobile device?

  A. Data remanence
  B. Deepfake
  C. Metadata scraping
  D. Biometric impersonation
  D. Biometric impersonation

• Question 234:

  An application developer has been informed of a web application that is susceptible to a clickjacking vulnerability Which of the following code snippets would be MOST applicable to resolve this vulnerability?

  A. Content-Security-Policy frame-ancestors: 'none'
  B. $escaped_command = escapeshellcmd(Sargs); exec ($escaped_command, Soutput, $return_var);
  C. sqlQuery= 'SELECT * FROM custTable WHERE User=? AND Pass=?' parameters.add("User", username)
  D. require 'digest/sha2' sha256 = Digest::SHA2.new(256)
  A. Content-Security-Policy frame-ancestors: 'none'

  ---

  Explanation

  Content-Security-Policy: frame-ancestors 'none';

  This prevents any domain from framing the content This setting is recommended unless a specific need has been identified for framing

• Question 235:

  The Chief Information Security Officer of a large multinational organization has asked the security risk manager to use risk scenarios during a risk analysis.

  Which of the following is the most likely reason for this approach?

  A. To connect risks to business objectives
  B. To ensure a consistent approach to risk
  C. To present a comprehensive view of risk
  D. To provide context to the relevancy of risk
  D. To provide context to the relevancy of risk

• Question 236:

  Which of the following describes the system responsible for storing private encryption/decryption files with a third party to ensure these files are stored safely?

  A. Key escrow
  B. TPM
  C. Trust models
  D. Code signing
  A. Key escrow

  ---

  Explanation

• Question 237:

  A security architect is analyzing an old application that is not covered for maintenance anymore because the software company is no longer in business. Which of the following techniques should have been implemented to prevent these types of risks?

  A. Code reviews
  B. Supply chain visibility
  C. Software audits
  D. Source code escrows
  D. Source code escrows

  ---

  Explanation

• Question 238:

  A software developer created an application for a large, multinational company. The company is concerned the program code could be reverse engineered by a foreign entity and intellectual property would be lost. Which of the following techniques should be used to prevent this situation?

  A. Obfuscation
  B. Code signing
  C. Watermarking
  D. Digital certificates
  A. Obfuscation

  ---

  Explanation

  Obfuscation is a technique used to make the program code difficult to understand or read. It can help to prevent reverse engineering by making it more challenging to analyze the code and understand its structure and functionality, thereby protecting intellectual property.

• Question 239:

  A company is moving most of its customer-facing production systems to the cloud-facing production systems to the cloud. IaaS is the service model being used. The Chief Executive Officer is concerned about the type of encryption available and requires the solution must have the highest level of security.

  Which of the following encryption methods should the cloud security engineer select during the implementation phase?

  A. Instance-based
  B. Storage-based
  C. Proxy-based
  D. Array controller-based
  B. Storage-based

  ---

  Explanation

  We recommend that you encrypt your virtual hard disks (VHDs) to help protect your boot volume and data volumes at rest in storage, along with your encryption keys and secrets. Azure Disk Encryption helps you encrypt your Windows and Linux IaaS virtual machine disks. Azure Disk Encryption uses the industry-standard BitLocker feature of Windows and the DM-Crypt feature of Linux to provide volume encryption for the OS and the data disks. The solution is integrated with Azure Key Vault to help you control and manage the disk-encryption keys and secrets in your key vault subscription. The solution also ensures that all data on the virtual machine disks are encrypted at rest in Azure Storage. https:// docs.microsoft.com/en-us/azure/security/fundamentals/iaas

• Question 240:

  An organization is assessing the security posture of a new SaaS CRM system that handles sensitive PI I and identity information, such as passport numbers. The SaaS CRM system does not meet the organization's current security standards.

  The assessment identifies the following:

  1) There will be a 520,000 per day revenue loss for each day the system is delayed going into production.

  2) The inherent risk is high.

  3) The residual risk is low.

  4) There will be a staged deployment to the solution rollout to the contact center.

  Which of the following risk-handling techniques will BEST meet the organization's requirements?

  A. Apply for a security exemption, as the risk is too high to accept.
  B. Transfer the risk to the SaaS CRM vendor, as the organization is using a cloud service.
  C. Accept the risk, as compensating controls have been implemented to manage the risk.
  D. Avoid the risk by accepting the shared responsibility model with the SaaS CRM provider.
  C. Accept the risk, as compensating controls have been implemented to manage the risk.

  ---

  Explanation