CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 471:

  A vulnerability scanner detected an obsolete version of an open-source file-sharing application on one of a company's Linux servers. While the software version is no longer supported by the OSS community, the company's Linux vendor backported fixes, applied them for all current vulnerabilities, and agrees to support the software in the future.

  Based on this agreement, this finding is BEST categorized as a:

  A. true positive.
  B. true negative.
  C. false positive.
  D. false negative.
  C. false positive.

  ---

  Explanation

• Question 472:

  An organization is designing a MAC scheme (or critical servers running GNU/Linux. The security engineer is investigating SELinux but is confused about how to read labeling contexts. The engineer executes the command stat ./secretfile and receives the following output:

  

  Which of the following describes the correct order of labels shown in the output above?

  A. Role, type MLS level, and user identity
  B. Role, user identity, object, and MLS level
  C. Object MLS level, role, and type
  D. User identity, role, type, and MLS level
  E. Object, user identity, role, and MLS level
  D. User identity, role, type, and MLS level

  ---

  Explanation

  SELinux contexts are typically made up of several components, including the user identity, role, type (also known as domain or type), and MLS (Multi-Level Security) level. The context format is user:role:type:level. In the given output sys:secret:sec_t:s0, 'sys' represents the user identity, 'secret' is the role, 'sec_t' is the type, and 's0' is the MLS level. Understanding SELinux contexts is critical for managing Mandatory Access Control (MAC) in GNU/Linux systems to protect against unauthorized access.

• Question 473:

  A software developer is working on a piece of code required by a new software package. The code should use a protocol to verify the validity of a remote identity. Which of the following should the developer implement in the code?

  A. RSA
  B. OCSP
  C. HSTS
  D. CRL
  B. OCSP

  ---

  Explanation

• Question 474:

  A recent data breach revealed that a company has a number of files containing customer data across its storage environment. These files are individualized for each employee and are used in tracking various customer orders, inquiries, and issues. The files are not encrypted and can be accessed by anyone. The senior management team would like to address these issues without interrupting existing processes.

  Which of the following should a security architect recommend?

  A. A DLP program to identify which files have customer data and delete them
  B. An ERP program to identify which processes need to be tracked
  C. A CMDB to report on systems that are not configured to security baselines
  D. A CRM application to consolidate the data and provision access based on the process and need
  D. A CRM application to consolidate the data and provision access based on the process and need

  ---

  Explanation

  A CRM application is a type of software that helps organizations manage customer relationships and interactions, including storing and organizing customer data. By consolidating the customer data files into a CRM application and implementing proper access controls, the company can ensure that the data is protected and that only authorized employees have access to it.

  The security architect should recommend that the CRM application be configured to provision access based on the process and need, so that employees only have access to the data that they need to perform their duties. This can help reduce the risk of unauthorized access to the data and ensure that the data is being used appropriately.

• Question 475:

  A developer needs to provide feedback on a peer's work during the SDLC. While reviewing the code changes, the developer discovers session ID tokens for a web application will be transmitted over an unsecure connection. Which of the following code snippets should the developer recommend implementing to correct the vulnerability?

  A. Cookie cookie = new Cookie ("primary"); cookie.secure(true);
  B. String input = request.getParameter ("input"); String character Pattern = "[./a-zA-ZO-9? "=" and]"; If (! input.matches (character Pattern)} { out.println ("Invalid Input"); )
  C. 15
  A. Cookie cookie = new Cookie ("primary"); cookie.secure(true);

  ---

  Explanation

• Question 476:

  A developer implement the following code snippet.

  

  Which of the following vulnerabilities does the code snippet resolve?

  A. SQL inject
  B. Buffer overflow
  C. Missing session limit
  D. Information leakage
  D. Information leakage

  ---

  Explanation

• Question 477:

  Which of the following is the reason why security engineers often cannot upgrade the security of embedded facility automation systems?

  A. They are constrained by available compute.
  B. They lack X86-64 processors.
  C. They lack EEPROM.
  D. They are not logic-bearing devices.
  A. They are constrained by available compute.

  ---

  Explanation

  Embedded facility automation systems are often difficult to upgrade because they are constrained by available compute. These systems typically have limited processing power, memory, and storage, which restricts the ability to implement modern security measures, such as encryption, software updates, or advanced security controls. Security engineers may be unable to apply patches or updates without exceeding the system's capacity. CASP+ discusses the challenges posed by resource-constrained devices, particularly in embedded systems and IoT environments, where upgrading security can be difficult due to hardware limitations.

  References: CASP+ CAS-004 Exam Objectives: Domain 3.0 Enterprise Security Architecture (Embedded System Security and Constraints) CompTIA CASP+ Study Guide: Managing Security for Resource-Constrained Embedded Systems

• Question 478:

  A security analyst needs to recommend a remediation to the following threat:

  

  Which of the following actions should the security analyst propose to prevent this successful exploitation?

  A. Patch the system.
  B. Update the antivirus.
  C. Install a host-based firewall.
  D. Enable TLS 1.2.
  A. Patch the system.

  ---

  Explanation

• Question 479:

  A security consultant needs to protect a network of electrical relays that are used for monitoring and controlling the energy used in a manufacturing facility. Which of the following systems should the consultant review before making a recommendation?

  A. CAN
  B. ASIC
  C. FPGA
  D. SCADA
  D. SCADA

  ---

  Explanation

  https://www.sciencedirect.com/topics/computer-science/protective-relay

• Question 480:

  A global organization's Chief Information Security Officer (CISO) has been asked to analyze the risks involved in a plan to move the organization's current MPLS-based WAN network to use commodity internet and SD-WAN hardware. The SD-WAN provider is currently highly regarded but is a regional provider. Which of the following is MOST likely identified as a potential risk by the CISO?

  A. The SD-WAN provider would not be able to handle the organization's bandwidth requirements.
  B. The operating costs of the MPLS network are too high for the organization.
  C. The SD-WAN provider may not be able to support the required troubleshooting and maintenance.
  D. Internal IT staff will not be able to properly support remote offices after the migration.
  C. The SD-WAN provider may not be able to support the required troubleshooting and maintenance.

  ---

  Explanation