CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 481:

  A security engineer estimates the company's popular web application experiences 100 attempted breaches per day. In the past four years, the company's data has been breached two times. Which of the following should the engineer report as the ARO for successful breaches?

  A. 0.5
  B. 8
  C. 50
  D. 36,500
  A. 0.5

  ---

  Explanation

  https://blog.netwrix.com/2020/07/24/annual-loss-expectancy-and-quantitative- risk-analysis/

• Question 482:

  A security analyst is investigating a series of suspicious emails by employees to the security team. The email appear to come from a current business partner and do not contain images or URLs. No images or URLs were stripped from the message by the security tools the company uses instead, the emails only include the following in plain text.

  

  Which of the following should the security analyst perform?

  A. Contact the security department at the business partner and alert them to the email event.
  B. Block the IP address for the business partner at the perimeter firewall.
  C. Pull the devices of the affected employees from the network in case they are infected with a zero-day virus.
  D. Configure the email gateway to automatically quarantine all messages originating from the business partner.
  A. Contact the security department at the business partner and alert them to the email event.

  ---

  Explanation

• Question 483:

  An employee in the accounting department created a potential security incident by emailing an internal spreadsheet to an external email address. The spreadsheet contained thousands of payment card numbers. A security administrator queried the following filter log and filter policy settings:

  Outbound filter log information for the email:

  

  Outbound filter policy settings:

  

  Which of the following would best prevent this scenario from reoccurring without causing disruptions to normal business operations?

  A. Add "Sensitive" data classification tags to all files that include matches to the payment card number format.
  B. Change the Filter action for Card_Data_Policy from Allow to Quarantine.
  C. Add the Filter actions Block and Notify to the Confidential_Policy.
  D. Change the Filter action for all Attachment_Policy from Allow to Block.
  E. Change the Filter action for Personal_Email_Policy from Quarantine to Block.
  F. Configure the Monitor action to send automated alerts to the sender's immediate supervisor.
  B. Change the Filter action for Card_Data_Policy from Allow to Quarantine.

  ---

  Explanation

• Question 484:

  A company recently deployed new servers to create an additional cluster to support a new application. The corporate security policy states that all new servers must be resilient. The new cluster has a high-availability configuration for a smooth failover. The failover was successful following a recent power outage, but both clusters lost critical data, which impacted recovery time. Which of the following needs to be configured to help ensure minimal delays when power outages occur in the future?

  A. Replication
  B. Caching
  C. Containerization
  D. Redundancy
  E. High availability
  A. Replication

  ---

  Explanation

  Based on the requirement to reduce delays during power outages and the scenario's description of data loss despite high availability, configuring replication (option A) is crucial. Replication ensures that critical data is duplicated across clusters, allowing seamless failover and access to data from alternative locations in the event of server failures or power outages. This approach directly addresses the need for data resilience and continuity, ensuring minimal impact on operations during unforeseen disruptions. Thus, replication is the most suitable solution to enhance the company's data resilience and reduce recovery times during power outages.

• Question 485:

  A company has hired a security architect to address several service outages on the endpoints due to new malware. The Chief Executive Officer's laptop was impacted while working from home. The goal is to prevent further endpoint disruption. The edge network is protected by a web proxy.

  Which of the following solutions should the security architect recommend?

  A. Replace the current antivirus with an EDR solution.
  B. Remove the web proxy and install a UTM appliance.
  C. Implement a deny list feature on the endpoints.
  D. Add a firewall module on the current antivirus solution.
  A. Replace the current antivirus with an EDR solution.

  ---

  Explanation

• Question 486:

  A security analyst sees that a hacker has discovered some keys and they are being made available on a public website. The security analyst is then able to successfully decrypt the data using the keys from the website. Which of the following should the security analyst recommend to protect the affected data?

  A. Key rotation
  B. Key revocation
  C. Key escrow
  D. Zeroization
  E. Cryptographic obfuscation
  A. Key rotation

  ---

  Explanation

• Question 487:

  A security analyst is reviewing the following vulnerability assessment report:

  

  Which of the following should be patched FIRST to minimize attacks against Internet-facing hosts?

  A. Server1
  B. Server2
  C. Server 3
  D. Servers
  B. Server2

  ---

  Explanation

  Server2 has an external IP address (205.1.3.5), meaning it is Internet-facing. It is running a Bind server, which is critical infrastructure for DNS resolution, and has a CVSS score of 6.5 with a remotely executable vulnerability. Importantly, there is a proof-of-concept (POC) exploit available, which indicates that the vulnerability is known and potentially exploitable by attackers in the near term.

  This makes Server2 the most urgent patch priority to reduce the risk of external attacks.

• Question 488:

  A company is developing an application that will be used to perform e-commerce transactions for a subscription-based service. The application must be able to use previously saved payment methods to perform recurring transactions.

  Which of the following is the most appropriate?

  A. Tokenization through an HSM
  B. Self-encrypting disks with field-level encryption
  C. NX/XN implementation to minimize data retention
  D. Token-based access for application users
  E. Address space layout randomization
  A. Tokenization through an HSM

• Question 489:

  Some end users of an e-commerce website are reporting a delay when browsing pages. The website uses TLS 1.2. A security architect for the website troubleshoots by connecting from home to the website and capturing traffic via Wireshark. The security architect finds that the issue is the time required to validate the certificate. Which of the following solutions should the security architect recommend?

  A. Adding more nodes to the web server clusters
  B. Changing the cipher algorithm used on the web server
  C. Implementing OCSP stapling on the server
  D. Upgrading to TLS 1.3
  C. Implementing OCSP stapling on the server

  ---

  Explanation

  OCSP (Online Certificate Status Protocol) is a protocol used to check the revocation status of a digital certificate. When a client connects to a server, it may need to check the status of the server's certificate by sending a request to the Certificate Authority (CA). This can introduce a delay, especially if the CA's server is slow or unreachable. OCSP stapling is a solution where the server periodically retrieves its certificate status from the CA and then "staples" this status to the TLS handshake. This means the client doesn't need to make a separate connection to the CA, thus reducing the connection time.

• Question 490:

  A security analyst identified a vulnerable and deprecated runtime engine that is supporting a public-facing banking application. The developers anticipate the transition to modern development environments will take at least a month. Which of the following controls would best mitigate the risk without interrupting the service during the transition?

  A. Shutting down the systems until the code is ready
  B. Uninstalling the impacted runtime engine
  C. Selectively blocking traffic on the affected port
  D. Configuring IPS and WAF with signatures
  D. Configuring IPS and WAF with signatures

  ---

  Explanation