CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 631:

  A company wants to quantify and communicate the effectiveness of its security controls but must establish measures. Which of the following is MOST likely to be included in an effective assessment roadmap for these controls?

  A. Create a change management process.
  B. Establish key performance indicators.
  C. Create an integrated master schedule.
  D. Develop a communication plan.
  E. Perform a security control assessment.
  B. Establish key performance indicators.

  ---

  Explanation

• Question 632:

  A penetration tester is trying to gain access to a building after hours as part of a physical assessment of an office complex. The tester notes that each employee touches a badge near a small black box outside the side door, and the door unlocks. The tester uses a software-defined radio tool to determine a 125kHz signal is used during this process. Which of the following technical solutions would be BEST to help the penetration tester gain access to the building?

  A. Generate a 125kHz tone.
  B. Compromise the ICS/SCADA system.
  C. Utilize an RFID duplicator.
  D. Obtain a lock pick set.
  C. Utilize an RFID duplicator.

  ---

  Explanation

  RFID duplicators can read and clone low-frequency RFID cards ?the real method for physical bypass.

• Question 633:

  A security engineer receives reports through the organization's bug bounty program about remote code execution in a specific component in a custom application. Management wants to properly secure the component and proactively avoid similar issues.

  Which of the following is the best approach to uncover additional vulnerable paths in the application?

  A. Implement fuzz testing focused on the component and inputs uncovered by the bug bounty program.
  B. Leverage a software composition analysis tool to find all known vulnerabilities in dependencies.
  C. Use a vulnerability scanner to perform multiple types of network scans to look for vulnerabilities.
  D. Utilize a network traffic analyzer to find malicious packet combinations that lead to remote code execution.
  E. Run an exploit framework with all payloads against the application to see if it is able to gain access.
  A. Implement fuzz testing focused on the component and inputs uncovered by the bug bounty program.

  ---

  Explanation

  Fuzz testing identifies vulnerabilities by providing unexpected or random input to the application, exposing edge cases and additional attack vectors. This aligns with CASP+ objective 1.5, emphasizing proactive vulnerability discovery techniques in application security.

• Question 634:

  Which of the following is the best way to protect the website browsing history for an executive who travels to foreign countries where internet usage is closely monitored?

  A. DoH
  B. EAP-TLS
  C. Geofencing
  D. Private browsing mode
  A. DoH

• Question 635:

  A security engineer performed an assessment on a recently deployed web application. The engineer was able to exfiltrate a company report by visiting the following URL:

  www.intranet.abc.com/get-files.jsp?file=report.pdf

  Which of the following mitigation techniques would be BEST for the security engineer to recommend?

  A. Input validation
  B. Firewall
  C. WAF
  D. DLP
  A. Input validation

  ---

  Explanation

  Input validation is the process of checking user input to ensure that it is valid and safe. In this case, the security engineer should recommend that the web application validate the file parameter to ensure that it is a valid "file" path. This will prevent attackers from being able to exfiltrate arbitrary files from the web server.

• Question 636:

  A company in the financial sector receives a substantial number of customer transaction requests via email. While doing a root-cause analysis conceding a security breach, the CIRT correlates an unusual spike in port 80 traffic from the IP address of a desktop used by a customer relations employee who has access to several of the compromised accounts. Subsequent antivirus scans of the device do not return an findings, but the CIRT finds undocumented services running on the device.

  Which of the following controls would reduce the discovery time for similar in the future.

  A. Implementing application blacklisting
  B. Configuring the mall to quarantine incoming attachment automatically
  C. Deploying host-based firewalls and shipping the logs to the SIEM
  D. Increasing the cadence for antivirus DAT updates to twice daily
  C. Deploying host-based firewalls and shipping the logs to the SIEM

  ---

  Explanation

• Question 637:

  In preparation for the holiday season, a company redesigned the system that manages retail sales and moved it to a cloud service provider. The new infrastructure did not meet the company's availability requirements. During a postmortem analysis, the following issues were highlighted:

  1.International users reported latency when images on the web page were initially loading.

  2.During times of report processing, users reported issues with inventory when attempting to place orders.

  3.Despite the fact that ten new API servers were added, the load across servers was heavy at peak times.

  Which of the following infrastructure design changes would be BEST for the organization to implement to avoid these issues in the future?

  A. Serve static content via distributed CDNs, create a read replica of the central database and pull reports from there, and auto-scale API servers based on performance.
  B. Increase the bandwidth for the server that delivers images, use a CDN, change the database to a non-relational database, and split the ten API servers across two load balancers.
  C. Serve images from an object storage bucket with infrequent read times, replicate the database across different regions, and dynamically create API servers based on load.
  D. Serve static-content object storage across different regions, increase the instance size on the managed relational database, and distribute the ten API servers across multiple regions.
  A. Serve static content via distributed CDNs, create a read replica of the central database and pull reports from there, and auto-scale API servers based on performance.

  ---

  Explanation

  Serving static content via distributed Content Delivery Networks (CDNs) can reduce latency for international users because it serves content from the closest geographic location to the user.

  Creating a read replica of the central database and pulling reports from there can reduce the load on the central database, minimizing disruptions to inventory lookups during report processing.

  Auto-scaling API servers based on performance can ensure that as load increases, new servers are spun up to handle it, distributing the load more evenly and preventing any single server from becoming overloaded.

  The other options offer some potential improvements but don't address all of the identified issues as effectively.

• Question 638:

  A company's Chief Information Security Officer is concerned that the company's proposed move to the cloud could lead to a lack of visibility into network traffic flow logs within the VPC. Which of the following compensating controls would be BEST to implement in this situation?

  A. EDR
  B. SIEM
  C. HIDS
  D. UEBA
  B. SIEM

  ---

  Explanation

  https://runpanther.io/cyber-explained/cloud-based-siem-explained/

• Question 639:

  A large number of emails have been reported, and a security analyst is reviewing the following information from the emails:

  

  As part of the image process, which of the following is the FIRST step the analyst should take?

  A. Block the email address carl b@comptia1 com, as it is sending spam to subject matter experts
  B. Validate the final "Received" header against the DNS entry of the domain.
  C. Compare the 'Return-Path" and "Received" fields.
  D. Ignore the emails, as SPF validation is successful, and it is a false positive
  B. Validate the final "Received" header against the DNS entry of the domain.

  ---

  Explanation

• Question 640:

  A software assurance analyst reviews an SSH daemon's source code and sees the following:

  

  Based on this code snippet, which of the following attacks is MOST likely to succeed?

  A. Race condition
  B. Cross-site scripting
  C. Integer overflow
  D. Driver shimming
  C. Integer overflow

  ---

  Explanation