CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 781:

  The security team is looking into aggressive bot behavior that is resulting in performance issues on the web server After further investigation, the security engineer determines that the bot traffic is legitimate.

  Which of the following is the best course of action to reduce performance issues without allocating additional resources to the server?

  A. Block all bot traffic using the IPS.
  B. Monitor legitimate SEO bot traffic for abnormalities.
  C. Configure the WAF to rate-limit bot traffic.
  D. Update robots.txt to slow down the crawling speed.
  C. Configure the WAF to rate-limit bot traffic.

• Question 782:

  A small company recently developed prototype technology for a military program. The company's security engineer is concerned about potential theft of the newly developed, proprietary information. Which of the following should the security engineer do to BEST manage the threats proactively?

  A. Join an information-sharing community that is relevant to the company.
  B. Leverage the MITRE ATTandCK framework to map the TTR.
  C. Use OSINT techniques to evaluate and analyze the threats.
  D. Update security awareness training to address new threats, such as best practices for data security.
  D. Update security awareness training to address new threats, such as best practices for data security.

  ---

  Explanation

• Question 783:

  Which of the following is the best reason for obtaining file hashes from a confiscated laptop?

  A. To prevent metadata tampering on each file
  B. To later validate the integrity of each file
  C. To generate unique identifiers for each file
  D. To preserve the chain of custody of files
  B. To later validate the integrity of each file

  ---

  Explanation

• Question 784:

  An administrator completed remediation for all the findings of a penetration test and notifies the management team that the systems are ready to be placed back into production. Which of the following steps should the management team require the analyst to perform immediately before placing the systems back into production?

  A. Rescan for corrections/changes.
  B. Conduct the entire penetration test again.
  C. Harden the targeted systems.
  D. Ensure a host-based IPS is in place.
  A. Rescan for corrections/changes.

  ---

  Explanation

  Rescanning ensures all identified vulnerabilities have been resolved and no additional changes introduced new issues. This step is critical for verifying remediation effectiveness before moving systems back into production, aligning with CASP + objective 5.1, which involves verifying security measures during testing and evaluation phases.

• Question 785:

  An organization's assessment of a third-party, non-critical vendor reveals that the vendor does not have cybersecurity insurance and IT staff turnover is high. The organization uses the vendor to move customer office equipment from one service location to another. The vendor acquires customer data and access to the business via an API.

  Given this information, which of the following is a noted risk?

  A. Feature delay due to extended software development cycles
  B. Financial liability from a vendor data breach
  C. Technical impact to the API configuration
  D. The possibility of the vendor's business ceasing operations
  B. Financial liability from a vendor data breach

  ---

  Explanation

  https://legal.thomsonreuters.com/en/insights/articles/data-breach-liability

• Question 786:

  A security consultant needs to set up wireless security for a small office that does not have Active Directory. Despite the lack of central account management, the office manager wants to ensure a high level of defense to prevent brute-force attacks against wireless authentication.

  Which of the following technologies would BEST meet this need?

  A. Faraday cage
  B. WPA2 PSK
  C. WPA3 SAE
  D. WEP 128 bit
  C. WPA3 SAE

  ---

  Explanation

  WPA3 SAE prevents brute-force attacks.

  https://support.enplug.com/hc/en-us/articles/205160175-Setting-your-WiFi-encryption-as-WPA2-PSK

• Question 787:

  A security architect for a manufacturing company must ensure that a new acquisition of IoT devices is securely integrated into the company's Infrastructure. The devices should not directly communicate with other endpoints on the network and must be subject to network traffic monitoring to identify anomalous traffic. Which of the following would be the BEST solution to meet these requirements?

  A. Block all outbound traffic and implement an inline firewall.
  B. Allow only wireless connections and proxy the traffic through a network tap.
  C. Establish an air-gapped network and implement an IDS.
  D. Use a separate VLAN with an ACL and implement network detection and response.
  D. Use a separate VLAN with an ACL and implement network detection and response.

  ---

  Explanation

• Question 788:

  A network administrator receives a ticket regarding an error from a remote worker who is trying to reboot a laptop. The laptop has not yet loaded the operating system, and the user is unable to continue the boot process. The administrator is able to provide the user with a recovery PIN, and the user is able to reboot the system and access the device as needed. Which of the following is the MOST likely cause of the error?

  A. Lockout of privileged access account
  B. Duration of the BitLocker lockout period
  C. Failure of the Kerberos time drift sync
  D. Failure of TPM authentication
  D. Failure of TPM authentication

  ---

  Explanation

• Question 789:

  A system administrator recently conducted a vulnerability scan of the internet. Subsequently, the organization was successfully attacked by an adversary. Which of the following in the MOST likely explanation for why the organization network was compromised?

  A. There was a false positive since the network was fully patched.
  B. The system administrator did not perform a full system sun.
  C. The systems administrator performed a credentialed scan.
  D. The vulnerability database was not updated.
  D. The vulnerability database was not updated.

  ---

  Explanation

  If the system was compromised after a scan, but no vulnerabilities were reported, it's likely the scanner didn't have the latest vulnerability definitions.

• Question 790:

  A security analyst is assessing a new application written in Java. The security analyst must determine which vulnerabilities exist during runtime. Which of the following would provide the most exhaustive list of vulnerabilities while meeting the objective?

  A. Input validation
  B. Dynamic analysis
  C. Side-channel analysis
  D. Fuzz testing
  E. Static analysis
  B. Dynamic analysis

  ---

  Explanation

  Dynamic analysis involves testing the application while it is running to identify vulnerabilities present during execution, providing the most exhaustive runtime vulnerability detection. Input validation is a specific security control, not a method for

  exhaustive testing. Side-channel analysis examines unintended information leakage but does not comprehensively assess runtime vulnerabilities.

  Fuzz testing is a specific technique within dynamic analysis but does not ensure exhaustive coverage.

  Static analysis examines code without execution, missing runtime-specific vulnerabilities.

  CASP+ Exam Objectives 2.4 ?Analyze application vulnerabilities using dynamic testing techniques.