CompTIA CAS-004 Online Practice Questions and Exam Preparation

CompTIA CAS-004 Online Questions & Answers

• Question 81:

  A recent batch of bug bounty findings indicates a systematic issue related to directory traversal. A security engineer needs to prevent flawed code from being deployed into production. Which of the following is the best mitigation strategy for the engineer?

  A. Setting up secure development training with a focus on filesystem access issues
  B. Implementing static code analysis testing into the CI/CD pipeline and blocking based on findings
  C. Using a software composition analysis tool to look for directory traversal issues in the application
  D. Developing a secure library for filesystem access and blocking builds that do not use the library
  E. Leveraging a dynamic application security testing tool to uncover issues related to directory traversal
  B. Implementing static code analysis testing into the CI/CD pipeline and blocking based on findings

  ---

  Explanation

• Question 82:

  An organization is considering a BYOD standard to support remote working. The first iteration of the solution will utilize only approved collaboration applications and the ability to move corporate data between those applications. The security team has concerns about the following:

  1.Unstructured data being exfiltrated after an employee leaves the organization

  2.Data being exfiltrated as a result of compromised credentials

  3.Sensitive information in emails being exfiltrated

  Which of the following solutions should the security team implement to mitigate the risk of data loss?

  A. Mobile device management, remote wipe, and data loss detection
  B. Conditional access, DoH, and full disk encryption
  C. Mobile application management, MFA, and DRM
  D. Certificates, DLP, and geofencing
  C. Mobile application management, MFA, and DRM

  ---

  Explanation

• Question 83:

  A company Is adopting a new artificial-intelligence-based analytics SaaS solution. This Is the company's first attempt at using a SaaS solution, and a security architect has been asked to determine any future risks. Which of the following would be the GREATEST risk In adopting this solution?

  A. The inability to assign access controls to comply with company policy
  B. The inability to require the service provider process data in a specific country
  C. The inability to obtain company data when migrating to another service
  D. The inability to conduct security assessments against a service provider
  C. The inability to obtain company data when migrating to another service

  ---

  Explanation

• Question 84:

  A company that all mobile devices be encrypted, commensurate with the full disk encryption scheme of assets, such as workstation, servers, and laptops. Which of the following will MOST likely be a limiting factor when selecting mobile device managers for the company?

  A. Increased network latency
  B. Unavailable of key escrow
  C. Inability to selected AES-256 encryption
  D. Removal of user authentication requirements
  C. Inability to selected AES-256 encryption

  ---

  Explanation

  The real limitation for mobile device managers (MDMs) is often the lack of support for enforcing specific encryption standards like AES-256 across all mobile platforms.

• Question 85:

  A security analyst is monitoring an organization's IDS and DLP systems for an alert indicating files were removed from the network. The files were from the workstation of an employee who was authenticated but not authorized to access the files. Which of the following should the organization do FIRST to address this issue?

  A. Provide additional security awareness training.
  B. Disable the employee's credentials until the issue is resolved.
  C. Ask human resources to notify the employee that sensitive files were accessed.
  D. Isolate the employee's network segment and investigate further.
  D. Isolate the employee's network segment and investigate further.

  ---

  Explanation

• Question 86:

  A company has decided to move an ERP application to a public cloud vendor. The company wants to replicate some of its global policies from on premises to cloud. The policies include data encryption, token management, and limited user

  access to the ERP application The Chief Information Officer (CIO) is mainly concerned about privileged accounts that might be compromised and used to alter data in the ERP application.

  Which of the following is the BEST option to meet the requirements?

  A. Sandboxing
  B. CASB
  C. MFA
  D. Security as a service
  B. CASB

  ---

  Explanation

  A Cloud Access Security Broker (CASB) is the best option to meet the requirements. CASBs provide visibility, compliance, data security, and threat protection for cloud-based services. They can enforce encryption policies, tokenization, access controls, and monitor or restrict actions by privileged accounts—which is the CIO's main concern.

  While MFA enhances authentication, it does not provide ongoing monitoring or policy enforcement within the cloud application. CASB can replicate on-premises policies in the cloud environment and detect or block suspicious behavior.

• Question 87:

  A help desk analyst suddenly begins receiving numerous calls from remote employees who state they are unable to connect to the VPN. The employees indicate the VPN client software is warning about an expired certificate. The help desk analyst determines the VPN certificate is valid. Which of the following is the most likely cause of the issue?

  A. The certificate has been compromised and needs to be replaced.
  B. The VPN concentrator is running an old version of code and needs to be upgraded.
  C. The NTP settings on the VPN concentrator are incorrectly configured.
  D. The end users are using outdated VPN client software.
  C. The NTP settings on the VPN concentrator are incorrectly configured.

  ---

  Explanation

  The issue described--where remote employees are unable to connect to the VPN due to warnings about an expired certificate despite the certificate being valid--is likely caused by incorrect NTP (Network Time Protocol) settings on the VPN concentrator. NTP is crucial for ensuring that the system clocks across network devices are synchronized with accurate time. Certificates have a validity period defined by start and end dates, and they rely on the system clock to determine whether they are valid or expired. If the system clock on the VPN concentrator is incorrect due to misconfigured NTP settings, the VPN concentrator may mistakenly believe that the certificate has expired when it actually hasn't. This would result in VPN clients displaying warnings about expired certificates and refusing to connect. Therefore, ensuring correct NTP configuration on the VPN concentrator is essential to resolve this issue.

• Question 88:

  A Chief information Security Officer (CISO) is developing corrective-action plans based on the following from a vulnerability scan of internal hosts:

  High (CVSS: 10.0)

  NVT: PHP '_php_stream_scandir()' Buffer Overflow Vulnerability (Windows) (OID: 1.3.6.1.4.1.25623.1.0.803917)

  Product detection result: open|ssl|php|php|5.3.6 by PHP Version Detection (Remote) (OID: 1.3.6.1.4.1.25623.1.0.800109)

  Summary

  This host is running PHP and is prone to buffer overflow vulnerability.

  Vulnerability Detection ResultInstalled version: 5.3.6

  Fixed version: 5.3.15/5.4.5

  Impact

  Successful exploitation could allow attackers to execute arbitrary code and failed attempts will likely result in denial-of-service conditions. Impact level: System/Application

  Which of the following MOST appropriate corrective action to document for this finding?

  A. The product owner should perform a business impact assessment regarding the ability to implement a WAF.
  B. The application developer should use a static code analysis tool to ensure any application code is not vulnerable to buffer overflows.
  C. The system administrator should evaluate dependencies and perform upgrade as necessary.
  D. The security operations center should develop a custom IDS rule to prevent attacks buffer overflows against this server.
  C. The system administrator should evaluate dependencies and perform upgrade as necessary.

  ---

  Explanation

  The vulnerability is in the installed PHP version (5.3.6), which is outdated and has a known buffer overflow flaw. The scan identifies a fixed version (5.3.15 or 5.4.5), so the proper corrective action is to upgrade PHP to a secure version.

  This is a system-level vulnerability, not an application-specific issue, so code review or IDS rules would be insufficient or reactive. Upgrading addresses the root cause.

• Question 89:

  A security engineer based in Iceland works in an environment requiring an on-premises and cloud-based storage solution. The solution should take into consideration the following:

  1.The company has sensitive data.

  2.The company has proprietary data.

  3.The company has its headquarters in Iceland, and the data must always reside in that country.

  Which cloud deployment model should be used?

  A. Hybrid cloud
  B. Community cloud
  C. Public cloud
  D. Private cloud
  A. Hybrid cloud

  ---

  Explanation

• Question 90:

  A company has data it would like to aggregate from its PLCs for data visualization and predictive maintenance purposes. Which of the following is the most likely destination for the tag data from the PLCs?

  A. External drive
  B. Cloud storage
  C. System aggregator
  D. Local historian
  D. Local historian

  ---

  Explanation

  PLCs (Programmable Logic Controllers) are commonly used in industrial automation to control machinery and processes. They generate a significant amount of data known as tag data, which includes real-time information about variables such as temperatures, pressures, and other operational parameters.

  A local historian is a dedicated software or system component used in industrial automation environments to collect, store, and manage tag data from PLCs. The local historian typically resides on-site or within the industrial network environment. Its primary function is to capture and archive historical data from PLCs at a high frequency, providing insights into the operational history and trends of the industrial processes.