CompTIA CAS-005 Online Practice Questions and Exam Preparation

CompTIA CAS-005 Online Questions & Answers

• Question 411:

  An organization decides to move to a distributed workforce model. Several legacy systems exist on premises and cannot be migrated because of existing compliance requirements. However, all new systems are required to be cloud-based.

  Which of the following would best ensure network access security?

  A. Utilizing a VPN for all users who require legacy system access
  B. Shifting all legacy systems to the existing public cloud infrastructure
  C. Configuring an SDN to block malicious traffic to on-premises networks
  D. Deploying microsegmentation with a firewall acting as the core router
  A. Utilizing a VPN for all users who require legacy system access

• Question 412:

  A company is having issues with its vulnerability management program New devices/lPs are added and dropped regularly, making the vulnerability report inconsistent.

  Which of the following actions should the company lake to most likely improve the vulnerability management process?

  A. Request a weekly report with all new assets deployed and decommissioned.
  B. Extend the DHCP lease lime to allow the devices to remain with the same address for a longer period.
  C. Implement a shadow IT detection process to avoid rogue devices on the network.
  D. Perform regular discovery scanning throughout the 11 landscape using the vulnerability management tool.
  D. Perform regular discovery scanning throughout the 11 landscape using the vulnerability management tool.

  ---

  Explanation

  To improve the vulnerability management process in an environment where new devices/IPs are added and dropped regularly, the company should perform regular discovery scanning throughout the IT landscape using the vulnerability management tool.

  Here's why:

  Accurate Asset Inventory: Regular discovery scans help maintain an up-to-date inventory of all assets, ensuring that the vulnerability management process includes all relevant devices and IPs. Consistency in Reporting: By continuously discovering and scanning new and existing assets, the company can generate consistent and comprehensive vulnerability reports that reflect the current state of the network.

  Proactive Management: Regular scans enable the organization to proactively identify and address vulnerabilities on new and existing assets, reducing the window of exposure to potential threats.

• Question 413:

  A software vendor provides routine functionality and security updates to its global customer base. The vendor would like to ensure distributed updates are authorized, originate from only the company, and have not been modified by others.

  Which of the following solutions best supports these objectives?

  A. Envelope encryption
  B. File integrity monitoring
  C. Application control
  D. Code signing
  D. Code signing

• Question 414:

  A user tried to access a web page at http://10.1.1.1.Previouslythewebpagedidnotrequireauthentication,andnowthebrowserispromptingforcredentials.Whichofthefollowingactionswouldbestpreventtheissuefromreoccurringandreducethelikelihoodofcredentialexposure?

  A. Implementing 802.1x EAP-TTLS on access points to reduce the risk of evil twins.
  B. Transitioning internal services to use DNS security.
  C. Modifying web server configuration and utilizing X509 certificates for authentication.
  D. Installing new rules for the IDS to detect impersonation attacks.
  C. Modifying web server configuration and utilizing X509 certificates for authentication.

• Question 415:

  A company was recently infected by malware. During the root cause analysis, the company determined that several users were installing their own applications. To prevent further compromises, the company has decided it will only allow authorized applications to run on its systems.

  Which of the following should the company implement?

  A. Signing
  B. Access control
  C. HIPS
  D. Permit listing
  D. Permit listing

  ---

  Explanation

  To prevent unauthorized applications from running, the company needs a mechanism to explicitly define and enforce which applications are allowed to execute. "Permit listing" (often referred to as "whitelisting" in security contexts) is the most effective solution here. It involves creating a list of approved applications, and only those on the list are permitted to run, blocking all others by default. This directly addresses the root cause--users installing unapproved software--by restricting execution to only authorized programs. Option A (Signing):Code signing ensures the authenticity and integrity of software by verifying it comes from a trusted source and hasn't been tampered with. While useful, it doesn't inherently prevent unauthorized applications from running unless combined with a policy like whitelisting.

  Option B (Access control):Access control governs who can access systems or resources but doesn't specifically restrict which applications can execute. It's too broad for this scenario.

  Option C (HIPS):A Host-based Intrusion Prevention System (HIPS) can detect and block malicious behavior, but it's reactive and relies on signatures or heuristics, not a proactive allow-only approach.

  Option D (Permit listing):This is the best fit, as it proactively enforces a policy where only explicitly authorized applications can run, preventing malware introduced by unauthorized software.

  References:

  CompTIA SecurityX CAS-005 Domain 2: Security Architecture ?Application Security Controls.

• Question 416:

  A security analyst is participating in a risk assessment and is helping to calculate the exposure factor associated with various systems and processes within the organization.

  Which of the following resources would be most useful to calculate the exposure factor in this scenario?

  A. Gap analysis
  B. Business impact analysis
  C. Risk register
  D. Information security policy
  E. Lessons learned
  B. Business impact analysis

• Question 417:

  A company wants to improve and automate the compliance of its cloud environments to meet industry standards.

  Which of the following resources should the company use to best achieve this goal?

  A. Jenkins
  B. Python
  C. Ansible
  D. PowerShell
  C. Ansible

  ---

  Explanation

  Comprehensive and Detailed Explanation:

  Automating compliance in cloud environments requires a tool that can enforce configurations, manage infrastructure as code, and align with industry standards (e.g., NIST, ISO). Let's evaluate:

  A. Jenkins:A CI/CD tool for automating software builds and deployments. It's not designed for compliance enforcement or infrastructure management.

  B. Python:A programming language that can be scripted for automation but lacks built-in compliance-focused features without significant custom development.

  C. Ansible:An automation tool for configuration management, application deployment, and compliance enforcement. It uses playbooks to define desired states, making it ideal for automating compliance checks and remediation in cloud environments (e.g., AWS, Azure). CAS-005 emphasizes automation tools for security and compliance, and Ansible fits perfectly.

  References:

  CompTIA SecurityX (CAS-005) objectives, Domain 3: Security Engineering and Cryptography, focusing on automation for compliance in cloud environments.

• Question 418:

  Which of the following tests explains why AI output could be inaccurate?

  A. Model poisoning
  B. Social engineering
  C. Output handling
  D. Prompt injections
  A. Model poisoning

• Question 419:

  A company isolated its OT systems from other areas of the corporate network. These systems are required to report usage information over the internet to the vendor.

  Which of the following best reduces the risk of compromise or sabotage? (Select two).

  A. Implementing allow lists
  B. Monitoring network behavior
  C. Encrypting data at rest
  D. Performing boot Integrity checks
  E. Executing daily health checks
  F. Implementing a site-to-site IPSec VPN
  A. Implementing allow lists
  F. Implementing a site-to-site IPSec VPN

  ---

  Explanation

  A. Implementing allow lists: Allow lists (whitelisting) restrict network communication to only authorized devices and applications, significantly reducing the attack surface by ensuring that only pre-approved traffic is permitted.

  F. Implementing a site-to-site IPSec VPN: A site-to-site VPN provides a secure, encrypted tunnel for data transmission between the OT systems and the vendor, protecting the data from interception and tampering during transit. Other options:

  B. Monitoring network behavior: While useful for detecting anomalies, it does not proactively reduce the risk of compromise or sabotage.

  C. Encrypting data at rest: Important for protecting data stored on devices, but does not address network communication risks.

  D. Performing boot integrity checks: Ensures the integrity of the system at startup but does not protect ongoing network communications.

  E. Executing daily health checks: Useful for maintaining system health but does not directly reduce the risk of network-based compromise or sabotage.

  References:

  CompTIA Security+ Study Guide NIST SP 800-82, "Guide to Industrial Control Systems (ICS) Security" "Industrial Network Security" by Eric

  D. Knapp and Joel Thomas Langill

• Question 420:

  A healthcare system recently suffered from a ransomware incident. As a result, the board of directors decided to hire a security consultant to improve existing network security. The security consultant found that the healthcare network was completely flat, had no privileged access limits, and had open RDP access to servers with personal health information.

  As the consultant builds the remediation plan, which of the following solutions would best solve these challenges? (Select three).

  A. SD-WAN
  B. PAM
  C. Remote access VPN
  D. MFA
  E. Network segmentation
  F. BGP
  G. NAC
  B. PAM
  D. MFA
  E. Network segmentation

  ---

  Explanation

  Privileged Access Management (PAM) restricts elevated permissions, reducing the risk of widespread ransomware attacks.Multi-Factor Authentication (MFA)protects against credential theft and ensures that even if passwords are compromised, accounts are not easily accessible.Network segmentation breaks the flat network into secure zones, limiting lateral movement by attackers. SD-WAN and BGP relate to network routing and efficiency, not security architecture specifically. Remote access VPN secures external access but does not solve internal flat network issues. Network Access Control (NAC) is helpful but secondary compared to PAM, MFA, and segmentation in this context.

  References:

  CompTIA SecurityX CAS-005, Domain 2.0: Implement identity and access controls, network segmentation, and authentication hardening to mitigate internal threats.