CompTIA CompTIA Certifications CAS-004 Questions & Answers

• Question 151:

  Which of the following is the best reason to maintain visibility into vendor supply chains?

  A. To circumvent interdiction of shipments by nation-state actors

  B. To prevent clandestine tampering with components in transit

  C. To comply with import/export legal regulations

  D. To ensure the lowest possible price is quoted

  Correct Answer: B

• Question 152:

  A security analyst is investigating unapproved cloud services that are being used in the organization. Which of the following would best allow for discovery of shadow IT?

  A. Monitoring for sign-up emails of cloud services

  B. Centralizing WAF deployment in the data center

  C. Setting up a reverse proxy and web filtering software

  D. Performing attack surface analysis

  Correct Answer: C

  A reverse proxy and web filtering software can help monitor and control outbound web traffic. By inspecting the traffic, these tools can identify and log connections to cloud services that are not officially sanctioned by the organization. This allows the security analyst to discover and assess unapproved cloud services being accessed by users.

• Question 153:

  The results of an internal audit indicate several employees reused passwords that were previously included in a published list of compromised passwords. The company has the following employee password policy:

  

  Which of the following should be implemented to best address the password reuse issue? (Choose two.)

  A. Increase the minimum age to two days.

  B. Increase the history to 20.

  C. Increase the character length to 12.

  D. Add case-sensitive requirements to character class.

  E. Decrease the maximum age to 30 days.

  F. Remove the complexity requirements.

  G. Increase the maximum age to 120 days.

  Correct Answer: AB

• Question 154:

  An employee in the accounting department created a potential security incident by emailing an internal spreadsheet to an external email address. The spreadsheet contained thousands of payment card numbers. A security administrator queried the following filter log and filter policy settings:

  Outbound filter log information for the email:

  

  Outbound filter policy settings:

  

  Which of the following would best prevent this scenario from reoccurring without causing disruptions to normal business operations?

  A. Add "Sensitive" data classification tags to all files that include matches to the payment card number format.

  B. Change the Filter action for Card_Data_Policy from Allow to Quarantine.

  C. Add the Filter actions Block and Notify to the Confidential_Policy.

  D. Change the Filter action for all Attachment_Policy from Allow to Block.

  E. Change the Filter action for Personal_Email_Policy from Quarantine to Block.

  F. Configure the Monitor action to send automated alerts to the sender's immediate supervisor.

  Correct Answer: B

• Question 155:

  While performing mandatory monthly patch updates on a production application server, the security analyst reports an instance of buffer overflow for a new application that was migrated to the cloud and is also publicly exposed. Security policy requires that only internal users have access to the application. Which of the following should the analyst implement to mitigate the issues reported? (Choose two.)

  A. Configure firewall rules to block all external traffic.

  B. Enable input validation for all fields.

  C. Enable automatic updates to be installed on all servers.

  D. Configure the security group to enable external traffic.

  E. Set up a DLP policy to alert for exfiltration on all application servers.

  F. Enable nightly vulnerability scans.

  Correct Answer: AB

• Question 156:

  A security engineer is assessing a new tool to segment data and communications between domains. The assessment must determine how data transmission controls can be bypassed without detection. Which of the following techniques should the security engineer use?

  A. Machine-learning statistical analysis

  B. Fuzz testing

  C. Covert channel analysis

  D. Protocol analysis

  Correct Answer: C

• Question 157:

  An engineer has had scaling issues with a web application hosted on premises and would like to move to a serverless architecture. Which of the following cloud benefits would be best to utilize for this project?

  A. Cost savings for hosting

  B. Automation of resource provisioning

  C. Providing geo-redundant hosting

  D. Eliminating need to patch

  Correct Answer: B

• Question 158:

  Multiple users have reported that an internal website's status is listed as insecure because the TLS certificate has expired. Although a new certificate was generated, this issue has become a common occurrence throughout the year for multiple websites. Which of the following best prevents recurrence of this issue?

  A. OCSP responder

  B. Life-cycle management

  C. Wildcard certificates

  D. Certificate pinning

  Correct Answer: B

• Question 159:

  Following a successful exploitation of an RCE vulnerability during a penetration test, a systems administrator is performing remediation activities of the target system. Since the systems administrator was not involved in the planning process for the penetration test, a production server was inadvertently targeted and impacted by the actions of the penetration tester. Which of the following would be the most appropriate to reduce the impact of the penetration test in the future?

  A. Leverage a purple team approach to refine scope definition.

  B. Exclude non-production systems from the penetration test.

  C. Implement a black-box approach for the penetration test.

  D. Include an intercepting proxy in the production environment.

  E. Rely on web application vulnerability scans instead of penetration testing.

  Correct Answer: A

  Purple teaming is a collaborative approach to cybersecurity that brings together red and blue teams to test and improve an organization's security posture. The Purple Team is a combination of the Red and Blue Teams and work together to

  identify and address vulnerabilities discovered in simulated attacks.

  The White Team is typically made up of executive-level individuals who oversee and coordinate all of the other teams' efforts.

• Question 160:

  Which of the following describes how a risk assessment is performed when an organization has a critical vendor that provides multiple products?

  A. At the individual product level

  B. Through the selection of a random product

  C. Using a third-party audit report

  D. By choosing a major product

  Correct Answer: A