CompTIA CompTIA Certifications CAS-004 Questions & Answers

• Question 11:

  The IT team suggests the company would save money by using self-signed certificates, but the security team indicates the company must use digitally signed third-party certificates. Which of the following is a valid reason to pursue the security team's recommendation?

  A. PKCS #10 is still preferred over PKCS #12.

  B. Private-key CSR signage prevents on-path interception.

  C. There is more control in using a local certificate over a third-party certificate.

  D. There is minimal benefit in using a certificate revocation list.

  Correct Answer: B

  Using a digitally signed third-party certificate ensures that the certificate is trusted and verified, reducing the risk of man-in-the-middle attacks and ensuring secure communications.

• Question 12:

  A junior security researcher has identified a buffer overflow vulnerability leading to remote code execution in a former employer's software. The security researcher asks for the manager's advice on the vulnerability submission process. Which of the following is the best advice the current manager can provide the security researcher?

  A. Collect proof that the exploit works in order to expedite the process.

  B. Publish proof-of-concept exploit code on a personal blog.

  C. Recommend legal consultation about the process.

  D. Visit a bug bounty website for the latest information.

  Correct Answer: C

  Legal consultation is crucial before proceeding with any vulnerability disclosure process, especially when dealing with vulnerabilities found in former employers' software. It ensures that the researcher adheres to legal and ethical standards, protects their rights, and avoids potential legal risks associated with disclosure. Therefore, advising the security researcher to seek legal consultation is the most prudent course of action in this situation.

• Question 13:

  A company recently deployed new servers to create an additional cluster to support a new application. The corporate security policy states that all new servers must be resilient. The new cluster has a high-availability configuration for a smooth failover. The failover was successful following a recent power outage, but both clusters lost critical data, which impacted recovery time. Which of the following needs to be configured to help ensure minimal delays when power outages occur in the future?

  A. Replication

  B. Caching

  C. Containerization

  D. Redundancy

  E. High availability

  Correct Answer: A

  Based on the requirement to reduce delays during power outages and the scenario's description of data loss despite high availability, configuring replication (option A) is crucial. Replication ensures that critical data is duplicated across clusters, allowing seamless failover and access to data from alternative locations in the event of server failures or power outages. This approach directly addresses the need for data resilience and continuity, ensuring minimal impact on operations during unforeseen disruptions. Thus, replication is the most suitable solution to enhance the company's data resilience and reduce recovery times during power outages.

• Question 14:

  A security researcher identified the following messages while testing a web application:

  /file/admin/myprofile.php ERROR file does not exist. /file/admin/userinfo.php ERROR file does not exist. /file/admin/adminprofile.php ERROR file does not exist. /file/admin/admininfo.php ERROR file does not exist. /file/admin/universalprofile.php ERROR file does not exist. /file/admin/universalinfo.php ERROR file does not exist. /file/admin/restrictedprofile.php ACCESS is denied. /file/admin/restrictedinfo.php ERROR file does not exist.

  Which of the following should the researcher recommend to remediate the issue?

  A. Software composition analysis

  B. Packet inspection

  C. Proper error handling

  D. Elimination of the use of unsafe functions

  Correct Answer: C

  The messages provide information about the existence and access permissions of certain files, which can be useful to an attacker. Proper error handling involves:

  Ensuring that error messages do not reveal sensitive information about the server or its structure.

  Customizing error messages to be generic and user-friendly without disclosing specifics about the error (e.g., "An error occurred" instead of "ERROR file does not exist" or "ACCESS is denied").

  Logging detailed error information on the server-side for debugging purposes without exposing it to the end user.

• Question 15:

  A company has been the target of LDAP injections, as well as brute-force, whaling, and spear-phishing attacks. The company is concerned about ensuring continued system access. The company has already implemented a SSO system with strong passwords. Which of the following additional controls should the company deploy?

  A. Two-factor authentication

  B. Identity proofing

  C. Challenge questions

  D. Live identity verification

  Correct Answer: A

• Question 16:

  Two companies that recently merged would like to unify application access between the companies, without initially merging internal authentication stores. Which of the following technical strategies would best meet this objective?

  A. Federation

  B. RADIUS

  C. TACACS+

  D. MFA

  E. ABAC

  Correct Answer: A

  Federation (option A) is the best technical strategy for allowing two recently merged companies to unify application access while keeping their internal authentication stores separate. It provides a secure, seamless, and standardized approach to authentication and authorization across organizational boundaries, ensuring efficient and controlled access to shared applications and resources.

• Question 17:

  A security analyst is participating in a risk assessment and is helping to calculate the exposure factor associated with various systems and processes within the organization. Which of the following resources would be most useful to calculate the exposure factor in this scenario?

  A. Gap analysis

  B. Business impact analysis

  C. Risk register

  D. Information security policy

  E. Lessons learned

  Correct Answer: B

• Question 18:

  A security architect is reviewing the following organizational specifications for a new application:

  1.

  Be sessionless and API-based

  2.

  Accept uploaded documents with PII, so all storage must be ephemeral

  3.

  Be able to scale on-demand across multiple nodes

  4.

  Restrict all network access except for the TLS port

  Which of the following ways should the architect recommend the application be deployed in order to meet security and organizational infrastructure requirements?

  A. Utilizing the cloud container service

  B. On server instances with autoscaling groups

  C. Using scripted delivery

  D. With a content delivery network

  Correct Answer: A

  Deploying the application using a cloud container service aligns well with the specified security and organizational infrastructure requirements. It ensures sessionless, API-based operation, supports ephemeral storage for uploaded documents with PII, enables on-demand scalability across multiple nodes, and facilitates strict restriction of network access except for the TLS port.

• Question 19:

  A security engineer has learned that terminated employees' accounts are not being disabled. The termination dates are updated automatically in the human resources information system software by the appropriate human resources staff. Which of the following would best reduce risks to the organization?

  A. Exporting reports from the system on a weekly basis to disable terminated employees' accounts

  B. Granting permission to human resources staff to mark terminated employees' accounts as disabled

  C. Configuring allowed login times for all staff to only work during business hours

  D. Automating a process to disable the accounts by integrating Active Directory and human resources information systems

  Correct Answer: D

  Automating the process to disable terminated employees' accounts by integrating Active Directory (or any other authentication system) with the human resources information system (HRIS) is the best approach to reduce risks to the organization. By automating this process, the organization ensures that accounts are disabled promptly and consistently whenever an employee's termination date is updated in the HRIS. This reduces the window of opportunity for terminated employees to retain access to systems and sensitive information after leaving the organization.

• Question 20:

  A company has identified a number of vulnerable, end-of-support systems with limited defensive capabilities. Which of the following would be the first step in reducing the attack surface in this environment?

  A. Utilizing hardening recommendations

  B. Deploying IPS/IDS throughout the environment

  C. Installing and updating antivirus

  D. Installing all available patches

  Correct Answer: A