CompTIA CompTIA Certifications CAS-004 Questions & Answers

• Question 431:

  Within change management, which of the following ensures functions are earned out by multiple employees?

  A. Least privilege

  B. Mandatory vacation

  C. Separation of duties

  D. Job rotation

  Correct Answer: C

  Reference: https://www aihr com/bloa/job-rotation/

• Question 432:

  An employee decides to log into an authorized system The system does not prompt the employee for authentication prior to granting access to the console, and it cannot authenticate the network resources. Which of the following attack types can this lead to if it is not mitigated?

  A. Memory leak

  B. Race condition

  C. Smurf

  D. Deadlock

  Correct Answer: C

  Reference: https://www imperva com/learn/ddos/smurf-attack-ddos/

• Question 433:

  A cybersecunty analyst receives a ticket that indicates a potential incident is occurring. There has been a large increase in log files generated by a website containing a `Contact Us' form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign or if this is a potential incident.

  Which of the following would BEST assist the analyst?

  A. Ensuring proper input validation is configured on the `Contact Us' form

  B. Deploying a WAF in front of the public website

  C. Checking for new rules from the inbound network IPS vendor

  D. Running the website log files through a log reduction and analysis tool

  Correct Answer: D

  By deploying a WAF in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects a client machine's identity by using an intermediary, a WAF is a type of reverse-proxy, protecting the server from exposure by having clients pass through the WAF before reaching the server

• Question 434:

  During the migration of a company's human resources application to a PaaS provider, the Chief Privacy Officer (CPO) expresses concern the vendor's staff may be able to access data within the migrating application The application stack

  includes a multitier architecture and uses commercially available, vendor-supported software packages.

  Which of the following BEST addresses the CPO's concerns?

  A. Execute non-disclosure agreements and background checks on vendor staff

  B. Ensure the platform vendor implements data-at-rest encryption on its storage

  C. Enable MFA to the vendor's tier of the architecture

  D. Implement a CASB that tokenizes company data in transit to the migrated applications.

  Correct Answer: D

  Reference: https://www.omo.orQ/cloud/deliverables/CSCC-Miqratino-ApDlications-to-Public-Cloud-Sefvices-Roadmap-for-Success.pdf

• Question 435:

  An application developer has been informed of a web application that is susceptible to a clickjacking vulnerability Which of the following code snippets would be MOST applicable to resolve this vulnerability?

  A. Content-Security-Policy frame-ancestors: 'none'

  B. $escaped_command = escapeshellcmd(Sargs); exec ($escaped_command, Soutput, $return_var);

  C. sqlQuery= 'SELECT * FROM custTable WHERE User=? AND Pass=?' parameters.add("User", username)

  D. require 'digest/sha2' sha256 = Digest::SHA2.new(256)

  Correct Answer: A

  Content-Security-Policy: frame-ancestors 'none';

  This prevents any domain from framing the content This setting is recommended unless a specific need has been identified for framing

• Question 436:

  A company recently experienced a period of rapid growth, and it now needs to move to a more scalable cloud-based solution. Historically, salespeople have maintained separate systems for information on competing customers to prevent the inadvertent disclosure of one customer's information to another customer.

  Which of the following would be the BEST method to provide secure data separation?

  A. Use a CRM tool to separate data stores

  B. Migrate to a single-tenancy cloud infrastructure.

  C. Employ network segmentation to provide isolation among salespeople

  D. Implement an open-source public cloud CRM

  Correct Answer: C

• Question 437:

  The OS on several servers crashed around the same time for an unknown reason. The servers were restored to working conditions, and all file integrity was verified

  Which of the following should the incident response team perform to understand the crash and prevent it in the future?

  A. Root cause analysis

  B. Continuity of operations plan

  C. After-action report

  D. Lessons learned

  Correct Answer: A

• Question 438:

  An organization has been notified of a breach related to its sensitive data The point of compromise is the use of weak encryption algorithms on a web server that provides access to a legacy API The organization had previously decided to

  accept the nsk of using weak algorithms due to the cost to continually develop the legacy platform.

  Other system owners need to be aware of the increased likelihood of this threat.

  Which of the following should be reviewed by the CERT and presented to system owners to ensure a proper nsk analysis is performed?

  A. Lessons learned

  B. Incident log

  C. Risk register

  D. Root-cause analysis

  E. Gap analysis

  Correct Answer: A

• Question 439:

  Over the last 90 days, many private storage services have been exposed in the cloud services environments, and the security team does not have the ability to see who is creating these instances. Shadow IT is creating data services and instances faster than the email security team can keep up with them. The Chief Information Security Officer (CISO) has asked the security lead architect to recommend solutions to this problem.

  Which of the following BEST addresses the problem with the least amount of administrative effort?

  A. Compile a list of firewall requests and compare them against interesting cloud services

  B. Implement a CASB solution and track cloud service use cases for greater visibility

  C. Implement a user-behavior analytics system to associate user events with cloud service creation events

  D. Capture all logs and feed them to a SIEM. and then analyze for cloud service events.

  Correct Answer: D

• Question 440:

  A facilities manager requests approval to deploy a new key management system that integrates with logical network access controls to provide conditional access. The security analyst who is assessing the risk has no experience with the category of products.

  Which of the following is the FIRST step the analyst should take to begin the research?

  A. Seek documented industry best practices.

  B. Review the preferred vendor's white papers.

  C. Compare the product function to relevant RFCs

  D. Execute a non-disclosure agreement with the vendor

  Correct Answer: A