CompTIA CompTIA Certifications CAS-004 Questions & Answers

• Question 511:

  A company based in the United States holds insurance details of EU citizens. Which of the following must be adhered to when processing EU citizens' personal, private, and confidential data?

  A. The principle of lawful, fair, and transparent processing

  B. The right to be forgotten principle of personal data erasure requests

  C. The non-repudiation and deniability principle

  D. The principle of encryption, obfuscation, and data masking

  Correct Answer: A

• Question 512:

  An organization is researching the automation capabilities for systems within an OT network. A security analyst wants to assist with creating secure coding practices and would like to learn about the programming languages used on the PLCs. Which of the following programming languages is the MOST relevant for PLCs?

  A. Ladder logic

  B. Rust

  C. C

  D. Python

  E. Java

  Correct Answer: A

• Question 513:

  A bank is working with a security architect to find the BEST solution to detect database management system compromises. The solution should meet the following requirements:

  1.

  Work at the application layer

  2.

  Send alerts on attacks from both privileged and malicious users

  3.

  Have a very low false positive

  Which of the following should the architect recommend?

  A. FIM

  B. WAF

  C. NIPS

  D. DAM

  E. UTM

  Correct Answer: D

• Question 514:

  An attacker infiltrated the code base of a hardware manufacturer and inserted malware before the code was compiled. The malicious code is now running at the hardware level across a number of industries and sectors.

  Which of the following categories BEST describes this type of vendor risk?

  A. SDLC attack

  B. Side-load attack

  C. Remote code signing

  D. Supply chain attack

  Correct Answer: D

• Question 515:

  Based on PCI DSS v3.4, One Particular database field can store data, but the data must be unreadable. Which of the following data objects meets this requirement?

  A. PAN

  B. CVV2

  C. Cardholder name

  D. expiration date

  Correct Answer: A

• Question 516:

  A company's finance department acquired a new payment system that exports data to an unencrypted file on the system. The company implemented controls on the file so only appropriate personnel are allowed access. Which of the following risk techniques did the department use in this situation?

  A. Accept

  B. Avoid

  C. Transfer

  D. Mitigate

  Correct Answer: D

• Question 517:

  A company just released a new video card. Due to limited supply and nigh demand, attackers are employing automated systems to purchase the device through the company's web store so they can resell it on the secondary market. The company's Intended customers are frustrated. A security engineer suggests implementing a CAPTCHA system on the web store to help reduce the number of video cards purchased through automated systems. Which of the following now describes the level of risk?

  A. Inherent Low

  B. Mitigated

  C. Residual

  D. Transferred

  Correct Answer: A

• Question 518:

  Due to internal resource constraints, the management team has asked the principal security architect to recommend a solution that shifts partial responsibility for application- level controls to the cloud provider. In the shared responsibility model, which of the following levels of service meets this requirement?

  A. laaS

  B. SaaS

  C. FaaS

  D. PaaS

  Correct Answer: D

• Question 519:

  An organization is assessing the security posture of a new SaaS CRM system that handles sensitive PI I and identity information, such as passport numbers. The SaaS CRM system does not meet the organization's current security standards.

  The assessment identifies the following:

  1) There will be a 520,000 per day revenue loss for each day the system is delayed going into production.

  2) The inherent risk is high.

  3) The residual risk is low.

  4) There will be a staged deployment to the solution rollout to the contact center.

  Which of the following risk-handling techniques will BEST meet the organization's requirements?

  A. Apply for a security exemption, as the risk is too high to accept.

  B. Transfer the risk to the SaaS CRM vendor, as the organization is using a cloud service.

  C. Accept the risk, as compensating controls have been implemented to manage the risk.

  D. Avoid the risk by accepting the shared responsibility model with the SaaS CRM provider.

  Correct Answer: C

• Question 520:

  A networking team asked a security administrator to enable Flash on its web browser. The networking team explained that an important legacy embedded system gathers SNMP information from various devices. The system can only be managed through a web browser running Flash. The embedded system will be replaced within the year but is still critical at the moment.

  Which of the following should the security administrator do to mitigate the risk?

  A. Explain to the networking team the reason Flash is no longer available and insist the team move up the timetable for replacement.

  B. Air gap the legacy system from the network and dedicate a laptop with an end-of-life OS on it to connect to the system via crossover cable for management.

  C. Suggest that the networking team contact the original embedded system's vendor to get an update to the system that does not require Flash.

  D. Isolate the management interface to a private VLAN where a legacy browser in a VM can be used as needed to manage the system.

  Correct Answer: D