CompTIA CompTIA Certifications CAS-004 Questions & Answers

• Question 671:

  SIMULATION

  An administrator wants to install a patch to an application.

  INSTRUCTIONS

  Given the scenario, download, verify, and install the patch in the most secure manner.

  The last install that is completed will be the final submission.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  A. See the explanation below.

  B. PlaceHoder

  C. PlaceHoder

  D. PlaceHoder

  Correct Answer: A

  In this case the second link should be used (This may vary in actual exam). The first link showed the following error so it should not be used.

  

  Also, Two of the link choices used HTTP and not HTTPS as shown when hovering over the links as shown:

  

  Since we need to do this in the most secure manner possible, they should not be used.

  Finally, the second link was used and the MD5 utility of MD5sum should be used on the install.exe file as shown. Make sure that the hash matches.

  

  Finally, type in install.exe to install it and make sure there are no signature verification errors.

• Question 672:

  SIMULATION

  As a security administrator, you are asked to harden a server running Red Hat Enterprise Server 5.5 64-bit.

  This server is being used as a DNS and time server. It is not used as a database, web server, or print server. There are no wireless connections to the server, and it does not need to print.

  The command window will be provided along with root access. You are connected via a secure shell with root access.

  You may query help for a list of commands.

  Instructions:

  You need to disable and turn off unrelated services and processes.

  It is possible to simulate a crash of your server session. The simulation can be reset, but the server cannot be rebooted.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  A. See the explanation below.

  B. PlaceHoder

  C. PlaceHoder

  D. PlaceHoder

  Correct Answer: A

  

  

• Question 673:

  SIMULATION

  You are a security analyst tasked with interpreting an Nmap scan output from Company A's privileged network.

  The company's hardening guidelines indicate the following:

  1.

  There should be one primary server or service per device.

  2.

  Only default ports should be used.

  3.

  Non-secure protocols should be disabled.

  INSTRUCTIONS

  Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed. For each device found, add a device entry to the Devices Discovered list, with the following information:

  1.

  The IP address of the device

  2.

  The primary server or service of the device

  3.

  The protocol(s) that should be disabled based on the hardening guidelines

  To select multiple protocols, use CTRL+CLICK.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  A. Check the answer in explanation.

  B. PlaceHoder

  C. PlaceHoder

  D. PlaceHoder

  Correct Answer: A

  10.1.45.65 SFTP Server Disable 8080

  10.1.45.66 Email Server Disable 415 and 443

  10.1.45.67 Web Server Disable 21, 80

  10.1.45.68 UTM Appliance Disable 21

• Question 674:

  SIMULATION

  A product development team has submitted code snippets for review pnor to release INSTRUCTIONS.

  Analyze the code snippets and then select one vulnerability and one fix for each code snippet If at any time you would like to bang back the initial state of the simulation, please click the Reset All button.

  

  A. Check the answer in explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  

  

• Question 675:

  SIMULATION

  An IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.

  Complete the configuration files to meet the following requirements:

  1.

  The EAP method must use mutual certificate-based authentication (with issued client certificates).

  2.

  The IKEv2 cipher suite must be configured to the MOST secure authenticated mode of operation.

  3.

  The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimum length requirement of eight characters.

  INSTRUCTIONS

  Click on the AAA server and VPN concentrator to complete the configuration. Fill in the appropriate fields and make selections from the drop-down menus.

  If at any time you would like to bung back the initial state of the simulation, please click the Reset All button.

  

  

  A. Check the answer in explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  

• Question 676:

  SIMULATION

  A security engineer needs to review the configurations of several devices on the network to meet the following requirements:

  1.

  The PostgreSQL server must only allow connectivity in the 10.1.2.0/24 subnet.

  2.

  The SSH daemon on the database server must be configured to listen to port 4022.

  3.

  The SSH daemon must only accept connections from a single workstation.

  4.

  All host-based firewalls must be disabled on all workstations.

  5.

  All devices must have the latest updates from within the past eight days.

  6.

  All HDDs must be configured to secure data at rest.

  7.

  Cleartext services are not allowed.

  8.

  All devices must be hardened when possible.

  INSTRUCTIONS

  Click on the various workstations and network devices to review the posture assessment results. Remediate any possible issues or indicate that no issue is found.

  Click on Server A to review output data. Select commands in the appropriate tab to remediate connectivity problems to the PostgreSQL database via SSH.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  

  

  A. Check the answer in explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  

• Question 677:

  SIMULATION

  You are about to enter the virtual environment.

  Once you have completed the item in the virtual environment, you will NOT be allowed to return to this item.

  Click Next to continue.

  

  DO NOT perform the following actions within the virtual environment. Making any of these changes will cause the virtual environment to fail and prevent proper scoring.

  1.

  Disabling ssh

  2.

  Disabling systemd

  3.

  Altering the network adapter 172.162.0.0

  4.

  Changing the password in the lab admin account

  Once you have completed the item in the virtual environment. you will NOT be allowed to return to this item.

  This system was recently patched following the exploitation of a vulnerability by an attacker to enable data exfiltration.

  Despite the vulnerability being patched, it is likely that a malicious TCP service is still running and the adversary has achieved persistence by creating a systemd service.

  Examples of commands to use:

  1.

  kill, killall

  2.

  lsof

  3.

  man, --help (use for assistance)

  4.

  netstat (useful flags: a, n, g, u)

  5.

  ps (useful flag: a)

  6.

  systemctl (to control systemd)

  Please note: the list of commands shown above is not exhaustive. All native commands are available.

  INSTRUSTIONS

  Using the following credentials:

  1.

  Username: labXXXadmin

  2.

  Password: XXXyyYzz!

  Investigate to identify indicators of compromise and then remediate them. You will need to make at least two changes:

  1.

  End the compromised process that is using a malicious TCP service.

  2.

  Remove the malicious persistence agent by disabling the service's ability to start on boot.

  A. Check the answer in explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Find the malicious service and use “Killall” switch command to end the process.

• Question 678:

  SIMULATION

  During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.

  INSTRUCTIONS

  Review each of the events and select the appropriate analysis and remediation options for each IoC.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  A. Check the answer in explanation below.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  

  

• Question 679:

  DRAG DROP

  IT staff within a company often conduct remote desktop sharing sessions with vendors to troubleshoot vendor product-related issues. Drag and drop the following security controls to match the associated security concern. Options may be used once or not at all.

  Select and Place:

  

  Correct Answer:

  

  Vendor may accidentally or maliciously make changes to the IT system - Allow view-only access.

  With view-only access, the third party can view the desktop but cannot interact with it. In other words, they cannot control the keyboard or mouse to make any changes.

  Desktop sharing traffic may be intercepted by network attackers - Use SSL for remote sessions.

  SSL (Secure Sockets Layer) encrypts data in transit between computers. If an attacker intercepted the traffic, the data would be encrypted and therefore unreadable to the attacker.

  No guarantees that shoulder surfing attacks are not occurring at the vendor - Identified control gap.

  Shoulder surfing is where someone else gains information by looking at your computer screen. This should be identified as a risk. A control gap occurs when there are either insufficient or no actions taken to avoid or mitigate a significant risk.

  Vendor may inadvertently see confidential material from the company such as email and IMs - Limit desktop session to certain windows.

  The easiest way to prevent a third party from viewing your emails and IMs is to close the email and IM application windows for the duration of the desktop sharing session.

• Question 680:

  DRAG DROP

  A security consultant is considering authentication options for a financial institution. The following authentication options are available security mechanism to the appropriate use case. Options may be used once.

  Select and Place:

  

  Correct Answer: