CompTIA CompTIA Certifications CAS-004 Questions & Answers

• Question 61:

  IoCs were missed during a recent security incident due to the reliance on a signature-based detection platform. A security engineer must recommend a solution that can be implemented to address this shortcoming. Which of the following would be the most appropriate recommendation?

  A. FIM

  B. SASE

  C. UEBA

  D. CSPM

  E. EAP

  Correct Answer: C

  UEBA focuses on analyzing the behaviors of users and entities within the network to identify anomalies that may indicate security threats. Unlike signature-based detection, which relies on known patterns of malicious activity, UEBA uses machine learning and advanced analytics to detect deviations from normal behavior. This approach can identify new and unknown threats that do not match existing signatures, thus addressing the limitation of missing IoCs that signature-based systems might overlook

• Question 62:

  A security analyst discovers a new device on the company's dedicated IoT subnet during the most recent vulnerability scan. The scan results show numerous open ports and insecure protocols in addition to default usernames and passwords. A camera needs to transmit video to the security server in the IoT subnet. Which of the following should the security analyst recommend to securely operate the camera?

  A. Harden the camera configuration.

  B. Send camera logs to the SIEM.

  C. Encrypt the camera's video stream.

  D. Place the camera on an isolated segment.

  Correct Answer: A

• Question 63:

  An application engineer is using the Swagger framework to leverage REST APIs to authenticate endpoints. The engineer is receiving HTTP 403 responses. Which of the following should the engineer do to correct this issue? (Choose two.)

  A. Obtain a security token.

  B. Obtain a public key.

  C. Leverage Kerberos for authentication

  D. Leverage OAuth for authentication.

  E. Leverage LDAP for authentication.

  F. Obtain a hash value.

  Correct Answer: AD

  Obtain a security token: HTTP 403 responses typically indicate that the request is authenticated but the user does not have the necessary permissions to access the endpoint. Obtaining a security token is a common method for authenticating

  requests. This token is usually required by the API to verify that the requestor has the proper access rights.

  Leverage OAuth for authentication: OAuth is a widely used authentication framework that allows an application to obtain limited access to user accounts on an HTTP service. It is commonly used for token-based authentication, and leveraging

  OAuth would help in obtaining the necessary tokens and permissions to access the API endpoints.

• Question 64:

  To bring digital evidence in a court of law the evidence must be:

  A. material

  B. tangible

  C. consistent

  D. conserved

  Correct Answer: A

  In the context of legal proceedings, "material" evidence refers to evidence that is relevant and has a significant impact on the case at hand. For digital evidence to be admissible in court, it must be material, meaning it must relate directly to the case and contribute to proving or disproving a key aspect of the case. Material evidence helps establish the facts and is crucial for the court's decision-making process.

• Question 65:

  A compliance officer is responsible for selecting the right governance framework to protect individuals' data. Which of the following is the appropriate framework for the company to consult when collecting international user data for the purpose of processing credit cards?

  A. ISO 27001

  B. COPPA

  C. NIST 800-53

  D. PCI DSS

  Correct Answer: D

• Question 66:

  To bring digital evidence in a court of law, the evidence must be:

  A. material.

  B. tangible.

  C. consistent.

  D. conserved.

  Correct Answer: A

  For evidence to be admissible in court, it must be material, meaning it must be relevant and have a significant impact on the case. Material evidence directly relates to the facts in dispute and can affect the outcome of the case by proving or disproving a key point.

• Question 67:

  A company's software developers have indicated that the security team takes too long to perform application security tasks. A security analyst plans to improve the situation by implementing security into the SDLC. The developers have the following requirements:

  1.

  The solution must be able to initiate SQL injection and reflected XSS attacks.

  2.

  The solution must ensure the application is not susceptible to memory leaks.

  Which of the following should be implemented to meet these requirements? (Choose two.)

  A. Side-channel analysis

  B. Protocol scanner

  C. HTTP interceptor

  D. DAST

  E. Fuzz testing

  F. SAST

  G. SCAP

  Correct Answer: DF

  DAST (Dynamic Application Security Testing): DAST is a type of black-box testing that involves testing an application in its running state. It can initiate SQL injection and reflected XSS attacks by simulating these attacks against the live application to identify vulnerabilities. This meets the first requirement of initiating SQL injection and reflected XSS attacks.

  SAST (Static Application Security Testing): SAST is a type of white-box testing that involves analyzing the source code of an application. It can detect vulnerabilities related to memory management, such as memory leaks, by examining the code for issues that could lead to such problems. This meets the second requirement of ensuring the application is not susceptible to memory leaks.

• Question 68:

  A company has received threat intelligence about bad routes being advertised. The company has also been receiving reports of degraded internet activity. When looking at the routing table on the edge router, a security engineer discovers the following:

  

  Which of the following can the company implement to prevent receiving bad routes from peers, while still allowing dynamic updates?

  A. OSPF prefix list

  B. BGP prefix list

  C. EIGRP prefix list

  D. DNS

  Correct Answer: B

• Question 69:

  A financial institution generates a list of newly created accounts and sensitive information on a daily basis. The financial institution then sends out a file containing thousands of lines of data. Which of the following would be the best way to reduce the risk of a malicious insider making changes to the file that could go undetected?

  A. Write a SIEM rule that generates a critical alert when files are created on the application server.

  B. Implement a FIM that automatically generates alerts when the file is accessed by IP addresses that are not associated with the application.

  C. Create a script that compares the size of the file on an hourly basis and generates alerts when changes are identified.

  D. Tune the rules on the host-based IDS for the application server to trigger automated alerts when the application server is accessed from the internet.

  Correct Answer: B

  File Integrity Monitoring (FIM) is a technology that can detect changes in files, often used to safeguard critical data. Implementing a FIM solution that generates alerts for access by unauthorized IP addresses would ensure that any unauthorized modifications to the file can be detected and acted upon. This helps in mitigating the risk of insider threats, as it would alert to any changes not made through the expected application process.

• Question 70:

  A security engineer is re-architecting a network environment that provides regional electric distribution services. During a pretransition baseline assessment, the engineer identified the following security-relevant characteristics of the environment:

  1.

  Enterprise IT servers and supervisory industrial systems share the same subnet.

  2.

  Supervisory controllers use the 750MHz band to direct a portion of fielded PLCs.

  3.

  Command and telemetry messages from industrial control systems are unencrypted and unauthenticated.

  Which of the following re-architecture approaches would be best to reduce the company's risk?

  A. Implement a one-way guard between enterprise IT services and mission-critical systems, obfuscate legitimate RF signals by broadcasting noise, and implement modern protocols to authenticate ICS messages.

  B. Characterize safety-critical versus non-safety-critical systems, isolate safety-critical systems from other systems, and increase the directionality of RF links in the field.

  C. Create a new network segment for enterprise IT servers, configure NGFW to enforce a well-defined segmentation policy, and implement a WIDS to monitor the spectrum.

  D. Segment supervisory controllers from field PLCs, disconnect the entire network from the internet, and use only the 750MHz link for controlling energy distribution services.

  Correct Answer: C

  The best approach to reduce the company's risk is to segregate the enterprise IT servers and supervisory industrial systems. Creating a new network segment and using a Next- Generation Firewall (NGFW) to enforce a strict segmentation policy will help to isolate the systems and protect against potential attacks. Additionally, implementing a Wireless Intrusion Detection System (WIDS) can help monitor the spectrum for unauthorized devices or interference.