CompTIA CompTIA Certifications CAS-005 Questions & Answers

• Question 91:

  A systems administrator wants to reduce the number of failed patch deployments in an organization. The administrator discovers that system owners modify systems or applications in an ad hoc manner.

  Which of the following is the best way to reduce the number of failed patch deployments?

  A. Compliance tracking

  B. Situational awareness

  C. Change management

  D. Quality assurance

  Correct Answer: C

  To reduce the number of failed patch deployments, the systems administrator should implement a robust change management process. Change management ensures that all modifications to systems or applications are planned, tested, and

  approved before deployment. This systematic approach reduces the risk of unplanned changes that can cause patch failures and ensures that patches are deployed in a controlled and predictable manner.

  References:

  CompTIA SecurityX Study Guide: Emphasizes the importance of change management in maintaining system integrity and ensuring successful patch deployments.

  ITIL (Information Technology Infrastructure Library) Framework: Provides best practices for change management in IT services.

  "The Phoenix Project" by Gene Kim, Kevin Behr, and George Spafford: Discusses the critical role of change management in IT operations and its impact on system stability and reliability.

• Question 92:

  A central bank implements strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin. Which of the following best describes the cyberthreat to the bank?

  A. Ability to obtain components during wartime

  B. Fragility and other availability attacks

  C. Physical Implants and tampering

  D. Non-conformance to accepted manufacturing standards

  Correct Answer: C

  The best description of the cyber threat to a central bank implementing strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin, is the risk of physical implants and tampering. Here's why: Supply Chain Security: The supply chain is a critical vector for hardware tampering and physical implants, which can compromise the integrity and security of hardware components before they reach the organization. Targeted Attacks: Banks and financial institutions are high-value targets, making them susceptible to sophisticated attacks, including those involving physical implants that can be introduced during manufacturing or shipping processes. Strict Mitigations: Implementing an allow list for specific countries aims to mitigate the risk of supply chain attacks by limiting the sources of hardware. However, the primary concern remains the introduction of malicious components through tampering.

• Question 93:

  A company that relies on an COL system must keep it operating until a new solution is available

  Which of the following is the most secure way to meet this goal?

  A. Isolating the system and enforcing firewall rules to allow access to only required endpoints

  B. Enforcing strong credentials and improving monitoring capabilities

  C. Restricting system access to perform necessary maintenance by the IT team

  D. Placing the system in a screened subnet and blocking access from internal resources

  Correct Answer: A

  To ensure the most secure way of keeping a legacy system (COL) operating until a new solution is available, isolating the system and enforcing strict firewall rules is the best approach. This method minimizes the attack surface by restricting

  access to only the necessary endpoints, thereby reducing the risk of unauthorized access and potential security breaches. Isolating the system ensures that it is not exposed to the broader network, while firewall rules control the traffic that

  can reach the system, providing a secure environment until a replacement is implemented.

  References:

  CompTIA SecurityX Study Guide: Recommends network isolation and firewall rules as effective measures for securing legacy systems. NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security": Advises on

  isolating critical systems and using firewalls to control access.

  "Network Security Assessment" by Chris McNab: Discusses techniques for isolating systems and enforcing firewall rules to protect vulnerable or legacy systems. By isolating the system and implementing strict firewall controls, the

  organization can maintain the necessary operations securely while working on deploying a new solution.

• Question 94:

  A security configure is building a solution to disable weak CBC configuration for remote access connections lo Linux systems.

  Which of the following should the security engineer modify?

  A. The /etc/openssl.conf file, updating the virtual site parameter

  B. The /etc/nsswith.conf file, updating the name server

  C. The /etc/hosts file, updating the IP parameter

  D. The /etc/etc/sshd, configure file updating the ciphers

  Correct Answer: D

  The sshd_config file is the main configuration file for the OpenSSH server. To disable weak CBC (Cipher Block Chaining) ciphers for SSH connections, the security engineer should modify the sshd_config file to update the list of allowed

  ciphers. This file typically contains settings for the SSH daemon, including which encryption algorithms are allowed.

  By editing the /etc/ssh/sshd_config file and updating the Ciphers directive, weak ciphers can be removed, and only strong ciphers can be allowed. This change ensures that the SSH server does not use insecure encryption methods.

  References:

  CompTIA Security+ Study Guide

  OpenSSH manual pages (man sshd_config)

  CIS Benchmarks for Linux

• Question 95:

  A vulnerability can on a web server identified the following:

  

  Which of the following actions would most likely eliminate on path decryption attacks? (Select two).

  A. Disallowing cipher suites that use ephemeral modes of operation for key agreement

  B. Removing support for CBC-based key exchange and signing algorithms

  C. Adding TLS_ECDHE_ECDSA_WITH_AE3_256_GCMS_HA256

  D. Implementing HIPS rules to identify and block BEAST attack attempts

  E. Restricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA

  F. Increasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA

  Correct Answer: BC

  On-path decryption attacks, such as BEAST (Browser Exploit Against SSL/TLS) and other related vulnerabilities, often exploit weaknesses in the implementation of CBC (Cipher Block Chaining) mode. To mitigate these attacks, the following actions are recommended:

  B. Removing support for CBC-based key exchange and signing algorithms: CBC mode is vulnerable to certain attacks like BEAST. By removing support for CBC- based ciphers, you can eliminate one of the primary vectors for these attacks. Instead, use modern cipher modes like GCM (Galois/Counter Mode) which offer better security properties.

  C. Adding TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA256: This cipher suite uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for key exchange, which provides perfect forward secrecy. It also uses AES in GCM mode, which is not susceptible to the same attacks as CBC. SHA-256 is a strong hash function that ensures data integrity. References: CompTIA Security+ Study Guide NIST SP 800-52 Rev. 2, "Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations" OWASP (Open Web Application Security Project) guidelines on cryptography and secure communication

• Question 96:

  A company is having issues with its vulnerability management program New devices/lPs are added and dropped regularly, making the vulnerability report inconsistent

  Which of the following actions should the company lake to most likely improve the vulnerability management process'

  A. Request a weekly report with all new assets deployed and decommissioned

  B. Extend the DHCP lease lime to allow the devices to remain with the same address for a longer period.

  C. Implement a shadow IT detection process to avoid rogue devices on the network

  D. Perform regular discovery scanning throughout the 11 landscape using the vulnerability management tool

  Correct Answer: D

  To improve the vulnerability management process in an environment where new devices/IPs are added and dropped regularly, the company should perform regular discovery scanning throughout the IT landscape using the vulnerability

  management tool.

  Here's why:

  Accurate Asset Inventory: Regular discovery scans help maintain an up-to-date inventory of all assets, ensuring that the vulnerability management process includes all relevant devices and IPs. Consistency in Reporting: By continuously

  discovering and scanning new and existing assets, the company can generate consistent and comprehensive vulnerability reports that reflect the current state of the network. Proactive Management:

  Regular scans enable the organization to proactively identify and address vulnerabilities on new and existing assets, reducing the window of exposure to potential threats.

• Question 97:

  Within a SCADA a business needs access to the historian server in order together metric about the functionality of the environment.

  Which of the following actions should be taken to address this requirement?

  A. Isolating the historian server for connections only from The SCADA environment

  B. Publishing the C$ share from SCADA to the enterprise

  C. Deploying a screened subnet between 11 and SCADA

  D. Adding the business workstations to the SCADA domain

  Correct Answer: A

  The best action to address the requirement of accessing the historian server within a SCADA system is to isolate the historian server for connections only from the SCADA environment. Here's why:

  Security and Isolation: Isolating the historian server ensures that only authorized devices within the SCADA environment can connect to it. This minimizes the attack surface and protects sensitive data from unauthorized access. Access

  Control: By restricting access to the historian server to only SCADA devices, the organization can better control and monitor interactions, ensuring that only legitimate queries and data retrievals occur. Best Practices for Critical Infrastructure:

  Following the principle of least privilege, isolating critical components like the historian server is a standard practice in securing SCADA systems, reducing the risk of cyberattacks.

• Question 98:

  While reviewing recent modem reports, a security officer discovers that several employees were contacted by the same individual who impersonated a recruiter.

  Which of the following best describes this type of correlation?

  A. Spear-phishing campaign

  B. Threat modeling

  C. Red team assessment

  D. Attack pattern analysis

  Correct Answer: A

  The situation where several employees were contacted by the same individual impersonating a recruiter best describes a spear-phishing campaign. Here's why:

  Targeted Approach: Spear-phishing involves targeting specific individuals within an organization with personalized and convincing messages to trick them into divulging sensitive information or performing actions that compromise security.

  Impersonation: The use of impersonation, in this case, a recruiter, is a common tactic in spear-phishing to gain the trust of the targeted individuals and increase the likelihood of a successful attack. Correlated Contacts: The fact that several

  employees were contacted by the same individual suggests a coordinated effort to breach the organization's security by targeting multiple points of entry through social engineering.

• Question 99:

  A security analyst reviews the following report:

  

  Which of the following assessments is the analyst performing?

  A. System

  B. Supply chain

  C. Quantitative

  D. Organizational

  Correct Answer: B

  The table shows detailed information about products, including location, chassis manufacturer, OS, application developer, and vendor. This type of information is typically assessed in a supply chain assessment to evaluate the security and

  reliability of components and services from different suppliers.

  Why Supply Chain Assessment?

  Component Evaluation: Assessing the origin and security of each component used in the products, including hardware, software, and third-party services. Vendor Reliability: Evaluating the security practices and reliability of vendors involved

  in providing components or services.

  Risk Management: Identifying potential risks associated with the supply chain, such as vulnerabilities in third-party components or insecure development practices.

  Other types of assessments do not align with the detailed supplier and component information provided:

  A. System: Focuses on individual system security, not the broader supply chain. C. Quantitative: Focuses on numerical risk assessments, not supplier information. D. Organizational: Focuses on internal organizational practices, not external

  suppliers.

  References:

  CompTIA SecurityX Study Guide

  NIST Special Publication 800-161, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations"

  "Supply Chain Security Best Practices," Gartner Research

• Question 100:

  A security officer received several complaints from users about excessive MPA push notifications at night The security team investigates and suspects malicious activities regarding user account authentication

  Which of the following is the best way for the security officer to restrict MI~A notifications''

  A. Provisioning FID02 devices

  B. Deploying a text message based on MFA

  C. Enabling OTP via email

  D. Configuring prompt-driven MFA

  Correct Answer: D

  Excessive MFA push notifications can be a sign of an attempted push notification attack, where attackers repeatedly send MFA prompts hoping the user will eventually approve one by mistake. To mitigate this:

  A. Provisioning FIDO2 devices: While FIDO2 devices offer strong authentication, they may not be practical for all users and do not directly address the issue of excessive push notifications.

  B. Deploying a text message-based MFA: SMS-based MFA can still be vulnerable to similar spamming attacks and phishing.

  C. Enabling OTP via email: Email-based OTPs add another layer of security but do not directly solve the issue of excessive notifications. D. Configuring prompt-driven MFA: This option allows users to respond to prompts in a secure manner,

  often including features like time-limited approval windows, additional verification steps, or requiring specific actions to approve. This can help prevent users from accidentally approving malicious attempts. Configuring prompt-driven MFA is

  the best solution to restrict unnecessary MFA notifications and improve security.

  References:

  CompTIA Security+ Study Guide

  NIST SP 800-63B, "Digital Identity Guidelines"

  "Multi-Factor Authentication: Best Practices" by Microsoft