CompTIA CompTIA Certifications CAS-005 Questions & Answers

• Question 101:

  Which of the following best explains the business requirement a healthcare provider fulfills by encrypting patient data at rest?

  A. Securing data transfer between hospitals

  B. Providing for non-repudiation data

  C. Reducing liability from identity theft

  D. Protecting privacy while supporting portability.

  Correct Answer: D

  Encrypting patient data at rest is a critical requirement for healthcare providers to ensure compliance with regulations such as the Health Insurance Portability and Accountability Act (HIPAA). The primary business requirement fulfilled by this

  practice is the protection of patient privacy while supporting the portability of medical information. By encrypting data at rest, healthcare providers safeguard sensitive patient information from unauthorized access, ensuring that privacy is

  maintained even if the storage media are compromised. Additionally, encryption supports the portability of patient records, allowing for secure transfer and access across different systems and locations while ensuring that privacy controls are

  in place.

  References:

  CompTIA SecurityX Study Guide: Emphasizes the importance of data encryption for protecting sensitive information and ensuring compliance with regulatory requirements.

  HIPAA Security Rule: Requires healthcare providers to implement safeguards, including encryption, to protect patient data.

  "Health Informatics: Practical Guide for Healthcare and Information Technology Professionals" by Robert E. Hoyt: Discusses encryption as a key measure for protecting patient data privacy and supporting data portability.

• Question 102:

  A user submits a help desk ticket stating then account does not authenticate sometimes. An analyst reviews the following logs for the user:

  Which of the following best explains the reason the user's access is being denied?

  A. incorrectly typed password

  B. Time-based access restrictions

  C. Account compromise

  D. Invalid user-to-device bindings

  Correct Answer: B

  The logs reviewed for the user indicate that access is being denied due to time-based access restrictions. These restrictions are commonly implemented to limit access to systems during specific hours to enhance security. If a user attempts

  to authenticate outside of the allowed time window, access will be denied. This measure helps prevent unauthorized access during non-business hours, reducing the risk of security incidents.

  References:

  CompTIA SecurityX Study Guide: Covers various access control methods, including time-based restrictions, as a means of enhancing security. NIST Special Publication 800-53, "Security and Privacy Controls for Information Systems and

  Organizations": Recommends the use of time-based access restrictions as part of access control policies.

  "Access Control and Identity Management" by Mike Chapple and Aaron French:

  Discusses the implementation and benefits of time-based access restrictions.

• Question 103:

  A company updates its cloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved lo the repository The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment

  Which of the following should a security engineer recommend to reduce the deployment failures? (Select two).

  A. Software composition analysis

  B. Pre-commit code linting

  C. Repository branch protection

  D. Automated regression testing

  E. Code submit authorization workflow

  F. Pipeline compliance scanning

  Correct Answer: BD

  B. Pre-commit code linting: Linting tools analyze code for syntax errors and adherence to coding standards before the code is committed to the repository. This helps catch minor code issues early in the development process, reducing the

  likelihood of deployment failures.

  D. Automated regression testing: Automated regression tests ensure that new code changes do not introduce bugs or regressions into the existing codebase. By running these tests automatically during the deployment process, developers

  can catch issues early and ensure the stability of the development environment.

  Other options:

  A. Software composition analysis: This helps identify vulnerabilities in third-party components but does not directly address code quality or deployment failures. C. Repository branch protection: While this can help manage the code

  submission process, it does not directly prevent deployment failures caused by code issues or security check failures.

  E. Code submit authorization workflow: This manages who can submit code but does not address the quality of the code being submitted. F. Pipeline compliance scanning: This checks for compliance with security policies but does not

  address syntax or regression issues.

  References:

  CompTIA Security+ Study Guide

  "Continuous Integration and Continuous Delivery" by Jez Humble and David Farley

  OWASP (Open Web Application Security Project) guidelines on secure coding practices

• Question 104:

  A company receives several complaints from customers regarding its website. An engineer implements a parser for the web server logs that generates the following output:

  

  which of the following should the company implement to best resolve the issue?

  A. IDS

  B. CDN

  C. WAF

  D. NAC

  Correct Answer: B

  The table indicates varying load times for users accessing the website from different geographic locations. Customers from Australia and India are experiencing significantly higher load times compared to those from the United States. This suggests that latency and geographical distance are affecting the website's performance. A. IDS (Intrusion Detection System): While an IDS is useful for detecting malicious activities, it does not address performance issues related to latency and geographical distribution of content.

  B. CDN (Content Delivery Network): A CDN stores copies of the website's content in multiple geographic locations. By serving content from the nearest server to the user, a CDN can significantly reduce load times and improve user

  experience globally.

  C. WAF (Web Application Firewall): A WAF protects web applications by filtering and monitoring HTTP traffic but does not improve performance related to geographical latency. D. NAC (Network Access Control): NAC solutions control access

  to network resources but are not designed to address web performance issues. Implementing a CDN is the best solution to resolve the performance issues observed in the log output.

  References:

  CompTIA Security+ Study Guide

  "CDN: Content Delivery Networks Explained" by Akamai Technologies NIST SP 800-44, "Guidelines on Securing Public Web Servers"

• Question 105:

  A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware static of a domain controller The forensic team cryptographically validated that com the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LOAP

  Which of the following is me best way to reduce the risk oi reoccurrence?

  A. Enforcing allow lists for authorized network pons and protocols

  B. Measuring and attesting to the entire boot chum

  C. Rolling the cryptographic keys used for hardware security modules

  D. Using code signing to verify the source of OS updates

  Correct Answer: A

  The scenario describes a sophisticated attack where the threat actor used steganography within LDAP to exfiltrate data. Given that the hardware and OS firmware were validated and found uncompromised, the attack vector likely exploited a

  network communication channel. To mitigate such risks, enforcing allow lists for authorized network ports and protocols is the most effective strategy.

  Here's why this option is optimal:

  Port and Protocol Restrictions: By creating an allow list, the organization can restrict communications to only those ports and protocols that are necessary for legitimate business operations. This reduces the attack surface by preventing

  unauthorized or unusual traffic.

  Network Segmentation: Enforcing such rules helps in segmenting the network and ensuring that only approved communications occur, which is critical in preventing data exfiltration methods like steganography. Preventing Unauthorized

  Access: Allow lists ensure that only predefined, trusted connections are allowed, blocking potential paths that attackers could use to infiltrate or exfiltrate data.

  Other options, while beneficial in different contexts, are not directly addressing the network communication threat:

  B. Measuring and attesting to the entire boot chain: While this improves system integrity, it doesn't directly mitigate the risk of data exfiltration through network channels. C. Rolling the cryptographic keys used for hardware security modules:

  This is useful for securing data and communications but doesn't directly address the specific method of exfiltration described. D. Using code signing to verify the source of OS updates: Ensures updates are from legitimate sources, but it

  doesn't mitigate the risk of network-based data exfiltration.

  References:

  CompTIA SecurityX Study Guide

  NIST Special Publication 800-41, "Guidelines on Firewalls and Firewall Policy" CIS Controls Version 8, Control 9: Limitation and Control of Network Ports, Protocols, and Services

• Question 106:

  During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server Given the following portion of the code:

  

  Which of the following best describes this incident?

  A. XSRF attack

  B. Command injection

  C. Stored XSS

  D. SQL injection

  Correct Answer: C

  The provided code snippet shows a script that captures the user's cookies and sends them to a remote server. This type of attack is characteristic of Cross-Site Scripting (XSS), specifically stored XSS, where the malicious script is stored on the target server (e.g., in a database) and executed in the context of users who visit the infected web page. A. XSRF (Cross-Site Request Forgery) attack: This involves tricking the user into performing actions on a different site without their knowledge but does not involve stealing cookies via script injection.

  B. Command injection: This involves executing arbitrary commands on the host operating system, which is not relevant to the given JavaScript code. C. Stored XSS: The provided code snippet matches the pattern of a stored XSS attack,

  where the script is injected into a web page, and when users visit the page, the script executes and sends the user's cookies to the attacker's server. D. SQL injection: This involves injecting malicious SQL queries into the database and is

  unrelated to the given JavaScript code.

  References:

  CompTIA Security+ Study Guide

  OWASP (Open Web Application Security Project) guidelines on XSS "The Web Application Hacker's Handbook" by Dafydd Stuttard and Marcus Pinto

• Question 107:

  A compliance officer is reviewing the data sovereignty laws in several countries where the organization has no presence

  Which of the following is the most likely reason for reviewing these laws?

  A. The organization is performing due diligence of potential tax issues.

  B. The organization has been subject to legal proceedings in countries where it has a presence.

  C. The organization is concerned with new regulatory enforcement in other countries

  D. The organization has suffered brand reputation damage from incorrect media coverage

  Correct Answer: C

  Reviewing data sovereignty laws in countries where the organization has no presence is likely due to concerns about regulatory enforcement. Data sovereignty laws dictate how data can be stored, processed, and transferred across borders. Understanding these laws is crucial for compliance, especially if the organization handles data that may be subject to foreign regulations. A. The organization is performing due diligence of potential tax issues: This is less likely as tax issues are generally not directly related to data sovereignty laws. B. The organization has been subject to legal proceedings in countries where it has a presence: While possible, this does not explain the focus on countries where the organization has no presence.

  C. The organization is concerned with new regulatory enforcement in other countries: This is the most likely reason. New regulations could impact the organization's operations, especially if they involve data transfers or processing data from

  these countries.

  D. The organization has suffered brand reputation damage from incorrect media coverage: This is less relevant to the need for reviewing data sovereignty laws.

  References:

  CompTIA Security+ Study Guide

  GDPR and other global data protection regulations "Data Sovereignty: The Future of Data Protection?" by Mark Burdon

• Question 108:

  Which of the following best describes the challenges associated with widespread adoption of homomorphic encryption techniques?

  A. Incomplete mathematical primitives

  B. No use cases to drive adoption

  C. Quantum computers not yet capable

  D. insufficient coprocessor support

  Correct Answer: D

  Homomorphic encryption allows computations to be performed on encrypted data without decrypting it, providing strong privacy guarantees. However, the adoption of homomorphic encryption is challenging due to several factors:

  A. Incomplete mathematical primitives: This is not the primary barrier as the theoretical foundations of homomorphic encryption are well-developed. B. No use cases to drive adoption: There are several compelling use cases for homomorphic

  encryption, especially in privacy-sensitive fields like healthcare and finance.

  C. Quantum computers not yet capable: Quantum computing is not directly related to the challenges of adopting homomorphic encryption. D. Insufficient coprocessor support: The computational overhead of homomorphic encryption is

  significant, requiring substantial processing power. Current general- purpose processors are not optimized for the intensive computations required by homomorphic encryption, limiting its practical deployment. Specialized hardware or

  coprocessors designed to handle these computations more efficiently are not yet widely available.

  References:

  CompTIA Security+ Study Guide

  "Homomorphic Encryption: Applications and Challenges" by Rivest et al.

  NIST, "Report on Post-Quantum Cryptography"

• Question 109:

  A systems administrator wants to introduce a newly released feature for an internal application. The administrate docs not want to test the feature in the production environment.

  Which of the following locations is the best place to test the new feature?

  A. Staging environment

  B. Testing environment

  C. CI/CO pipeline

  D. Development environment

  Correct Answer: A

  The best location to test a newly released feature for an internal application, without affecting the production environment, is the staging environment. Here's a detailed explanation:

  Staging Environment: This environment closely mirrors the production environment in terms of hardware, software, configurations, and settings. It serves as a final testing ground before deploying changes to production. Testing in the staging

  environment ensures that the new feature will behave as expected in the actual production setup.

  Isolation from Production: The staging environment is isolated from production, which means any issues arising from the new feature will not impact the live users or the integrity of the production data. This aligns with best practices in change

  management and risk mitigation.

  Realistic Testing: Since the staging environment replicates the production environment, it provides realistic testing conditions. This helps in identifying potential issues that might not be apparent in a development or testing environment, which

  often have different configurations and workloads.

• Question 110:

  A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed

  

  Which of the following is the best action for the security analyst to take?

  A. Block messages from hr-saas.com because it is not a recognized domain.

  B. Reroute all messages with unusual security warning notices to the IT administrator

  C. Quarantine all messages with sales-mail.com in the email header

  D. Block vendor com for repeated attempts to send suspicious messages

  Correct Answer: D

  In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here's the analysis of the options provided:

  A. Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking. B.

  Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages. C. Quarantine all

  messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails. D. Block vendor com for repeated attempts to

  send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous

  communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.

  References:

  CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity. NIST Special Publication 800-45 Version 2, "Guidelines on Electronic Mail Security":

  Provides guidelines on email security, including the management of suspicious email domains.

  "Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft" by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent

  offenders.

  By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.