CompTIA CompTIA Certifications CAS-005 Questions & Answers

• Question 111:

  A systems administrator works with engineers to process and address vulnerabilities as a result of continuous scanning activities. The primary challenge faced by the administrator is differentiating between valid and invalid findings.

  Which of the following would the systems administrator most likely verify is properly configured?

  A. Report retention time

  B. Scanning credentials

  C. Exploit definitions

  D. Testing cadence

  Correct Answer: B

  When differentiating between valid and invalid findings from vulnerability scans, the systems administrator should verify that the scanning credentials are properly configured. Valid credentials ensure that the scanner can authenticate and

  access the systems being evaluated, providing accurate and comprehensive results. Without proper credentials, scans may miss vulnerabilities or generate false positives, making it difficult to prioritize and address the findings effectively.

  References:

  CompTIA SecurityX Study Guide: Highlights the importance of using valid credentials for accurate vulnerability scanning.

  "Vulnerability Management" by Park Foreman: Discusses the role of scanning credentials in obtaining accurate scan results and minimizing false positives. "The Art of Network Security Monitoring" by Richard Bejtlich: Covers best practices

  for configuring and using vulnerability scanning tools, including the need for valid credentials.

• Question 112:

  A security analyst is reviewing suspicious log-in activity and sees the following data in the SICM:

  

  Which of the following is the most appropriate action for the analyst to take?

  A. Update the log configuration settings on the directory server that Is not being captured properly.

  B. Have the admin account owner change their password to avoid credential stuffing.

  C. Block employees from logging in to applications that are not part of their business area.

  D. implement automation to disable accounts that nave been associated with high-risk activity.

  Correct Answer: D

  The log-in activity indicates a security threat, particularly involving the ADMIN account with a high-risk failure status. This suggests that the account may be targeted by malicious activities such as credential stuffing or brute force attacks.

  Updating log configuration settings (A) may help in better logging future activities but does not address the immediate threat. Changing the admin account password (B) is a good practice but may not fully mitigate the ongoing threat if the

  account has already been compromised. Blocking employees (C) from logging into non-business applications might help in reducing attack surfaces but doesn't directly address the compromised account issue.

  Implementing automation to disable accounts associated with high-risk activities ensures an immediate response to the detected threat, preventing further unauthorized access and allowing time for thorough investigation and remediation.

  References:

  CompTIA SecurityX guide on incident response and account management. Best practices for handling compromised accounts. Automation tools and techniques for security operations centers (SOCs).

• Question 113:

  After an incident occurred, a team reported during the lessons-learned review that the team.

  1.

  Lost important Information for further analysis.

  2.

  Did not utilize the chain of communication

  3.

  Did not follow the right steps for a proper response

  Which of the following solutions is the best way to address these findinds?

  A. Requesting budget for better forensic tools to Improve technical capabilities for Incident response operations

  B. Building playbooks for different scenarios and performing regular table-top exercises

  C. Requiring professional incident response certifications tor each new team member D. Publishing the incident response policy and enforcing it as part of the security awareness program

  Correct Answer: B

  Building playbooks for different scenarios and performing regular table-top exercises directly addresses the issues identified in the lessons-learned review. Here's why: Lost important information for further analysis: Playbooks outline step-by-step procedures for incident response, ensuring that team members know exactly what to document and how to preserve evidence. Did not utilize the chain of communication: Playbooks include communication protocols, specifying who to notify and when. Regular table-top exercises reinforce these communication channels, ensuring they are followed during actual incidents. Did not follow the right steps for a proper response: Playbooks provide a clear sequence of actions to be taken during various types of incidents, helping the team to respond in a structured and effective manner. Regular exercises allow the team to practice these steps, identifying and correcting any deviations from the plan. Investing in better forensic tools (Option A) or requiring certifications (Option C) are also valuable, but they do not directly address the procedural and communication gaps identified. Publishing and enforcing the incident response policy (Option D) is important but not as practical and hands-on as playbooks and exercises in ensuring the team is prepared. References: CompTIA Security+ Study Guide NIST SP 800-61 Rev. 2, "Computer Security Incident Handling Guide" SANS Institute, "Incident Handler's Handbook"

• Question 114:

  Users are willing passwords on paper because of the number of passwords needed in an environment.

  Which of the following solutions is the best way to manage this situation and decrease risks?

  A. Increasing password complexity to require 31 least 16 characters

  B. implementing an SSO solution and integrating with applications

  C. Requiring users to use an open-source password manager

  D. Implementing an MFA solution to avoid reliance only on passwords

  Correct Answer: B

  Implementing a Single Sign-On (SSO) solution and integrating it with applications is the best way to manage the situation and decrease risks. Here's why:

  Reduced Password Fatigue: SSO allows users to log in once and gain access to multiple applications and systems without needing to remember and manage multiple passwords. This reduces the likelihood of users writing down passwords.

  Improved Security: By reducing the number of passwords users need to manage, SSO decreases the attack surface and potential for password-related security breaches. It also allows for the implementation of stronger authentication

  methods. User Convenience: SSO improves the user experience by simplifying the login process, which can lead to higher productivity and satisfaction.

  References:

• Question 115:

  Users are experiencing a variety of issues when trying to access corporate resources examples include

  1.

  Connectivity issues between local computers and file servers within branch offices

  2.

  Inability to download corporate applications on mobile endpoints wtiilc working remotely

  3.

  Certificate errors when accessing internal web applications

  Which of the following actions are the most relevant when troubleshooting the reported issues? (Select two).

  A. Review VPN throughput

  B. Check IPS rules

  C. Restore static content on lite CDN.

  D. Enable secure authentication using NAC

  E. Implement advanced WAF rules.

  F. Validate MDM asset compliance

  Correct Answer: AF

  The reported issues suggest problems related to network connectivity, remote access, and certificate management:

  A. Review VPN throughput: Connectivity issues and the inability to download applications while working remotely may be due to VPN bandwidth or performance issues. Reviewing and optimizing VPN throughput can help resolve these

  problems by ensuring that remote users have adequate bandwidth for accessing corporate resources.

  F. Validate MDM asset compliance: Mobile Device Management (MDM) systems ensure that mobile endpoints comply with corporate security policies. Validating MDM compliance can help address issues related to the inability to download

  applications and certificate errors, as non-compliant devices might be blocked from accessing certain resources.

  B. Check IPS rules: While important for security, IPS rules are less likely to directly address the connectivity and certificate issues described. C. Restore static content on the CDN: This action is related to content delivery but does not address

  VPN or certificate-related issues. D. Enable secure authentication using NAC: Network Access Control (NAC) enhances security but does not directly address the specific issues described. E. Implement advanced WAF rules: Web Application

  Firewalls protect web applications but do not address VPN throughput or mobile device compliance.

  References:

  CompTIA Security+ Study Guide

  NIST SP 800-77, "Guide to IPsec VPNs"

  CIS Controls, "Control 11: Secure Configuration for Network Devices"

• Question 116:

  A financial services organization is using Al lo fully automate the process of deciding client loan rates

  Which of the following should the organization be most concerned about from a privacy perspective?

  A. Model explainability

  B. Credential Theft

  C. Possible prompt Injections

  D. Exposure to social engineering

  Correct Answer: A

  When using AI to fully automate the process of deciding client loan rates, the primary concern from a privacy perspective is model explainability.

  Why Model Explainability is Critical:

  Transparency: It ensures that the decision-making process of the AI model can be understood and explained to stakeholders, including clients. Accountability: Helps in identifying biases and errors in the model, ensuring that the AI is making

  fair and unbiased decisions.

  Regulatory Compliance: Various regulations require that decisions, especially those affecting individuals' financial status, can be explained and justified. Trust: Builds trust among users and stakeholders by demonstrating that the AI decisions

  are transparent and justifiable.

  Other options, such as credential theft, prompt injections, and social engineering, are significant concerns but do not directly address the privacy and fairness implications of automated decision-making.

  References:

  CompTIA SecurityX Study Guide

  "The Importance of Explainability in AI," IEEE Xplore GDPR Article 22, "Automated Individual Decision-Making, Including Profiling"

• Question 117:

  After remote desktop capabilities were deployed in the environment, various vulnerabilities were noticed.

  1.

  Exfiltration of intellectual property

  2.

  Unencrypted files

  3.

  Weak user passwords

  Which of the following is the best way to mitigate these vulnerabilities? (Select two).

  A. Implementing data loss prevention

  B. Deploying file integrity monitoring

  C. Restricting access to critical file services only

  D. Deploying directory-based group policies

  E. Enabling modem authentication that supports MFA

  F. Implementing a version control system

  G. Implementing a CMDB platform

  Correct Answer: AE

  To mitigate the identified vulnerabilities, the following solutions are most appropriate:

  A. Implementing data loss prevention (DLP): DLP solutions help prevent the unauthorized transfer of data outside the organization. This directly addresses the exfiltration of intellectual property by monitoring, detecting, and blocking sensitive

  data transfers.

  E. Enabling modern authentication that supports Multi-Factor Authentication (MFA): This significantly enhances security by requiring additional verification methods beyond just passwords. It addresses the issue of weak user passwords by

  making it much harder for unauthorized users to gain access, even if they obtain the password.

  Other options, while useful in specific contexts, do not address all the vulnerabilities mentioned:

  B. Deploying file integrity monitoring helps detect changes to files but does not prevent data exfiltration or address weak passwords. C. Restricting access to critical file services improves security but is not comprehensive enough to mitigate

  all identified vulnerabilities. D. Deploying directory-based group policies can enforce security policies but might not directly prevent data exfiltration or ensure strong authentication. F. Implementing a version control system helps manage

  changes to files but is not a security measure for preventing the identified vulnerabilities. G. Implementing a CMDB platform (Configuration Management Database) helps manage IT assets but does not address the specific security issues

  mentioned.

  References:

  CompTIA Security+ Study Guide

  NIST SP 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations"

  CIS Controls, "Control 13: Data Protection" and "Control 16: Account Monitoring and Control"

• Question 118:

  A global manufacturing company has an internal application mat is critical to making products This application cannot be updated and must Be available in the production area A security architect is implementing security for the application.

  Which of the following best describes the action the architect should take-?

  A. Disallow wireless access to the application.

  B. Deploy Intrusion detection capabilities using a network tap

  C. Create an acceptable use policy for the use of the application

  D. Create a separate network for users who need access to the application

  Correct Answer: D

  Creating a separate network for users who need access to the application is the best action to secure an internal application that is critical to the production area and cannot be updated.

  Why Separate Network?

  Network Segmentation: Isolates the critical application from the rest of the network, reducing the risk of compromise and limiting the potential impact of any security incidents. Controlled Access: Ensures that only authorized users have

  access to the application, enhancing security and reducing the attack surface. Minimized Risk: Segmentation helps in protecting the application from vulnerabilities that could be exploited from other parts of the network. Other options, while

  beneficial, do not provide the same level of security for a critical application:

  A. Disallow wireless access: Useful but does not provide comprehensive protection.

  B. Deploy intrusion detection capabilities using a network tap: Enhances monitoring but does not provide the same level of isolation and control. C. Create an acceptable use policy: Important for governance but does not provide technical

  security controls.

  References:

  CompTIA SecurityX Study Guide

  NIST Special Publication 800-125, "Guide to Security for Full Virtualization Technologies"

  "Network Segmentation Best Practices," Cisco Documentation

• Question 119:

  An organization wants to create a threat model to identity vulnerabilities in its infrastructure.

  Which of the following, should be prioritized first?

  A. External-facing Infrastructure with known exploited vulnerabilities

  B. Internal infrastructure with high-seventy and Known exploited vulnerabilities

  C. External facing Infrastructure with a low risk score and no known exploited vulnerabilities

  D. External-facing infrastructure with a high risk score that can only be exploited with local access to the resource

  Correct Answer: A

  When creating a threat model to identify vulnerabilities in an organization's infrastructure, prioritizing external-facing infrastructure with known exploited vulnerabilities is critical.

  Here's why:

  Exposure to Attack: External-facing infrastructure is directly exposed to the internet, making it a primary target for attackers. Any vulnerabilities in this layer pose an immediate risk to the organization's security. Known Exploited Vulnerabilities:

  Vulnerabilities that are already known and exploited in the wild are of higher concern because they are actively being used by attackers. Addressing these vulnerabilities reduces the risk of exploitation significantly. Risk Mitigation: By

  prioritizing external-facing infrastructure with known exploited vulnerabilities, the organization can mitigate the most immediate and impactful threats, thereby improving overall security posture.

• Question 120:

  A security architect wants to develop a baseline of security configurations These configurations automatically will be utilized machine is created

  Which of the following technologies should the security architect deploy to accomplish this goal?

  A. Short

  B. GASB

  C. Ansible

  D. CMDB

  Correct Answer: C

  To develop a baseline of security configurations that will be automatically utilized when a machine is created, the security architect should deploy Ansible. Here's why:

  Automation: Ansible is an automation tool that allows for the configuration, management, and deployment of applications and systems. It ensures that security configurations are consistently applied across all new machines. Scalability:

  Ansible can scale to manage thousands of machines, making it suitable for large enterprises that need to maintain consistent security configurations across their infrastructure. Compliance: By using Ansible, organizations can enforce

  compliance with security policies and standards, ensuring that all systems are configured according to best practices.