CompTIA CompTIA Certifications CAS-005 Questions & Answers

• Question 131:

  A security architect for a global organization with a distributed workforce recently received funding lo deploy a CASB solution

  Which of the following most likely explains the choice to use a proxy-based CASB?

  A. The capability to block unapproved applications and services is possible

  B. Privacy compliance obligations are bypassed when using a user-based deployment.

  C. Protecting and regularly rotating API secret keys requires a significant time commitment

  D. Corporate devices cannot receive certificates when not connected to on-premises devices

  Correct Answer: A

  A proxy-based Cloud Access Security Broker (CASB) is chosen primarily for its ability to block unapproved applications and services. Here's why:

  Application and Service Control: Proxy-based CASBs can monitor and control the use of applications and services by inspecting traffic as it passes through the proxy. This allows the organization to enforce policies that block unapproved

  applications and services, ensuring compliance with security policies. Visibility and Monitoring: By routing traffic through the proxy, the CASB can provide detailed visibility into user activities and data flows, enabling better monitoring and

  threat detection.

  Real-Time Protection: Proxy-based CASBs can provide real-time protection against threats by analyzing and controlling traffic before it reaches the end user, thus preventing the use of risky applications and services.

• Question 132:

  Which of the following AI concerns is most adequately addressed by input sanitation?

  A. Model inversion

  B. Prompt Injection

  C. Data poisoning

  D. Non-explainable model

  Correct Answer: B

  Input sanitation is a critical process in cybersecurity that involves validating and cleaning data provided by users to prevent malicious inputs from causing harm. In the context of AI concerns:

  A. Model inversion involves an attacker inferring sensitive data from model outputs, typically requiring sophisticated methods beyond just manipulating input data. B. Prompt Injection is a form of attack where an adversary provides malicious input to manipulate the behavior of AI models, particularly those dealing with natural language processing (NLP). Input sanitation directly addresses this by ensuring that inputs are cleaned and validated to remove potentially harmful commands or instructions that could alter the AI's behavior. C. Data poisoning involves injecting malicious data into the training set to compromise the model. While input sanitation can help by filtering out bad data, data poisoning is typically addressed through robust data validation and monitoring during the model training phase, rather than real-time input sanitation. D. Non-explainable model refers to the lack of transparency in how AI models make decisions. This concern is not addressed by input sanitation, as it relates more to model design and interpretability techniques. Input sanitation is most relevant and effective for preventing Prompt Injection attacks, where the integrity of user inputs directly impacts the performance and security of AI models. References: CompTIA Security+ Study Guide "Security of Machine Learning" by Battista Biggio, Blaine Nelson, and Pavel Laskov OWASP (Open Web Application Security Project) guidelines on input validation and injection attacks

• Question 133:

  Recent repents indicate that a software tool is being exploited Attackers were able to bypass user access controls and load a database. A security analyst needs to find the vulnerability and recommend a mitigation. The analyst generates the following output: Which of the following would the analyst most likely recommend?

  

  A. Installing appropriate EDR tools to block pass-the-hash attempts

  B. Adding additional time to software development to perform fuzz testing

  C. Removing hard coded credentials from the source code

  D. Not allowing users to change their local passwords

  Correct Answer: C

  The output indicates that the software tool contains hard-coded credentials, which attackers can exploit to bypass user access controls and load the database. The most likely recommendation is to remove hard-coded credentials from the

  source code.

  Here's why:

  Security Best Practices: Hard-coded credentials are a significant security risk because they can be easily discovered through reverse engineering or simple inspection of the code. Removing them reduces the risk of unauthorized access.

  Credential Management: Credentials should be managed securely using environment variables, secure vaults, or configuration management tools that provide encryption and access controls. Mitigation of Exploits: By eliminating hard-coded

  credentials, the organization can prevent attackers from easily bypassing authentication mechanisms and gaining unauthorized access to sensitive systems.

• Question 134:

  After an incident response exercise, a security administrator reviews the following table:

  

  Which of the following should the administrator do to beat support rapid incident response in the future?

  A. Automate alerting to IT support for phone system outages.

  B. Enable dashboards for service status monitoring

  C. Send emails for failed log-In attempts on the public website

  D. Configure automated Isolation of human resources systems

  Correct Answer: B

  Enabling dashboards for service status monitoring is the best action to support rapid incident response. The table shows various services with different risk, criticality, and alert severity ratings. To ensure timely and effective incident response,

  real-time visibility into the status of these services is crucial.

  Why Dashboards for Service Status Monitoring?

  Real-time Visibility: Dashboards provide an at-a-glance view of the current status of all critical services, enabling rapid detection of issues. Centralized Monitoring: A single platform to monitor the status of multiple services helps streamline

  incident response efforts.

  Proactive Alerting: Dashboards can be configured to show alerts and anomalies immediately, ensuring that incidents are addressed as soon as they arise. Improved Decision Making: Real-time data helps incident response teams make

  informed decisions quickly, reducing downtime and mitigating impact. Other options, while useful, do not offer the same level of comprehensive, real-time visibility and proactive alerting:

  A. Automate alerting to IT support for phone system outages: This addresses one service but does not provide a holistic view.

  C. Send emails for failed log-in attempts on the public website: This is a specific alert for one type of issue and does not cover all services. D. Configure automated isolation of human resources systems: This is a reactive measure for a

  specific service and does not provide real-time status monitoring.

  References:

  CompTIA SecurityX Study Guide

  NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide"

  "Best Practices for Implementing Dashboards," Gartner Research

• Question 135:

  Audit findings indicate several user endpoints are not utilizing full disk encryption During me remediation process, a compliance analyst reviews the testing details for the endpoints and notes the endpoint device configuration does not support full disk encryption

  Which of the following is the most likely reason me device must be replaced'

  A. The HSM is outdated and no longer supported by the manufacturer

  B. The vTPM was not properly initialized and is corrupt.

  C. The HSM is vulnerable to common exploits and a firmware upgrade is needed

  D. The motherboard was not configured with a TPM from the OEM supplier.

  E. The HSM does not support sealing storage

  Correct Answer: D

  The most likely reason the device must be replaced is that the motherboard was not configured with a TPM (Trusted Platform Module) from the OEM (Original Equipment Manufacturer) supplier.

  Why TPM is Necessary for Full Disk Encryption:

  Hardware-Based Security: TPM provides a hardware-based mechanism to store encryption keys securely, which is essential for full disk encryption. Compatibility: Full disk encryption solutions, such as BitLocker, require TPM to ensure that

  the encryption keys are securely stored and managed. Integrity Checks: TPM enables system integrity checks during boot, ensuring that the device has not been tampered with.

  Other options do not directly address the requirement for TPM in supporting full disk encryption:

  A. The HSM is outdated: While HSM (Hardware Security Module) is important for security, it is not typically used for full disk encryption. B. The vTPM was not properly initialized: vTPM (virtual TPM) is less common and not typically a reason for requiring hardware replacement. C. The HSM is vulnerable to common exploits: This would require a firmware upgrade, not replacement of the device. E. The HSM does not support sealing storage: Sealing storage is relevant but not the primary reason for requiring TPM for full disk encryption. References: CompTIA SecurityX Study Guide "Trusted Platform Module (TPM) Overview," Microsoft Documentation "BitLocker Deployment Guide," Microsoft Documentation

• Question 136:

  A security analyst is reviewing the following authentication logs: Which of the following should the analyst do first?

  

  A. Disable User2's account

  B. Disable User12's account

  C. Disable User8's account

  D. Disable User1's account

  Correct Answer: D

  Based on the provided authentication logs, we observe that User1's account experienced multiple failed login attempts within a very short time span (at 8:01:23 AM on 12/15). This pattern indicates a potential brute-force attack or an attempt

  to gain unauthorized access. Here's a breakdown of why disabling User1's account is the appropriate first step:

  Failed Login Attempts: The logs show that User1 had four consecutive failed login attempts:

  Security Protocols and Best Practices: According to CompTIA Security+ guidelines, multiple failed login attempts within a short timeframe should trigger an immediate response to prevent further potential unauthorized access attempts. This

  typically involves temporarily disabling the account to stop ongoing brute- force attacks.

  Account Lockout Policy: Implementing an account lockout policy is a standard practice to thwart brute-force attacks. Disabling User1's account will align with these best practices and prevent further failed attempts, which might lead to

  successful unauthorized access if not addressed.

  References:

  By addressing User1's account first, we effectively mitigate the immediate threat of a brute- force attack, ensuring that further investigation can be conducted without the risk of unauthorized access continuing during the investigation period.

• Question 137:

  A security engineer performed a code scan that resulted in many false positives. The security engineer must find a solution that improves the quality of scanning results before application deployment.

  Which of the following is the best solution?

  A. Limiting the tool to a specific coding language and tuning the rule set

  B. Configuring branch protection rules and dependency checks

  C. Using an application vulnerability scanner to identify coding flaws in production

  D. Performing updates on code libraries before code development

  Correct Answer: A

  To improve the quality of code scanning results and reduce false positives, the best solution is to limit the tool to a specific coding language and fine-tune the rule set. By configuring the code scanning tool to focus on the specific language

  used in the application, the tool can more accurately identify relevant issues and reduce the number of false positives. Additionally, tuning the rule set ensures that the tool's checks are appropriate for the application's context, further

  improving the accuracy of the scan results.

  References:

  CompTIA SecurityX Study Guide: Discusses best practices for configuring code scanning tools, including language-specific tuning and rule set adjustments. "Secure Coding: Principles and Practices" by Mark G. Graff and Kenneth R. van

  Wyk: Highlights the importance of customizing code analysis tools to reduce false positives.

  OWASP (Open Web Application Security Project): Provides guidelines for configuring and tuning code scanning tools to improve accuracy.

• Question 138:

  A security analyst wants to use lessons learned from a poor incident response to reduce dwell lime in the future The analyst is using the following data points

  

  Which of the following would the analyst most likely recommend?

  A. Adjusting the SIEM to alert on attempts to visit phishing sites

  B. Allowing TRACE method traffic to enable better log correlation

  C. Enabling alerting on all suspicious administrator behavior

  D. utilizing allow lists on the WAF for all users using GFT methods

  Correct Answer: C

  In the context of improving incident response and reducing dwell time, the security analyst needs to focus on proactive measures that can quickly detect and alert on potential security breaches. Here's a detailed analysis of the options provided:

  A. Adjusting the SIEM to alert on attempts to visit phishing sites: While this is a useful measure to prevent phishing attacks, it primarily addresses external threats and doesn't directly impact dwell time reduction, which focuses on the time a threat remains undetected within a network.

  B. Allowing TRACE method traffic to enable better log correlation: The TRACE method in HTTP is used for debugging purposes, but enabling it can introduce security vulnerabilities. It's not typically recommended for enhancing security monitoring or incident response.

  C. Enabling alerting on all suspicious administrator behavior: This option directly targets the potential misuse of administrator accounts, which are often high-value targets for attackers. By monitoring and alerting on suspicious activities from admin accounts, the organization can quickly identify and respond to potential breaches, thereby reducing dwell time significantly. Suspicious behavior could include unusual login times, access to sensitive data not usually accessed by the admin, or any deviation from normal behavior patterns. This proactive monitoring is crucial for quick detection and response, aligning well with best practices in incident response. D. Utilizing allow lists on the WAF for all users using GET methods: This measure is aimed at restricting access based on allowed lists, which can be effective in preventing unauthorized access but doesn't specifically address the need for quick detection and response to internal threats. References: CompTIA SecurityX Study Guide: Emphasizes the importance of monitoring and alerting on admin activities as part of a robust incident response plan. NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide": Highlights best practices for incident response, including the importance of detecting and responding to suspicious activities quickly. "Incident Response and Computer Forensics" by Jason T. Luttgens, Matthew Pepe, and Kevin Mandia: Discusses techniques for reducing dwell time through effective monitoring and alerting mechanisms, particularly focusing on privileged account activities. By focusing on enabling alerting for suspicious administrator behavior, the security analyst addresses a critical area that can help reduce the time a threat goes undetected, thereby improving the overall security posture of the organization.

• Question 139:

  During a security assessment using an CDR solution, a security engineer generates the following report about the assets in me system: After five days, the EDR console reports an infection on the host 0WIN23 by a remote access Trojan Which of the following is the most probable cause of the infection?

  

  A. OW1N23 uses a legacy version of Windows that is not supported by the EDR

  B. LN002 was not supported by the EDR solution and propagates the RAT

  C. The EDR has an unknown vulnerability that was exploited by the attacker.

  D. 0W1N29 spreads the malware through other hosts in the network

  Correct Answer: A

  OWIN23 is running Windows 7, which is a legacy operating system. Many EDR solutions no longer provide full support for outdated operating systems like Windows 7, which has reached its end of life and is no longer receiving security updates from Microsoft. This makes such systems more vulnerable to infections and attacks, including remote access Trojans (RATs).

  A. OWIN23 uses a legacy version of Windows that is not supported by the EDR: This is the most probable cause because the lack of support means that the EDR solution may not fully protect or monitor this system, making it an easy target for infections. B. LN002 was not supported by the EDR solution and propagates the RAT: While LN002 is unmanaged, it is less likely to propagate the RAT to OWIN23 directly without an established vector. C. The EDR has an unknown vulnerability that was exploited by the attacker: This is possible but less likely than the lack of support for an outdated OS. D. OWIN29 spreads the malware through other hosts in the network: While this could happen, the status indicates OWIN29 is in a bypass mode, which might limit its interactions but does not directly explain the infection on OWIN23. References: CompTIA Security+ Study Guide NIST SP 800-53, "Security and Privacy Controls for Information Systems and Organizations" Microsoft's Windows 7 End of Support documentation

• Question 140:

  A developer needs to improve the cryptographic strength of a password-storage component in a web application without completely replacing the crypto-module. Which of the following is the most appropriate technique?

  A. Key splitting

  B. Key escrow

  C. Key rotation

  D. Key encryption

  E. Key stretching

  Correct Answer: E

  The most appropriate technique to improve the cryptographic strength of a password-storage component in a web application without completely replacing the crypto- module is key stretching. Here's why:

  Enhanced Security: Key stretching algorithms, such as PBKDF2, bcrypt, and scrypt, increase the computational effort required to derive the encryption key from the password, making brute-force attacks more difficult and time-consuming.

  Compatibility: Key stretching can be implemented alongside existing cryptographic modules, enhancing their security without the need for a complete overhaul. Industry Best Practices: Key stretching is a widely recommended practice for

  securely storing passwords, as it significantly improves resistance to password- cracking attacks.