CompTIA CompTIA Certifications CAS-005 Questions & Answers

• Question 161:

  A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems Given the following output:

  

  Which of the following actions would address the root cause of this issue?

  A. Automating the patching system to update base Images

  B. Recompiling the affected programs with the most current patches

  C. Disabling unused/unneeded ports on all servers

  D. Deploying a WAF with virtual patching upstream of the affected systems

  Correct Answer: A

  The output shows that multiple systems have outdated or vulnerable software versions (OpenSSL 1.01 and Java 11 runtime). This suggests that the systems are not being patched regularly or effectively. A. Automating the patching system to update base images: Automating the patching process ensures that the latest security updates and patches are applied to all systems, including newly deployed ones. This addresses the root cause by ensuring that base images used for deployment are always up-to-date with the latest security patches.

  B. Recompiling the affected programs with the most current patches: While this can fix the immediate vulnerabilities, it does not address the root cause of the problem, which is the lack of regular updates. C. Disabling unused/unneeded ports

  on all servers: This improves security but does not address the specific issue of outdated software. D. Deploying a WAF with virtual patching upstream of the affected systems: This can provide a temporary shield but does not resolve the

  underlying issue of outdated software. Automating the patching system to update base images ensures that all deployed systems are using the latest, most secure versions of software, addressing the root cause of the vulnerability trend.

  References:

  CompTIA Security+ Study Guide

  NIST SP 800-40 Rev. 3, "Guide to Enterprise Patch Management Technologies" CIS Controls, "Control 7: Continuous Vulnerability Management"

• Question 162:

  A company isolated its OT systems from other areas of the corporate network These systems are required to report usage information over the internet to the vendor

  Which oi the following b*st reduces the risk of compromise or sabotage? (Select two).

  A. Implementing allow lists

  B. Monitoring network behavior

  C. Encrypting data at rest

  D. Performing boot Integrity checks

  E. Executing daily health checks

  F. Implementing a site-to-site IPSec VPN

  Correct Answer: AF

  A. Implementing allow lists: Allow lists (whitelisting) restrict network communication to only authorized devices and applications, significantly reducing the attack surface by ensuring that only pre-approved traffic is permitted. F. Implementing a

  site-to-site IPSec VPN: A site-to-site VPN provides a secure, encrypted tunnel for data transmission between the OT systems and the vendor, protecting the data from interception and tampering during transit.

  Other options:

  B. Monitoring network behavior: While useful for detecting anomalies, it does not proactively reduce the risk of compromise or sabotage. C. Encrypting data at rest: Important for protecting data stored on devices, but does not address network

  communication risks. D. Performing boot integrity checks: Ensures the integrity of the system at startup but does not protect ongoing network communications. E. Executing daily health checks: Useful for maintaining system health but does

  not directly reduce the risk of network-based compromise or sabotage.

  References:

  CompTIA Security+ Study Guide

  NIST SP 800-82, "Guide to Industrial Control Systems (ICS) Security" "Industrial Network Security" by Eric D. Knapp and Joel Thomas Langill

• Question 163:

  A security analyst received a notification from a cloud service provider regarding an attack detected on a web server The cloud service provider shared the following information about the attack:

  1.

  The attack came from inside the network.

  2.

  The attacking source IP was from the internal vulnerability scanners.

  3.

  The scanner is not configured to target the cloud servers.

  Which of the following actions should the security analyst take first?

  A. Create an allow list for the vulnerability scanner IPs m order to avoid false positives

  B. Configure the scan policy to avoid targeting an out-of-scope host

  C. Set network behavior analysis rules

  D. Quarantine the scanner sensor to perform a forensic analysis

  Correct Answer: D

  When a security analyst receives a notification about an attack that appears to originate from an internal vulnerability scanner, it suggests that the scanner itself might have been compromised. This situation is critical because a compromised scanner can potentially conduct unauthorized scans, leak sensitive information, or execute malicious actions within the network. The appropriate first action involves containing the threat to prevent further damage and allow for a thorough investigation. Here's why quarantining the scanner sensor is the best immediate action: Containment and Isolation: Quarantining the scanner will immediately prevent it from continuing any malicious activity or scans. This containment is crucial to protect the rest of the network from potential harm. Forensic Analysis: By isolating the scanner, a forensic analysis can be performed to understand how it was compromised, what actions it took, and what data or systems might have been affected. This analysis will provide valuable insights into the nature of the attack and help in taking appropriate remedial actions. Preventing Further Attacks: If the scanner is allowed to continue operating, it might execute more unauthorized actions, leading to greater damage. Quarantine ensures that the threat is neutralized promptly. Root Cause Identification: A forensic analysis can help identify vulnerabilities in the scanner's configuration, software, or underlying system that allowed the compromise. This information is essential for preventing future incidents. Other options, while potentially useful in the long term, are not appropriate as immediate actions in this scenario:

  A. Create an allow list for the vulnerability scanner IPs to avoid false positives:

  This action addresses false positives but does not mitigate the immediate threat posed by the compromised scanner.

  B. Configure the scan policy to avoid targeting an out-of-scope host: This step is preventive for future scans but does not deal with the current incident where the scanner is already compromised. C. Set network behavior analysis rules: While

  useful for ongoing monitoring and detection, this does not address the immediate need to stop the compromised scanner's activities. In conclusion, the first and most crucial action is to quarantine the scanner sensor to halt any malicious

  activity and perform a forensic analysis to understand the scope and nature of the compromise. This step ensures that the threat is contained and provides a basis for further remediation efforts.

  References:

  CompTIA SecurityX Study Guide

  NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide"

• Question 164:

  A network engineer must ensure that always-on VPN access is enabled Curt restricted to company assets

  Which of the following best describes what the engineer needs to do'?

  A. Generate device certificates using the specific template settings needed

  B. Modify signing certificates in order to support IKE version 2

  C. Create a wildcard certificate for connections from public networks

  D. Add the VPN hostname as a SAN entry on the root certificate

  Correct Answer: A

  To ensure always-on VPN access is enabled and restricted to company assets, the network engineer needs to generate device certificates using the specific template settings required for the company's VPN solution. These certificates

  ensure that only authorized devices can establish a VPN connection.

  Why Device Certificates are Necessary:

  Authentication: Device certificates authenticate company assets, ensuring that only authorized devices can access the VPN.

  Security: Certificates provide a higher level of security compared to username and password combinations, reducing the risk of unauthorized access. Compliance: Certificates help in meeting security policies and compliance requirements by

  ensuring that only managed devices can connect to the corporate network.

  Other options do not provide the same level of control and security for always-on VPN access:

  B. Modify signing certificates for IKE version 2: While important for VPN protocols, it does not address device-specific authentication. C. Create a wildcard certificate: This is not suitable for device-specific authentication and could introduce

  security risks. D. Add the VPN hostname as a SAN entry: This is more related to certificate management and does not ensure device-specific authentication.

  References:

  CompTIA SecurityX Study Guide

  "Device Certificates for VPN Access," Cisco Documentation NIST Special Publication 800-77, "Guide to IPsec VPNs"

• Question 165:

  A security analyst is reviewing the following event timeline from an COR solution:

  

  Which of the following most likely has occurred and needs to be fixed?

  A. The Dl P has failed to block malicious exfiltration and data tagging is not being utilized property

  B. An EDR bypass was utilized by a threat actor and updates must be installed by the administrator.

  C. A logic law has introduced a TOCTOU vulnerability and must be addressed by the COR vendor

  D. A potential insider threat is being investigated and will be addressed by the senior management team.

  Correct Answer: C

  The event timeline indicates a sequence where a file (hr-reporting.docx) was saved, scanned, executed, and eventually found to contain malware. The critical issue here is that the malware scan completed after the file was already executed.

  This suggests a Time-Of- Check to Time-Of-Use (TOCTOU) vulnerability, where the state of the file changed between the time it was checked and the time it was used.

  References:

  CompTIA SecurityX Study Guide: Discusses TOCTOU vulnerabilities as a timing attack where the state of a resource changes after it has been validated. NIST Special Publication 800-53, "Security and Privacy Controls for Federal

  Information Systems and Organizations": Recommends addressing TOCTOU vulnerabilities to ensure the integrity of security operations. "The Art of Software Security Assessment" by Mark Dowd, John McDonald, and Justin Schuh: Covers

  logic flaws and timing vulnerabilities, including TOCTOU issues.

• Question 166:

  A company detects suspicious activity associated with external connections Security detection tools are unable to categorize this activity. Which of the following is the best solution to help the company overcome this challenge?

  A. Implement an Interactive honeypot

  B. Map network traffic to known loCs.

  C. Monitor the dark web

  D. implement UEBA

  Correct Answer: D

  User and Entity Behavior Analytics (UEBA) is the best solution to help the company overcome challenges associated with suspicious activity that cannot be categorized by traditional detection tools. UEBA uses advanced analytics to establish

  baselines of normal behavior for users and entities within the network. It then identifies deviations from these baselines, which may indicate malicious activity. This approach is particularly effective for detecting unknown threats and

  sophisticated attacks that do not match known indicators of compromise (IoCs).

  Reference: CompTIA SecurityX Study Guide, Chapter on Advanced Threat Detection and Mitigation, Section on User and Entity Behavior Analytics (UEBA).

• Question 167:

  A security analyst received a report that an internal web page is down after a company- wide update to the web browser Given the following error message:

  Your connection is not private.

  Attackers might be trying to steal your information for www.internalwebsite.company.com.

  NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM

  Which of the following is the best way to fix this issue?

  A. Rewriting any legacy web functions

  B. Disabling all deprecated ciphers

  C. Blocking all non-essential pons

  D. Discontinuing the use of self-signed certificates

  Correct Answer: D

  The error message "NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM" indicates that the web browser is rejecting the certificate because it uses a weak signature algorithm. This commonly happens with self-signed certificates, which

  often use outdated or insecure algorithms.

  Why Discontinue Self-Signed Certificates?

  Security Compliance: Modern browsers enforce strict security standards and may reject certificates that do not comply with these standards. Trusted Certificates: Using certificates from a trusted Certificate Authority (CA) ensures compliance

  with security standards and is less likely to be flagged as insecure.

  Weak Signature Algorithm: Self-signed certificates might use weak algorithms like MD5 or SHA-1, which are considered insecure.

  Other options do not address the specific cause of the certificate error:

  A. Rewriting legacy web functions: Does not address the certificate issue.

  B. Disabling deprecated ciphers: Useful for improving security but not related to the certificate error.

  C. Blocking non-essential ports: This is unrelated to the issue of certificate validation. References: CompTIA SecurityX Study Guide "Managing SSL/TLS Certificates," OWASP "Best Practices for Certificate Management," NIST Special Publication 800-57

• Question 168:

  A cloud engineer needs to identify appropriate solutions to:

  1.

  Provide secure access to internal and external cloud resources.

  2.

  Eliminate split-tunnel traffic flows.

  3.

  Enable identity and access management capabilities.

  Which of the following solutions arc the most appropriate? (Select two).

  A. Federation

  B. Microsegmentation

  C. CASB

  D. PAM

  E. SD-WAN

  F. SASE

  Correct Answer: CF

  To provide secure access to internal and external cloud resources, eliminate split-tunnel traffic flows, and enable identity and access management capabilities, the most appropriate solutions are CASB (Cloud Access Security Broker) and

  SASE (Secure Access Service Edge).

  Why CASB and SASE?

  CASB (Cloud Access Security Broker):

  SASE (Secure Access Service Edge):

  Other options, while useful, do not comprehensively address all the requirements:

  A. Federation: Useful for identity management but does not eliminate split-tunnel traffic or provide comprehensive security.

  B. Microsegmentation: Enhances security within the network but does not directly address secure access to cloud resources or split-tunnel traffic. D. PAM (Privileged Access Management): Focuses on managing privileged accounts and does not provide comprehensive access control for internal and external resources. E. SD-WAN: Enhances WAN performance but does not inherently provide the identity and access management capabilities or eliminate split-tunnel traffic. References: CompTIA SecurityX Study Guide "CASB: Cloud Access Security Broker," Gartner Research

• Question 169:

  A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate. Which of the following is the best way to meet this objective?

  A. Configuring an API Integration to aggregate the different data sets

  B. Combining back-end application storage into a single, relational database

  C. Purchasing and deploying commercial off the shelf aggregation software

  D. Migrating application usage logs to on-premises storage

  Correct Answer: A

  The best way to automate reporting from disparate security appliances that do not currently communicate is to configure an API Integration to aggregate the different data sets. Here's why:

  Interoperability: APIs allow different systems to communicate and share data, even if they were not originally designed to work together. This enables the integration of various security appliances into a unified reporting system. Automation:

  API integrations can automate the process of data collection, aggregation, and reporting, reducing manual effort and increasing efficiency. Scalability: APIs provide a scalable solution that can easily be extended to include additional security

  appliances or data sources as needed.

• Question 170:

  A company wants to implement hardware security key authentication for accessing sensitive information systems The goal is to prevent unauthorized users from gaining access with a stolen password Which of the following models should the company implement to best solve this issue?

  A. Rule based

  B. Time-based

  C. Role based

  D. Context-based

  Correct Answer: D

  Context-based authentication enhances traditional security methods by incorporating additional layers of information about the user's current environment and behavior. This can include factors such as the user's location, the time of access,

  the device used, and the behavior patterns. It is particularly useful in preventing unauthorized access even if an attacker has obtained a valid password.

  Rule-based (A) focuses on predefined rules and is less flexible in adapting to dynamic threats.

  Time-based (B) authentication considers the time factor but doesn't provide comprehensive protection against stolen credentials. Role-based (C) is more about access control based on the user's role within the organization rather than

  authenticating the user based on current context. By implementing context-based authentication, the company can ensure that even if a password is compromised, the additional contextual factors required for access (which an attacker is

  unlikely to possess) provide a robust defense mechanism.

  References:

  CompTIA SecurityX guide on authentication models and best practices. NIST guidelines on authentication and identity proofing. Analysis of multi-factor and adaptive authentication techniques.