Achieve Remarkable Results in the CompTIA CASP+ Exam with Reliable CAS-003 Study Materials

Question #1

Given the following information about a company’s internal network:User IP space: 192.168.1.0/24 Server IP space: 192.168.192.0/25A security engineer has been told that there are rogue websites hosted outside of the proper server space, and those websites need to be identified.Which of the following should the engineer do?

A. se a protocol analyzer on 192

B. se a port scanner on 192

C. se an HTTP interceptor on 192

D. se a port scanner on 192

E. se a protocol analyzer on 192

View answer

Correct Answer: B

Question #2

A newly hired security analyst has joined an established SOC team. Not long after going through corporate orientation, a new attack method on web-based applications was publicly revealed. The security analyst immediately brings this new information to the team lead, but the team lead is not concerned about it.Which of the following is the MOST likely reason for the team lead’s position?

A. he organization has accepted the risks associated with web-based threats

B. he attack type does not meet the organization’s threat model

C. eb-based applications are on isolated network segments

D. orporate policy states that NIPS signatures must be updated every hour

View answer

Correct Answer: A

Question #3

A company wants to confirm sufficient executable space protection is in place for scenarios in which malware may be attempting buffer overflow attacks. Which of the following should the security engineer check?

A. X/XN

B. SLR

C. trcpy

D. CC

View answer

Correct Answer: A

Question #4

A penetration tester is conducting an assessment on Comptia.org and runs the following command from a coffee shop while connected to the public Internet:Which of the following should the penetration tester conclude about the command output?

A. he public/private views on the Comptia

B. omptia

C. he DNS SPF records have not been updated for Comptia

D. 92

View answer

Correct Answer: B

Question #5

A security analyst, who is working in a Windows environment, has noticed a significant amount of IPv6 traffic originating from a client, even though IPv6 is not currently in use. The client is a stand-alone device, not connected to the AD that manages a series of SCADA devices used for manufacturing. Which of the following is the appropriate command to disable the client’s IPv6 stack?

A. uarantine emails sent to external domains containing PII and release after inspection

B. revent PII from being sent to domains that allow users to sign up for free webmail

C. nable transport layer security on all outbound email communications and attachments

D. rovide security awareness training regarding transmission of PII

View answer

Correct Answer: C

Question #6

An infrastructure team within an energy organization is at the end of a procurement process and has selected a vendor’s SaaS platform to deliver services. As part of the legal negotiation, there are a number of outstanding risks, including:1. There are clauses that confirm a data retention period in line with what is in the energy organization’s security policy.2. The data will be hosted and managed outside of the energy organization’s geographical location.The number of users accessing the system will be s

A. evelop a security exemption, as the solution does not meet the security policies of the energy organization

B. equire a solution owner within the energy organization to accept the identified risks and consequences

C. ititgate the risks by asking the vendor to accept the in-country privacy principles and modify the retention period

D. eview the procurement process to determine the lessons learned in relation to discovering risks toward the end of the process

View answer

Correct Answer: B

Question #7

A medical device company is implementing a new COTS antivirus solution in its manufacturing plant. All validated machines and instruments must be retested for interoperability with the new software.Which of the following would BEST ensure the software and instruments are working as designed?

A. ystem design documentation

B. ser acceptance testing

C. eer review

D. tatic code analysis testing

E. hange control documentation

View answer

Correct Answer: B

Question #8

A networking administrator was recently promoted to security administrator in an organization that handles highly sensitive data. The Chief Information Security Officer (CISO) has just asked for all IT security personnel to review a zero-day vulnerability and exploit for specific application servers to help mitigate the organization’s exposure to that risk. Which of the following should the new security administrator review to gain more information? (Choose three.)

A. IEM

B. DS/IPS

C. roxy server

D. irewall

E. outer

View answer

Correct Answer: ACG

Question #9

Following a recent data breach, a company has hired a new Chief Information Security Officer (CISO). The CISO is very concerned about the response time to the previous breach and wishes to know how the security team expects to react to a future attack. Which of the following is the BEST method to achieve this goal while minimizing disruption?

A. IEM server

B. DS appliance

C. CAP scanner

D. TTP interceptor

View answer

Correct Answer: C

Question #10

A recent penetration test identified that a web server has a major vulnerability. The web server hosts a critical shipping application for the company and requires 99.99% availability. Attempts to fix the vulnerability would likely break the application. The shipping application is due to be replaced in the next three months. Which of the following would BEST secure the web server until the replacement web server is ready?

A. atch management

B. ntivirus

C. pplication firewall

D. pam filters

E. IDS

View answer

Correct Answer: E

Question #11

A security engineer must establish a method to assess compliance with company security policies as they apply to the unique configuration of individual endpoints, as well as to the shared configuration policies of common devices. Which of the following tools is the security engineer using to produce the above output?

A. ulnerability scanner

B. IEM

C. ort scanner

D. CAP scanner

View answer

Correct Answer: B

Question #12

A security administrator wants to implement two-factor authentication for network switches and routers. The solution should integrate with the company’s RADIUS server, which is used for authentication to the network infrastructure devices. The security administrator implements the following:-An HOTP service is installed on the RADIUS server.-The RADIUS server is configured to require the HOTP service for authentication.The configuration is successfully tested using a software supplicant and enforced across

A. endor C for small remote sites, and Vendor B for large sites

B. endor B for all remote sites

C. endor C for all remote sites

D. endor A for all remote sites

E. endor D for all remote sites

View answer

Correct Answer: B

Question #13

The marketing department has developed a new marketing campaign involving significant social media outreach. The campaign includes allowing employees and customers to submit blog posts and pictures of their day-to-day experiences at the company. The information security manager has been asked to provide an informative letter to all participants regarding the security risks and how to avoid privacy and operational security issues.Which of the following is the MOST important information to reference in the le

A. fter-action reports from prior incidents

B. ocial engineering techniques

C. ompany policies and employee NDAs

D. ata classification processes

View answer

Correct Answer: C

Question #14

A Chief Information Security Officer (CISO) is working with a consultant to perform a gap assessment prior to an upcoming audit. It is determined during the assessment that the organization lacks controls to effectively assess regulatory compliance by third-party service providers. Which of the following should be revised to address this gap?

A. rivacy policy

B. ork breakdown structure

C. nterconnection security agreement

D. endor management plan

E. udit report

View answer

Correct Answer: D

Question #15

A deployment manager is working with a software development group to assess the security of a new version of the organization?€?s internally developed ERP tool.The organization prefers to not perform assessment activities following deployment, instead focusing on assessing security throughout the life cycle. Which of the following methods would BEST assess the security of the product?

A. Static code analysis in the IDE environment

B. Penetration testing of the UAT environment

C. Vulnerability scanning of the production environment

D. Penetration testing of the production environment

E. Peer review prior to unit testing

View answer

Correct Answer: C

Question #16

A security administrator is concerned about the increasing number of users who click on malicious links contained within phishing emails. Although the company has implemented a process to block these links at the network perimeter, many accounts are still becoming compromised. Which of the following should be implemented for further reduce the number of account compromises caused by remote users who click these links?

A. nti-spam gateways

B. ecurity awareness training

C. RL rewriting

D. nternal phishing campaign

View answer

Correct Answer: B

Question #17

An agency has implemented a data retention policy that requires tagging data according to type before storing it in the data repository. The policy requires all business emails be automatically deleted after two years. During an open records investigation, information was found on an employee’s work computer concerning a conversation that occurred three years prior and proved damaging to the agency’s reputation. Which of the following MOST likely caused the data leak?

A. he employee manually changed the email client retention settings to prevent deletion of emails

B. he file that contained the damaging information was mistagged and retained on the server for longer than it should have been

C. he email was encrypted and an exception was put in place via the data classification application

D. he employee saved a file on the computer’s hard drive that contained archives of emails, which were more than two years old

View answer

Correct Answer: D

Question #18

To prepare for an upcoming audit, the Chief Information Security Officer (CISO) asks for all 1200 vulnerabilities on production servers to be remediated. The security engineer must determine which vulnerabilities represent real threats that can be exploited so resources can be prioritized to migrate the most dangerous risks. The CISO wants the security engineer to act in the same manner as would an external threat, while using vulnerability scan results to prioritize any actions. Which of the following appr

A. lue team

B. ed team

C. lack box

D. hite team

View answer

Correct Answer: C

Question #19

The government is concerned with remote military missions being negatively impacted by the use of technology that may fail to protect operational security. To remediate this concern, a number of solutions have been implemented, including the following:-End-to-end encryption of all inbound and outbound communication, including personal email and chat sessions that allow soldiers to securely communicate with families. -Layer 7 inspection and TCP/UDP port restriction, including firewall rules to only allow TCP

A. alicious actors intercepting inbound and outbound communication to determine the scope of the mission

B. amily members posting geotagged images on social media that were received via email from soldiers

C. he effect of communication latency that may negatively impact real-time communication with mission control

D. he use of centrally managed military network and computers by soldiers when communicating with external parties

View answer

Correct Answer: B

Question #20

A systems administrator has installed a disk wiping utility on all computers across the organization and configured it to perform a seven-pass wipe and an additional pass to overwrite the disk with zeros. The company has also instituted a policy that requires users to erase files containing sensitive information when they are no longer needed.To ensure the process provides the intended results, an auditor reviews the following content from a randomly selected decommissioned hard disk: Which of the following

A. he hard disk contains bad sectors

B. he disk has been degaussed

C. he data represents part of the disk BIOS

D. ensitive data might still be present on the hard drives

View answer

Correct Answer: A

Question #21

Developers are working on a new feature to add to a social media platform. The new feature involves users uploading pictures of what they are currently doing. The data privacy officer (DPO) is concerned about various types of abuse that might occur due to this new feature. The DPO states the new feature cannot be released without addressing the physical safety concerns of the platform’s users.Which of the following controls would BEST address the DPO’s concerns?

A. ncreasing blocking options available to the uploader

B. dding a one-hour delay of all uploaded photos

C. emoving all metadata in the uploaded photo file

D. ot displaying to the public who uploaded the photo

E. orcing TLS for all connections on the platform

View answer

Correct Answer: C

Question #22

A web developer has implemented HTML5 optimizations into a legacy web application. One of the modifications the web developer made was the following client side optimization: localStorage.setItem(?€session-cookie?€, document.cookie);Which of the following should the security engineer recommend?

A. SessionStorage should be used so authorized cookies expire after the session ends

B. Cookies should be marked as ?€secure?€ and ?€HttpOnly?€

C. Cookies should be scoped to a relevant domain/path

D. Client-side cookies should be replaced by server-side mechanisms

View answer

Correct Answer: C

Question #23

A security engineer is attempting to convey the importance of including job rotation in a company’s standard security policies. Which of the following would be the BEST justification?

A. aking employees rotate through jobs ensures succession plans can be implemented and prevents single points of failure

B. orcing different people to perform the same job minimizes the amount of time malicious actions go undetected by forcing malicious actors to attempt collusion between two or more people

C. dministrators and engineers who perform multiple job functions throughout the day benefit from being cross-trained in new job areas

D. t eliminates the need to share administrative account passwords because employees gain administrative rights as they rotate into a new job area

View answer

Correct Answer: B

Question #24

A company relies on an ICS to perform equipment monitoring functions that are federally mandated for operation of the facility. Fines for non-compliance could be costly. The ICS has known vulnerabilities and can no longer be patched or updated. Cyber-liability insurance cannot be obtained because insurance companies will not insure this equipment.Which of the following would be the BEST option to manage this risk to the company's production environment?

A. void the risk by removing the ICS from production

B. ransfer the risk associated with the ICS vulnerabilities

C. itigate the risk by restricting access to the ICS

D. ccept the risk and upgrade the ICS when possible

View answer

Correct Answer: B

Question #25

A security researcher is gathering information about a recent spoke in the number of targeted attacks against multinational banks. The spike is on top of already sustained attacks against the banks. Some of the previous attacks have resulted in the loss of sensitive data, but as of yet the attackers have not successfully stolen any funds.Based on the information available to the researcher, which of the following is the MOST likely threat profile?

A. ation-state-sponsored attackers conducting espionage for strategic gain

B. nsiders seeking to gain access to funds for illicit purposes

C. pportunists seeking notoriety and fame for personal gain

D. acktivists seeking to make a political statement because of socio-economic factors

View answer

Correct Answer: D

Question #26

An internal staff member logs into an ERP platform and clicks on a record. The browser URL changes to:URL: http://192.168.0.100/ERP/accountId=5&action=SELECT Which of the following is the MOST likely vulnerability in this ERP platform?

A. rute forcing of account credentials

B. lain-text credentials transmitted over the Internet

C. nsecure direct object reference

D. QL injection of ERP back end

View answer

Correct Answer: C

Question #27

A security consultant is attempting to discover if the company is utilizing databases on client machines to store the customer data. The consultant reviews the following information: Which of the following commands would have provided this output?

A. rp -s

B. etstat -a

C. fconfig -arp

D. qlmap -w

View answer

Correct Answer: B

Question #28

A security appliance vendor is reviewing an RFP that is requesting solutions for the defense of a set of web- based applications. This RFP is from a financial institution with very strict performance requirements. The vendor would like to respond with its solutions. Before responding, which of the following factors is MOST likely to have an adverse effect on the vendor’s qualifications?

A. he solution employs threat information-sharing capabilities using a proprietary data model

B. he RFP is issued by a financial institution that is headquartered outside of the vendor’s own country

C. he overall solution proposed by the vendor comes in less that the TCO parameter in the RFP

D. he vendor’s proposed solution operates below the KPPs indicated in the RFP

View answer

Correct Answer: D

Question #29

A company wants to extend its help desk availability beyond business hours. The Chief Information Officer (CIO) decides to augment the help desk with a third- party service that will answer calls and provide Tier 1 problem resolution, such as password resets and remote assistance. The security administrator implements the following firewall change:

A. LDAP

B. WAYF

C. OpenID

D. RADIUS

E. SAML

View answer

Correct Answer: D

Question #30

After several industry competitors suffered data loss as a result of cyberattacks, the Chief Operating Officer (COO) of a company reached out to the information security manager to review the organization’s security stance. As a result of the discussion, the COO wants the organization to meet the following criteria:-Blocking of suspicious websites-Prevention of attacks based on threat intelligence-Reduction in spam-Identity-based reporting to meet regulatory compliance-Prevention of viruses based on signatu

A. econfigure existing IPS resources

B. mplement a WAF

C. eploy a SIEM solution

D. eploy a UTM solution

E. mplement an EDR platform

View answer

Correct Answer: D

Question #31

Which of the following is the GREATEST security concern with respect to BYOD?

A. he filtering of sensitive data out of data flows at geographic boundaries

B. emoving potential bottlenecks in data transmission paths

C. he transfer of corporate data onto mobile corporate devices

D. he migration of data into and out of the network in an uncontrolled manner

View answer

Correct Answer: D

Question #32

A security analyst who is concerned about sensitive data exfiltration reviews the following:Which of the following tools would allow the analyst to confirm if data exfiltration is occuring?

A. ort scanner

B. CAP tool

C. ile integrity monitor

D. rotocol analyzer

View answer

Correct Answer: D

Question #33

A security engineer is investigating a compromise that occurred between two internal computers. The engineer has determined during the investigation that one computer infected another. While reviewing the IDS logs, the engineer can view the outbound callback traffic, but sees no traffic between the two computers. Which of the following would BEST address the IDS visibility gap?

A. ar cvf - / | ssh 192

B. d if=/dev/mem | scp - 192

C. emdump /dev/sda1 | nc 192

D. d if=/dev/sda | nc 192

View answer

Correct Answer: C

Question #34

A Chief Information Security Officer (CISO) is reviewing the results of a gap analysis with an outside cybersecurity consultant. The gap analysis reviewed all procedural and technical controls and found the following:-High-impact controls implemented: 6 out of 10 -Medium-impact controls implemented: 409 out of 472 -Low-impact controls implemented: 97 out of 1000The report includes a cost-benefit analysis for each control gap. The analysis yielded the following information: -Average high-impact control imple

A. oo much emphasis has been placed on eliminating low-risk vulnerabilities in the past

B. he enterprise security team has focused exclusively on mitigating high-level risks

C. ecause of the significant ALE for each high-risk vulnerability, efforts should be focused on those controls

D. he cybersecurity team has balanced residual risk for both high and medium controls

View answer

Correct Answer: C

Question #35

A consultant is hired to perform a passive vulnerability assessment of a company to determine what information might be collected about the company and its employees. The assessment will be considered successful if the consultant can discover the name of one of the IT administrators.Which of the following is MOST likely to produce the needed information?

A. hois

B. NS enumeration

C. ulnerability scanner

D. ingerprinting

View answer

Correct Answer: A

Question #36

The Chief Information Security Officer (CISO) for an organization wants to develop custom IDS rulesets faster, prior to new rules being released by IDS vendors. Which of the following BEST meets this objective?

A. dentify a third-party source for IDS rules and change the configuration on the applicable IDSs to pull in the new rulesets

B. ncourage cybersecurity analysts to review open-source intelligence products and threat database to generate new IDS rules based on those sources

C. everage the latest TCP- and UDP-related RFCs to arm sensors and IDSs with appropriate heuristics for anomaly detection

D. se annual hacking conventions to document the latest attacks and threats, and then develop IDS rules to counter those threats

View answer

Correct Answer: B

Question #37

Ann, a terminated employee, left personal photos on a company-issued laptop and no longer has access to them. Ann emails her previous manager and asks to get her personal photos back.Which of the following BEST describes how the manager should respond?

A. etermine if the data still exists by inspecting to ascertain if the laptop has already been wiped and if the storage team has recent backups

B. nform Ann that the laptop was for company data only and she should not have stored personal photos on a company asset

C. eport the email because it may have been a spoofed request coming from an attacker who is trying to exfiltrate data from the company laptop

D. onsult with the legal and/or human resources department and check company policies around employment and termination procedures

View answer

Correct Answer: D

Question #38

A software development company lost customers recently because of a large number of software issues. These issues were related to integrity and availability defects, including buffer overflows, pointer dereferences, and others. Which of the following should the company implement to improve code quality? (Choose two.)

A. sing an SSO application that supports mutlifactor authentication

B. nabling the web application to support LDAP integration

C. orcing higher-complexity passwords and frequent changes

D. eploying Shibboleth to all web-based applications in the enterprise

View answer

Correct Answer: DF

Question #39

Which of the following describes a contract that is used to define the various levels of maintenance to be provided by an external business vendor in a secure environment?

A. DA

B. OU

C. IA

D. LA

View answer

Correct Answer: D

Question #40

An organization’s network security administrator has been using an SSH connection to manage switches and routers for several years. After attempting to connect to a router, an alert appears on the terminal emulation software, warning that the SSH key has changed.After confirming the administrator is using the typical workstation and the router has not been replaced, which of the following are the MOST likely explanations for the warning message? (Choose two.)

A. TR

B. LE

C. TBF

D. LE

E. PO

View answer

Correct Answer: BE

Question #41

An organization is currently working with a client to migrate data between a legacy ERP system and a cloud- based ERP tool using a global PaaS provider. As part of the engagement, the organization is performing data deduplication and sanitization of client data to ensure compliance with regulatory requirements. Which of the following is the MOST likely reason for the need to sanitize the client data? (Choose two.)

A. iometric authentication

B. loud storage encryption

C. pplication containerization

D. ardware anti-tamper

View answer

Correct Answer: BF

Question #42

To meet an SLA, which of the following document should be drafted, defining the company’s internal interdependent unit responsibilities and delivery timelines.

A. PA

B. LA

C. SA

D. OU

View answer

Correct Answer: B

Question #43

A government contractor was the victim of a malicious attack that resulted in the theft of sensitive information. An analyst’s subsequent investigation of sensitive systems led to the following discoveries:-There was no indication of the data owner’s or user’s accounts being compromised. -No database activity outside of previous baselines was discovered.-All workstations and servers were fully patched for all known vulnerabilities at the time of the attack. -It was likely not an insider threat, as all emplo

A. he attacker harvested the hashed credentials of an account within the database administrators group after dumping the memory of a compromised machine

B. n account, which belongs to an administrator of virtualization infrastructure, was compromised with a successful phishing attack

C. shared workstation was physically accessible in a common area of the contractor’s office space and was compromised by an attacker using a USB exploit, which resulted in gaining a local administrator account

D. fter successfully using a watering hole attack to deliver an exploit to a machine, which belongs to an employee of the contractor, an attacker gained access to a corporate laptop

View answer

Correct Answer: B

Question #44

As part of incident response, a technician is taking an image of a compromised system and copying the image to a remote image server (192.168.45.82). The system drive is very large but does not contain the sensitive data. The technician has limited time to complete this task. Which of the following is the BEST command for the technician to run?

A. se the route protection offered by the ISP to accept only BGP routes from trusted hosts on the Internet, which will discard traffic from attacking hosts

B. ork with the ISP and subscribe to an IPS filter that can recognize the attack patterns of the attacking hosts, and block those hosts at the local IPS device

C. dvertise a /32 route to the ISP to initiate a remotely triggered black hole, which will discard traffic destined to the problem server at the upstream provider

D. dd a redundant connection to a second local ISP, so a redundant connection is available for use if the server is being attacked on one connection

View answer

Correct Answer: D

Question #45

A security engineer is designing a system in which offshore, outsourced staff can push code from the development environment to the production environment securely. The security engineer is concerned with data loss, while the business does not want to slow down its development process. Which of the following solutions BEST balances security requirements with business need?

A. et up a VDI environment that prevents copying and pasting to the local workstations of outsourced staff members

B. nstall a client-side VPN on the staff laptops and limit access to the development network

C. reate an IPSec VPN tunnel from the development network to the office of the outsourced staff

D. se online collaboration tools to initiate workstation-sharing sessions with local staff who have access to the development network

View answer

Correct Answer: D

Question #46

A breach was caused by an insider threat in which customer PII was compromised. Following the breach, a lead security analyst is asked to determine which vulnerabilities the attacker used to access company resources.Which of the following should the analyst use to remediate the vulnerabilities?

A. rotocol analyzer

B. oot cause analysis

C. ehavioral analytics

D. ata leak prevention

View answer

Correct Answer: D

Question #47

While attending a meeting with the human resources department, an organization’s information security officer sees an employee using a username and password written on a memo pad to log into a specific service. When the information security officer inquires further as to why passwords are being written down, the response is that there are too many passwords to remember for all the different services the human resources department is required to use.Additionally, each password has specific complexity require

A. tilizing MFA

B. mplementing SSO

C. eploying 802

D. ushing SAML adoption

E. mplementing TACACS

View answer

Correct Answer: B

Question #48

A SaaS-based email service provider often receives reports from legitimate customers that their IP netblocks are on blacklists and they cannot send email. The SaaS has confirmed that affected customers typically have IP addresses within broader network ranges and some abusive customers within the same IP ranges may have performed spam campaigns. Which of the following actions should the SaaS provider perform to minimize legitimate customer impact?

A. nform the customer that the service provider does not have any control over third-party blacklist entries

B. erform a takedown of any customer accounts that have entries on email blacklists because this is a strong indicator of hostile behavior

C. ork with the legal department and threaten legal action against the blacklist operator if the netblocks are not removed because this is affecting legitimate traffic

D. stablish relationship with a blacklist operators so broad entries can be replaced with more granular entries and incorrect entries can be quickly pruned

View answer

Correct Answer: D

Question #49

A company’s chief cybersecurity architect wants to configure mutual authentication to access an internal payroll website. The architect has asked the administration team to determine the configuration that would provide the best defense against MITM attacks. Which of the following implementation approaches would BEST support the architect’s goals?

A. tilize a challenge-response prompt as required input at username/password entry

B. mplement TLS and require the client to use its own certificate during handshake

C. onfigure a web application proxy and institute monitoring of HTTPS transactions

D. nstall a reverse proxy in the corporate DMZ configured to decrypt TLS sessions

View answer

Correct Answer: B

Question #50

A hospital?€?s security team recently determined its network was breached and patient data was accessed by an external entity. The Chief Information SecurityOfficer (CISO) of the hospital approaches the executive management team with this information, reports the vulnerability that led to the breach has already been remediated, and explains the team is continuing to follow the appropriate incident response plan. The executive team is concerned about the hospital?€?s brand reputation and asks the CISO when t

A. When it is mandated by their legal and regulatory requirements

B. As soon as possible in the interest of the patients

C. As soon as the public relations department is ready to be interviewed

D. When all steps related to the incident response plan are completed

E. Upon the approval of the Chief Executive Officer (CEO) to release information to the public

View answer

Correct Answer: A

Question #51

A security administrator wants to allow external organizations to cryptographically validate the company’s domain name in email messages sent by employees. Which of the following should the security administrator implement?

A. PF

B. /MIME

C. LS

D. KIM

View answer

Correct Answer: D

Question #52

A security architect is reviewing the code for a company’s financial website. The architect suggests adding the following HTML element, along with a server-side function, to generate a random number on the page used to initiate a funds transfer:Which of the following attacks is the security architect attempting to prevent?

A. QL injection

B. SRF

C. SS

D. lickjacking

View answer

Correct Answer: B

Question #53

A software development team has spent the last 18 months developing a new web-based front-end that will allow clients to check the status of their orders as they proceed through manufacturing. The marketing team schedules a launch party to present the new application to the client base in two weeks. Before the launch, the security team discovers numerous flaws that may introduce dangerous vulnerabilities, allowing direct access to a database used by manufacturing. The development team did not plan to remedi

A. mplementing regression testing

B. ompleting user acceptance testing

C. erifying system design documentation

D. sing a SRTM

View answer

Correct Answer: D

Question #54

Providers at a healthcare system with many geographically dispersed clinics have been fined five times this year after an auditor received notice of the following SMS messages:Which of the following represents the BEST solution for preventing future fines?

A. mplement a secure text-messaging application for mobile devices and workstations

B. rite a policy requiring this information to be given over the phone only

C. rovide a courier service to deliver sealed documents containing public health informatics

D. mplement FTP services between clinics to transmit text documents with the information

E. mplement a system that will tokenize patient numbers

View answer

Correct Answer: A

Question #55

A security engineer has been hired to design a device that will enable the exfiltration of data from within a well- defended network perimeter during an authorized test. The device must bypass all firewalls and NIDS in place, as well as allow for the upload of commands from a centralized command and control server. The total cost of the device must be kept to a minimum in case the device is discovered during an assessment.Which of the following tools should the engineer load onto the device being designed?

A. ustom firmware with rotating key generation

B. utomatic MITM proxy

C. CP beacon broadcast software

D. everse shell endpoint listener

View answer

Correct Answer: B

Question #56

A network engineer is attempting to design-in resiliency characteristics for an enterprise network’s VPN services.If the engineer wants to help ensure some resilience against zero-day vulnerabilities exploited against the VPN implementation, which of the following decisions would BEST support this objective?

A. mplement a reverse proxy for VPN traffic that is defended and monitored by the organization’s SOC with near-real-time alerting to administrators

B. ubscribe to a managed service provider capable of supporting the mitigation of advanced DDoS attacks on the enterprise’s pool of VPN concentrators

C. istribute the VPN concentrators across multiple systems at different physical sites to ensure some backup services are available in the event of primary site loss

D. mploy a second VPN layer concurrently where the other layer’s cryptographic implementation is sourced from a different vendor

View answer

Correct Answer: D

Question #57

A security analyst is inspecting pseudocode of the following multithreaded application: Which of the following security concerns is evident in the above pseudocode?

A. ime of check/time of use

B. esource exhaustion

C. mproper storage of sensitive data

D. rivilege escalation

View answer

Correct Answer: A

Question #58

A company is developing requirements for a customized OS build that will be used in an embedded environment. The company procured hardware that is capable of reducing the likelihood of successful buffer overruns while executables are processing. Which of the following capabilities must be included for the OS to take advantage of this critical hardware-based countermeasure?

A. Application whitelisting

B. NX/XN bit

C. ASLR

D. TrustZone

E. SCP

View answer

Correct Answer: B

Question #59

A security engineer is embedded with a development team to ensure security is built into products being developed. The security engineer wants to ensure developers are not blocked by a large number of security requirements applied at specific schedule points.Which of the following solutions BEST meets the engineer’s goal?

A. series of ad-hoc tests that each verify security control functionality of the entire system at once

B. series of discrete tasks that, when viewed in total, can be used to verify and document each individual constraint from the SRTM

C. set of formal methods that apply to one or more of the programing languages used on the development project

D. methodology to verify each security control in each unit of developed code prior to committing the code

View answer

Correct Answer: C

Question #60

An organization is deploying IoT locks, sensors, and cameras, which operate over 802.11, to replace legacy building access control systems. These devices are capable of triggering physical access changes, including locking and unlocking doors and gates. Unfortunately, the devices have known vulnerabilities for which the vendor has yet to provide firmware updates.Which of the following would BEST mitigate this risk?

A. irect wire the IoT devices into physical switches and place them on an exclusive VLAN

B. equire sensors to sign all transmitted unlock control messages digitally

C. ssociate the devices with an isolated wireless network configured for WPA2 and EAP-TLS

D. mplement an out-of-band monitoring solution to detect message injections and attempts

View answer

Correct Answer: C

Question #61

A systems administrator at a medical imaging company discovers protected health information (PHI) on a general-purpose file server. Which of the following steps should the administrator take NEXT?

A. solate all of the PHI on its own VLAN and keep it segregated at Layer 2

B. mmediately encrypt all PHI with AES-256

C. elete all PHI from the network until the legal department is consulted

D. onsult the legal department to determine legal requirements

View answer

Correct Answer: B

Question #62

A security engineer is assessing a new IoT product. The product interfaces with the ODBII port of a vehicle and uses a Bluetooth connection to relay data to an onboard data logger located in the vehicle. The data logger can only transfer data over a custom USB cable. The engineer suspects a relay attack is possible against the cryptographic implementation used to secure messages between segments of the system. Which of the following tools should the engineer use to confirm the analysis?

A. inary decompiler

B. ireless protocol analyzer

C. og analysis and reduction tools

D. etwork-based fuzzer

View answer

Correct Answer: B

Question #63

A Chief Information Security Officer (CISO) is reviewing the controls in place to support the organization’s vulnerability management program. The CISO finds patching and vulnerability scanning policies and procedures are in place. However, the CISO is concerned the organization is siloed and is not maintaining awareness of new risks to the organization. The CISO determines systems administrators need to participate in industry security events. Which of the following is the CISO looking to improve?

A. endor diversification

B. ystem hardening standards

C. ounty programs

D. hreat awareness

E. ulnerability signatures

View answer

Correct Answer: D

Question #64

A security administrator is advocating for enforcement of a new policy that would require employers with privileged access accounts to undergo periodic inspections and review of certain job performance data. To which of the following policies is the security administrator MOST likely referring?

A. ackground investigation

B. andatory vacation

C. east privilege

D. eparation of duties

View answer

Correct Answer: B

Question #65

A government organization operates and maintains several ICS environments. The categorization of one of the ICS environments led to a moderate baseline. The organization has complied a set of applicable security controls based on this categorization.Given that this is a unique environment, which of the following should the organization do NEXT to determine if other security controls should be considered?

A. heck for any relevant or required overlays

B. eview enhancements within the current control set

C. odify to a high-baseline set of controls

D. erform continuous monitoring

View answer

Correct Answer: C

Question #66

During a security event investigation, a junior analyst fails to create an image of a server’s hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from the analysis is not usable in the prosecution of the attackers due to the uncertainty of tampering. Which of the following should the junior analyst have followed?

A. ontinuity of operations

B. hain of custody

C. rder of volatility

D. ata recovery

View answer

Correct Answer: C

Question #67

A vulnerability was recently announced that allows a malicious user to gain root privileges on other virtual machines running within the same hardware cluster. Customers of which of the following cloud-based solutions should be MOST concerned about this vulnerability?

A. ingle-tenant private cloud

B. ultitenant SaaS cloud

C. ingle-tenant hybrid cloud

D. ultitenant IaaS cloud

E. ultitenant PaaS cloud

View answer

Correct Answer: D

Question #68

A company recently implemented a new cloud storage solution and installed the required synchronization client on all company devices. A few months later, a breach of sensitive data was discovered. Root cause analysis shows the data breach happened from a lost personal mobile device.Which of the following controls can the organization implement to reduce the risk of similar breaches?

A. obile tokenization

B. xport controls

C. evice containerization

D. rivacy policies

View answer

Correct Answer: A

Question #69

A security administrator is hardening a TrustedSolaris server that processes sensitive data. The data owner has established the following security requirements:-The data is for internal consumption only and shall not be distributed to outside individuals -The systems administrator should not have access to the data processed by the server -The integrity of the kernel image is maintainedWhich of the following host-based security controls BEST enforce the data owner’s requirements? (Choose three.)

A. SA

B. IA

C. LA

D. A

View answer

Correct Answer: CEF

Question #70

A corporate forensic investigator has been asked to acquire five forensic images of an employee database application. There are three images to capture in the United States, one in the United Kingdom, and one in Germany. Upon completing the work, the forensics investigator saves the images to a local workstation. Which of the following types of concerns should the forensic investigator have about this work assignment?

A. nvironmental

B. rivacy

C. thical

D. riminal

View answer

Correct Answer: B

Question #71

A security consultant is considering authentication options for a financial institution. The following authentication options are available. Drag and drop the security mechanism to the appropriate use case. Options may be used once.Select and Place:

A. lease refer to Explanation below for the answer

View answer

Correct Answer: A

Question #72

An incident responder wants to capture volatile memory comprehensively from a running machine for forensic purposes. The machine is running a very recent release of the Linux OS.Which of the following technical approaches would be the MOST feasible way to accomplish this capture?

A. un the memdump utility with the -k flag

B. se a loadable kernel module capture utility, such as LiME

C. un dd on/dev/mem

D. mploy a stand-alone utility, such as FTK Imager

View answer

Correct Answer: D

Question #73

An organization just merged with an organization in another legal jurisdiction and must improve its network security posture in ways that do not require additional resources to implement data isolation. One recommendation is to block communication between endpoint PCs. Which of the following would be the BEST solution?

A. nstalling HIDS

B. onfiguring a host-based firewall

C. onfiguring EDR

D. mplementing network segmentation

View answer

Correct Answer: D

Question #74

Legal counsel has notified the information security manager of a legal matter that will require the preservation of electronic records for 2000 sales force employees. Source records will be email, PC, network shares, and applications.After all restrictions have been lifted, which of the following should the information manager review?

A. ata retention policy

B. egal hold

C. hain of custody

D. cope statement

View answer

Correct Answer: A

Question #75

Company.org has requested a black-box security assessment be performed on key cyber terrain. One area of concern is the company’s SMTP services. The security assessor wants to run reconnaissance before taking any additional action and wishes to determine which SMTP server is Internet-facing.Which of the following commands should the assessor use to determine this information?

A. nsrecon –d company

B. ig company

C. c –v company

D. hois company

View answer

Correct Answer: A

Question #76

First responders, who are part of a core incident response team, have been working to contain an outbreak of ransomware that also led to data loss. In a rush to isolate the three hosts that were calling out to the NAS to encrypt whole directories, the hosts were shut down immediately without investigation and then isolated. Which of the following were missed? (Choose two.)

A. disaster recovery plan

B. n incident response plan

C. business continuity plan

D. risk avoidance plan

View answer

Correct Answer: DE

Question #77

A server (10.0.0.2) on the corporate network is experiencing a DoS from a number of marketing desktops that have been compromised and are connected to a separate network segment. The security engineer implements the following configuration on the management router:Which of the following is the engineer implementing?

A. emotely triggered black hole

B. oute protection

C. ort security

D. ransport security

E. ddress space layout randomization

View answer

Correct Answer: B

Question #78

A security analyst is troubleshooting a scenario in which an operator should only be allowed to reboot remote hosts but not perform other activities. The analyst inspects the following portions of different configuration files:Configuration file 1:Operator ALL=/sbin/rebootConfiguration file 2:Command=”/sbin/shutdown now”, no-x11-forwarding, no-pty, ssh-dssConfiguration file 3: Operator:x:1000:1000::/home/operator:/bin/bashWhich of the following explains why an intended operator cannot perform the intended a

A. he sudoers file is locked down to an incorrect command

B. SH command shell restrictions are misconfigured

C. he passwd file is misconfigured

D. he SSH command is not allowing a pty session

View answer

Correct Answer: D

Question #79

An online bank has contracted with a consultant to perform a security assessment of the bank’s web portal. The consultant notices the login page is linked from the main page with HTTPS, but when the URL is changed to HTTP, the browser is automatically redirected back to the HTTPS site. Which of the following is a concern for the consultant, and how can it be mitigated?

A. SS could be used to inject code into the login page during the redirect to the HTTPS site

B. he consultant is concerned the site is using an older version of the SSL 3

C. he HTTP traffic is vulnerable to network sniffing, which could disclose usernames and passwords to an attacker

D. successful MITM attack Could intercept the redirect and use sslstrip to decrypt further HTTPS traffic

View answer

Correct Answer: D

Question #80

A team is at the beginning stages of designing a new enterprise-wide application. The new application will have a large database and require a capital investment in hardware. The Chief Information Officer (СIO) has directed the team to save money and reduce the reliance on the datacenter, and the vendor must specialize in hosting large databases in the cloud. Which of the following cloud-hosting options would BEST meet these needs?

A. ulti-tenancy SaaS

B. ybrid IaaS

C. ingle-tenancy PaaS

D. ommunity IaaS

View answer

Correct Answer: C

Question #81

A security incident responder discovers an attacker has gained access to a network and has overwritten key system files with backdoor software. The server was reimaged and patched offline. Which of the following tools should be implemented to detect similar attacks?

A. ulnerability scanner

B. PM

C. ost-based firewall

D. ile integrity monitor

E. IPS

View answer

Correct Answer: D

Question #82

After the departure of a developer under unpleasant circumstances, the company is concerned about the security of the software to which the developer has access. Which of the following is the BEST way to ensure security of the code following the incident?

A. ata custodian

B. ata owner

C. ecurity analyst

D. usiness unit director

E. hief Executive Officer (CEO)

View answer

Correct Answer: A

Question #83

A Chief Information Security Officer (CISO) implemented MFA for all accounts in parallel with the BYOD policy. After the implementation, employees report the increased authentication method is causing increased time to tasks. This applies both to accessing the email client on the workstation and the online collaboration portal.Which of the following should be the CISO implement to address the employees’ concerns?

A. reate an exception for the company’s IPs

B. mplement always-on VPN

C. onfigure the use of employee PKI authentication for email

D. llow the use of SSO

View answer

Correct Answer: D

Question #84

Management is reviewing the results of a recent risk assessment of the organization’s policies and procedures. During the risk assessment it is determined that procedures associated with background checks have not been effectively implemented. In response to this risk, the organization elects to revise policies and procedures related to background checks and use a third-party to perform background checks on all new employees.Which of the following risk management strategies has the organization employed?

A. ransfer

B. itigate

C. ccept

D. void

E. eject

View answer

Correct Answer: B

Question #85

A database administrator is required to adhere to and implement privacy principles when executing daily tasks. A manager directs the administrator to reduce the number of unique instances of PII stored within an organization’s systems to the greatest extent possible.Which of the following principles is being demonstrated?

A. dministrator accountability

B. II security

C. ecord transparency

D. ata minimization

View answer

Correct Answer: D

Question #86

Ann, a member of the finance department at a large corporation, has submitted a suspicious email she received to the information security team. The team was not expecting an email from Ann, and it contains a PDF file inside a ZIP compressed archive. The information security team is not sure which files were opened. A security team member uses an air-gapped PC to open the ZIP and PDF, and it appears to be a social engineering attempt to deliver an exploit.Which of the following would provide greater insight

A. un an antivirus scan on the finance PC

B. se a protocol analyzer on the air-gapped PC

C. erform reverse engineering on the document

D. nalyze network logs for unusual traffic

E. un a baseline analyzer against the user’s computer

View answer

Correct Answer: C

Question #87

A security engineer is deploying an IdP to broker authentication between applications. These applications all utilize SAML 2.0 for authentication. Users log into the IdP with their credentials and are given a list of applications they may access. One of the application’s authentications is not functional when a user initiates an authentication attempt from the IdP. The engineer modifies the configuration so users browse to the application first, which corrects the issue. Which of the following BEST describe

A. he application only supports SP-initiated authentication

B. he IdP only supports SAML 1

C. here is an SSL certificate mismatch between the IdP and the SaaS application

D. he user is not provisioned correctly on the IdP

View answer

Correct Answer: A

Question #88

As part of the development process for a new system, the organization plans to perform requirements analysis and risk assessment. The new system will replace a legacy system, which the organization has used to perform data analytics.Which of the following is MOST likely to be part of the activities conducted by management during this phase of the project?

A. tatic code analysis and peer review of all application code

B. alidation of expectations relating to system performance and security

C. oad testing the system to ensure response times is acceptable to stakeholders

D. esign reviews and user acceptance testing to ensure the system has been deployed properly

E. egression testing to evaluate interoperability with the legacy system during the deployment

View answer

Correct Answer: B

Question #89

A security engineer is attempting to increase the randomness of numbers used in key generation in a system. The goal of the effort is to strengthen the keys against predictive analysis attacks.Which of the following is the BEST solution?

A. se an entropy-as-a-service vendor to leverage larger entropy pools

B. oop multiple pseudo-random number generators in a series to produce larger numbers

C. ncrease key length by two orders of magnitude to detect brute forcing

D. hift key generation algorithms to ECC algorithms

View answer

Correct Answer: A

Question #90

A security architect is designing a system to satisfy user demand for reduced transaction time, increased security and message integrity, and improved cryptographic security. The resultant system will be used in an environment with a broad user base where many asynchronous transactions occur every minute and must be publicly verifiable.Which of the following solutions BEST meets all of the architect’s objectives?

A. nsure all IoT devices are configured in a geofencing mode so the devices do not work when removed from the home network

B. nstall a firewall capable of cryptographically separating network traffic, require strong authentication to access all IoT devices, and restrict network access for the home assistant based on time-of-day restrictions

C. egment the home network to separate network traffic from users and the IoT devices, ensure security settings on the home assistant support no or limited recording capability, and install firewall rules on the router to restrict traffic to the home assistant as much as possible

D. hange all default passwords on the IoT devices, disable Internet access for the IoT devices and the home assistant, obtain routable IP addresses for all devices, and implement IPv6 and IPSec protections on all network traffic

View answer

Correct Answer: D

Question #91

An organization is currently working with a client to migrate data between a legacy ERP system and a cloud- based ERP tool using a global PaaS provider. As part of the engagement, the organization is performing data deduplication and sanitization of client data to ensure compliance with regulatory requirements. Which of the following is the MOST likely reason for the need to sanitize the client data?

A. ata aggregation

B. ata sovereignty

C. ata isolation

D. ata volume

E. ata analytics

View answer

Correct Answer: B

Question #92

Which of the following is an external pressure that causes companies to hire security assessors and penetration testers?

A. ack of adequate in-house testing skills

B. equirements for geographically based assessments

C. ost reduction measures

D. egulatory insistence on independent reviews

View answer

Correct Answer: D

Question #93

The Chief Financial Officer (CFO) of a major hospital system has received a ransom letter that demands a large sum of cryptocurrency be transferred to an anonymous account. If the transfer does not take place within ten hours, the letter states that patient information will be released on the dark web. A partial listing of recent patients is included in the letter. This is the first indication that a breach took place. Which of the following steps should be done FIRST?

A. eview audit logs to determine the extent of the breach

B. ay the hacker under the condition that all information is destroyed

C. ngage a counter-hacking team to retrieve the data

D. otify the appropriate legal authorities and legal counsel

View answer

Correct Answer: D

Question #94

An organization’s Chief Financial Officer (CFO) was the target of several different social engineering attacks recently. The CFO has subsequently worked closely with the Chief Information Security Officer (CISO) to increase awareness of what attacks may look like. An unexpected email arrives in the CFO’s inbox from a familiar name with an attachment. Which of the following should the CISO task a security analyst with to determine whether or not the attachment is safe?

A. lace it in a malware sandbox

B. erform a code review of the attachment

C. onduct a memory dump of the CFO’s P

D. un a vulnerability scan on the email server

View answer

Correct Answer: A

Question #95

An organization’s network engineering team recently deployed a new software encryption solution to ensure the confidentiality of data at rest, which was found to add 300ms of latency to data read-write requests in storage, impacting business operations. Which of the following alternative approaches would BEST address performance requirements while meeting the intended security objective?

A. mploy hardware FDE or SED solutions

B. tilize a more efficient cryptographic hash function

C. eplace HDDs with SSD arrays

D. se a FIFO pipe a multithreaded software solution

View answer

Correct Answer: A

Question #96

A technician is validating compliance with organizational policies. The user and machine accounts in the AD are not set to expire, which is non-compliant. Which of the following network tools would provide this type of information?

A. ecurity awareness training

B. ast login verification

C. og correlation

D. ime-of-check controls

E. ime-of-use controls

View answer

Correct Answer: C

Question #97

During a security assessment, activities were divided into two phases: internal and external exploitation. The security assessment team set a hard time limit on external activities before moving to a compromised box within the enterprise perimeter.Which of the following methods is the assessment team most likely to employ NEXT?

A. ivoting from the compromised, moving laterally through the enterprise, and trying to exfiltrate data and compromise devices

B. onducting a social engineering attack attempt with the goal of accessing the compromised box physically

C. xfiltrating network scans from the compromised box as a precursor to social media reconnaissance

D. pen-source intelligence gathering to identify the network perimeter and scope to enable further system compromises

View answer

Correct Answer: A

Question #98

A security administrator was informed that a server unexpectedly rebooted. The administrator received an export of syslog entries for analysis: Which of the following does the log sample indicate? (Choose two.)

A. hreat modeling

B. isk assessment

C. ulnerability data

D. hreat intelligence

E. isk metrics

View answer

Correct Answer: CE

Question #99

Ann, a security administrator, is conducting an assessment on a new firewall, which was placed at the perimeter of a network containing PII. Ann runs the following commands on a server (10.0.1.19) behind the firewall: From her own workstation (192.168.2.45) outside the firewall, Ann then runs a port scan against the server and records the following packet capture of the port scan:Connectivity to the server from outside the firewall worked as expected prior to executing these commands. Which of the following

A. t is correctly dropping all packets destined for the server

B. t is not blocking or filtering any traffic to the server

C. ptables needs to be restarted

D. he IDS functionality of the firewall is currently disabled

View answer

Correct Answer: A

Question #100

A large company with a very complex IT environment is considering a move from an on-premises, internally managed proxy to a cloud-based proxy solution managed by an external vendor. The current proxy provides caching, content filtering, malware analysis, and URL categorization for all staff connected behind the proxy. Staff members connect directly to the Internet outside of the corporate network. The cloud-based version of the solution would provide content filtering, TLS decryption, malware analysis, and

A.

B.

C.

D.

View answer

Correct Answer: B

Question #101

An SQL database is no longer accessible online due to a recent security breach. An investigation reveals that unauthorized access to the database was possible due to an SQL injection vulnerability. To prevent this type of breach in the future, which of the following security controls should be put in place before bringing the database back online? (Choose two.)

A. andomly calling customer employees and posing as a help desk technician requiring user password to resolve issues

B. osing as a copier service technician and indicating the equipment had ?€phoned home?€ to alert the technician for a service call

C. imulating an illness while at a client location for a sales call and then recovering once listening devices are installed

D. btaining fake government credentials and impersonating law enforcement to gain access to a company facility

View answer

Correct Answer: CF

Question #102

After multiple service interruptions caused by an older datacenter design, a company decided to migrate away from its datacenter. The company has successfully completed the migration of all datacenter servers and services to a cloud provider. The migration project includes the following phases:? Selection of a cloud provider? Architectural design? Microservice segmentation? Virtual private cloud? Geographic service redundancy? Service migrationThe Chief Information Security Officer (CISO) is still concerned

A. Multicloud solution

B. Single-tenancy private cloud

C. Hybrid cloud solution

D. Cloud access security broker

View answer

Correct Answer: D

Question #103

A security controls assessor intends to perform a holistic configuration compliance test of networked assets. The assessor has been handed a package of definitions provided in XML format, and many of the files have two common tags within them: ?€

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now

Achieve Remarkable Results in the CompTIA CASP+ Exam with Reliable CAS-003 Study Materials

View The Updated CAS-003 Exam Questions

View The Updated Other Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE! Get Now

Achieve Remarkable Results in the CompTIA CASP+ Exam with Reliable CAS-003 Study Materials

View The Updated CAS-003 Exam Questions

View The Updated Other Exam Questions

View Answers after Submission

100% Pass Cisco, PMP, CISA, CISM, AWS Practice test on SALE!
Get Now