Exam Dumps CAS-005 Practice Free Latest CompTIA Practice Tests
CAS-005 Exam Questions | Real CAS-005 Practice Dumps
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 189
An incident response analyst finds the following content inside of a log file that was collected from a compromised server:
.2308464678 ... whoami ..... su2032829%72%322/// ...... /etc/passwd .... 2087031731467478432 ...
$6490/90/./ ..< XML ?.. .... nty.
Which of the following is the best action to prevent future compromise?
- A. Blocking the processing of external files by forwarding them to another server for processing
- B. Filtering inserted characters for all user inputs and allowing only ASCII characters
- C. Implementing an allow list for all text boxes throughout the web application
- D. Improving file-parsing capabilities to stop external entities from executing commands
Answer: D
NEW QUESTION # 190
During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server Given the following portion of the code:
Which of the following best describes this incident?
- A. Stored XSS
- B. Command injection
- C. SQL injection
- D. XSRF attack
Answer: A
Explanation:
The provided code snippet shows a script that captures the user's cookies and sends them to a remote server.
This type of attack is characteristic of Cross-Site Scripting (XSS), specifically stored XSS, where the malicious script is stored on the target server (e.g., in a database) and executed in the context of users who visit the infected web page.
A: XSRF (Cross-Site Request Forgery) attack: This involves tricking the user into performing actions on a different site without their knowledge but does not involve stealing cookies via script injection.
B: Command injection: This involves executing arbitrary commands on the host operating system, which is not relevant to the given JavaScript code.
C: Stored XSS: The provided code snippet matches the pattern of a stored XSS attack, where the script is injected into a web page, and when users visit the page, the script executes and sends the user's cookies to the attacker's server.
D: SQL injection: This involves injecting malicious SQL queries into the database and is unrelated to the given JavaScript code.
NEW QUESTION # 191
A security engineer must resolve a vulnerability in a deprecated version of Python for a custom-developed flight simul-ation application that is monitored and controlled remotely. The source code is proprietary and built with Python functions running on the Ubuntu operating system. Version control is not enabled for the application in development or production. However, the application must remain online in the production environment using built-in features. Which of the following solutions best reduces theattack surface of these issues and meets the outlined requirements?
- A. Enable branch protection in the GitHub repository. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- B. Configure version designation within the Python interpreter. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- C. Configure code-signing within the CI/CD pipeline, update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- D. Use an NFS network share. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
Answer: C
Explanation:
Code-signing within theCI/CD pipelineensures that only verified and signed code is deployed, mitigating the risk of supply chain attacks. Updating Python withaptitudeand updating modules withpipensures vulnerabilities are patched. Deploying the solution to production after testing maintains application availability while securing the development lifecycle.
* Branch protection (B)applies only to version-controlled environments, which is not the case here.
* NFS network share (C)does not address the deprecated Python vulnerability.
* Version designation (D)does not eliminate security risks from outdated dependencies.
Reference:CompTIA SecurityX (CAS-005) Exam Objectives- Domain 3.0 (Security Engineering), Section onSoftware Assurance and Secure Development
NEW QUESTION # 192
A security analyst is reviewing the following event timeline from an COR solution:
Which of the following most likely has occurred and needs to be fixed?
- A. A logic law has introduced a TOCTOU vulnerability and must be addressed by the COR vendor
- B. An EDR bypass was utilized by a threat actor and updates must be installed by the administrator.
- C. A potential insider threat is being investigated and will be addressed by the senior management team.
- D. The DlP has failed to block malicious exfiltration and data tagging is not being utilized property
Answer: A
Explanation:
The event timeline indicates a sequence where a file (hr-reporting.docx) was saved, scanned, executed, and eventually found to contain malware. The critical issue here is that the malware scan completed after the file was already executed. This suggests a Time-Of-Check to Time-Of- Use (TOCTOU) vulnerability, where the state of the file changed between the time it was checked and the time it was used.
NEW QUESTION # 193
A company's security policy states that any publicly available server must be patched within 12 hours after a patch is released A recent llS zero-day vulnerability was discovered that affects all versions of the Windows Server OS:
Which of the following hosts should a security analyst patch first once a patch is available?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
- F. 5
Answer: D
Explanation:
Based on the security policy that any publicly available server must be patched within 12 hours after a patch is released, the securityanalyst should patch Host 1 first. Here's why:
Public Availability: Host 1 is externally available, making it accessible from the internet. Publicly available servers are at higher risk of being targeted by attackers, especially when a zero-day vulnerability is known.
Exposure to Threats: Host 1 has IIS installed and is publicly accessible, increasing its exposure to potential exploitation. Patching this host first reduces the risk of a successful attack.
Prioritization of Critical Assets: According to best practices, assets that are exposed to higher risks should be prioritized for patching to mitigate potential threats promptly.
Reference:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
NIST Special Publication 800-40: Guide toEnterprise Patch Management Technologies CIS Controls: Control 3 - Continuous Vulnerability Management
NEW QUESTION # 194
Which of the following best describes the reason a network architect would enable forward secrecy on all VPN tunnels?
- A. The business requirements state that confidentiality is a critical success factor.
- B. This process is a requirement to enable hardware-accelerated cryptography.
- C. This process reduces the success of attackers performing cryptanalysis.
- D. Modern cryptographic protocols list this process as a prerequisite for use.
Answer: C
Explanation:
Forward secrecy, also known as perfect forward secrecy, is a feature of certain key agreement protocols that ensures session keys will not be compromised even if the server's private key is compromised in the future.
By enabling forward secrecy on VPN tunnels, each session uses a unique key, and these keys are not derived from a common master key. This means that even if an attacker obtains the server's private key, they cannot decrypt past sessions, thereby significantly reducing the effectiveness of cryptanalysis attacks.
NEW QUESTION # 195
A company migrating to aremote work model requires that company-owned devices connect to a VPN before logging in to the device itself. The VPN gateway requires that a specific key extension is deployed to the machine certificates in the internal PKI. Which of the following best explains this requirement?
- A. The server connection uses SSL VPN, which uses certificates for secure communication.
- B. The certificate is an additional factor to meet regulatory MFA requirements for VPN access.
- C. The internal PKI certificate deployment allows for Wi-Fi connectivity before logging in to other systems.
- D. The VPN client selected the certificate with the correct key usage without user interaction.
Answer: D
NEW QUESTION # 196
Source code snippets for two separate malware samples are shown below:
Sample 1:
knockEmDown(String e) {
if(target.isAccessed()) {
target.toShell(e);
System.out.printIn(e.toString());
c2.sendTelemetry(target.hostname.toString + " is " + e.toString());
} else {
target.close();
}
}
Sample 2:
targetSys(address a) {
if(address.islpv4()) {
address.connect(1337);
address.keepAlive("paranoid");
String status = knockEmDown(address.current);
remote.sendC2(address.current + " is " + status);
} else {
throw Exception e;
}
}
Which of the following describes the most important observation about the two samples?
- A. The samples were probably written by the same developer.
- B. Both samples use IP connectivity for command and control.
- C. Sample 1 is the target agent while Sample 2 is the C2 server.
- D. Telemetry is first buffered and then transmitted in paranoid mode.
Answer: A
Explanation:
Comprehensive and Detailed Step-by-Step
Both samples share similar function names, variable naming styles, and logic flow, indicating that they were likely written by the same developer. This is a key observation in malware attribution, as cyber threat analysts often look for unique coding styles to link malware to specific threat actors.
The presence of C2 (Command and Control) communication in both samples supports this theory, as attackers often reuse parts of their own malware code across different attacks.
NEW QUESTION # 197
During a recent audit, a company's systems were assessed- Given the following information:
Which of the following is the best way to reduce the attack surface?
- A. Setting up an IDS inline to monitor and detect any threats to the software
- B. Segmenting the manufacturing network with a firewall and placing the rules in monitor mode
- C. Deploying an EDR solution to all impacted machines in manufacturing
- D. Implementing an application-aware firewall and writing strict rules for the application access
Answer: D
Explanation:
SecurityX CAS-005 network architecture objectives emphasize limiting exposure of vulnerable systems by using application-aware firewalls with strict rule sets.
This approach directly reduces the attack surface by allowing only approved application traffic to and from the vulnerable systems, mitigating risk until systems are patched or replaced.
EDR (A) enhances detection but doesn't inherently reduce the exposed services.
Network segmentation in monitor mode (B) doesn't block threats.
IDS (C) detects activity but does not block it.
NEW QUESTION # 198
A security analyst is reviewing the following event timeline from an COR solution:
Which of the following most likely has occurred and needs to be fixed?
- A. A logic law has introduced a TOCTOU vulnerability and must be addressed by the COR vendor
- B. An EDR bypass was utilized by a threat actor and updates must be installed by the administrator.
- C. A potential insider threat is being investigated and will be addressed by the senior management team.
- D. The Dl P has failed to block malicious exfiltration and data tagging is not being utilized property
Answer: A
Explanation:
The event timeline indicates a sequence where a file (hr-reporting.docx) was saved, scanned, executed, and eventually found to contain malware. The critical issue here is that the malware scan completed after the file was already executed. This suggests a Time-Of-Check to Time-Of-Use (TOCTOU) vulnerability, where the state of the file changed between the time it was checked and the time it was used.
Reference:
CompTIA SecurityX Study Guide: Discusses TOCTOU vulnerabilities as a timing attack where the state of a resource changes after it has been validated.
NIST Special Publication 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations": Recommends addressing TOCTOU vulnerabilities to ensure the integrity of security operations.
"The Art of Software Security Assessment" by Mark Dowd, John McDonald, and Justin Schuh: Covers logic flaws and timing vulnerabilities, including TOCTOU issues.
NEW QUESTION # 199
An organization has been using self-managed encryption keys rather than the free keys managed by the cloud provider. The Chief Information Security Officer (CISO) reviews the monthly bill and realizes the self-managed keys are more costly than anticipated. Which of the following should the CISO recommend to reduce costs while maintaining a strong security posture?
- A. Begin using cloud-managed keys on all new resources deployed in the cloud.
- B. Extend the key rotation period to one year so that the cloud provider can use cached keys.
- C. Adjust the configuration for cloud provider keys on data that is classified as public.
- D. Utilize an on-premises HSM to locally manage keys.
Answer: C
Explanation:
Comprehensive and Detailed Step by Step
Understanding the Scenario: Theorganization is using customer-managed encryption keys in the cloud, which is more expensive than using the cloud provider's free managed keys. The CISO needs to find a way to reduce costs without significantly weakening the security posture.
Analyzing the Answer Choices:
A :Utilize an on-premises HSM to locally manage keys: While on-premises HSMs offer strong security, they introduce additional costs and complexity (procurement, maintenance, etc.). This option is unlikely to reduce costs compared to cloud-based key management.
B :Adjust the configuration for cloud provider keys on data that is classified as public: This is the most practical and cost-effective approach. Data classified as public doesn't require the same level of protection as sensitive data. Using the cloud provider's free managed keys for public data can significantly reduce costs without compromising security, as the data is intended to be publicly accessible anyway.
Reference:
C : Begin using cloud-managed keys on all new resources deployed in the cloud: While this would reduce costs, it's a broad approach that doesn't consider the sensitivity of the data. Applying cloud-managed keys to sensitive data might not be acceptable from a security standpoint.
D : Extend the key rotation period to one year so that the cloud provider can use cached keys: Extending the key rotation period weakens security. Frequent key rotation is a security best practice to limit the impact of a potential key compromise.
Risk-Based Approach: Using cloud-provider-managed keys for public data is a reasonable risk-based decision. Public data, by definition, is not confidential.
Cost Optimization: This directly addresses the CISO's concern about cost, as cloud-provider-managed keys are often free or significantly cheaper.
Security Balance: It maintains a strong security posture for sensitive data by continuing to use customer-managed keys where appropriate, while optimizing costs for less sensitive data.
CASP+ Relevance: This approach demonstrates an understanding of risk management, data classification, and cost-benefit analysis in security decision-making, all of which are important topics in CASP+.
Elaboration on Data Classification:
Data Classification Policy: Organizations should have a clear data classification policy that defines different levels of data sensitivity (e.g., public, internal, confidential, restricted).
Security Controls Based on Classification: Security controls, including encryption key management, should be applied based on the data's classification level.
Cost-Benefit Analysis: Data classification helps organizations make informed decisions about where to invest in stronger security controls and where cost optimization is acceptable.
In conclusion, adjusting the configuration to use cloud-provider-managed keys for data classified as public is the most effective way to reduce costs while maintaining a strong security posture. It's a practical, risk-based approach that aligns with data classification principles and cost-benefit considerations, all of which are important concepts covered in the CASP+ exam objectives.
NEW QUESTION # 200
A security analyst isreviewing the following event timeline from an COR solution:
Which of the following most likely has occurred and needs to be fixed?
- A. An EDRbypass was utilized by a threat actor and updates must be installed by the administrator.
- B. A logic law has introduced a TOCTOU vulnerability and must be addressed by the COR vendor
- C. A potential insider threat is being investigated and will be addressed by the senior management team.
- D. The Dl P has failed to block malicious exfiltration and data tagging is not being utilized property
Answer: B
Explanation:
The event timeline indicates a sequence where a file (hr-reporting.docx) was saved, scanned, executed, and eventually found to contain malware. The critical issue here is that the malware scan completed after the file was already executed. This suggests a Time-Of-Check to Time-Of-Use (TOCTOU) vulnerability, where the state of the file changed between the time it was checked and the time it was used.
Reference:
CompTIA SecurityX Study Guide: Discusses TOCTOU vulnerabilities as a timing attack where the state of a resource changes after it has been validated.
NIST Special Publication 800-53, "Security and Privacy Controls for Federal Information Systems and Organizations": Recommends addressing TOCTOU vulnerabilities to ensure the integrity of security operations.
"The Art of Software Security Assessment" by Mark Dowd, John McDonald, and Justin Schuh: Covers logic flaws and timing vulnerabilities, including TOCTOU issues.
NEW QUESTION # 201
An organization is looking for gaps in its detection capabilities based on the APTs that may target the industry Which of the following should the security analyst use to perform threat modeling?
- A. ATT&CK
- B. STRIDE
- C. CAPEC
- D. OWASP
Answer: A
Explanation:
The ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is the best tool for a security analyst to use for threat modeling when looking for gaps in detectioncapabilities based on Advanced Persistent Threats (APTs) that may target the industry. Here's why:
Comprehensive Framework: ATT&CK provides a detailed and structured repository of known adversary tactics and techniques based on real-world observations. It helps organizations understand how attackers operate and what techniques they might use.
Gap Analysis: By mapping existing security controls against the ATT&CK matrix, analysts can identify which tactics and techniques are not adequately covered by current detection and mitigation measures.
Industry Relevance: The ATT&CK framework is continuously updated with the latest threat intelligence, making it highly relevant for industries facing APT threats. It provides insights into specific APT groups and their preferred methods of attack.
NEW QUESTION # 202
A healthcare system recently suffered from a ransomware incident. As a result, the board of directors decided to hire a security consultant to improve existing network security. The security consultant found that the healthcare network was completely flat, had no privileged access limits, and had open RDP access to servers with personal health information. As the consultant builds the remediation plan, which of the following solutions would best solve these challenges? (Select three).
- A. NAC
- B. MFA
- C. Network segmentation
- D. Remote access VPN
- E. BGP
- F. PAM
- G. SD-WAN
Answer: B,C,F
Explanation:
Privileged Access Management (PAM)restricts elevated permissions, reducing the risk of widespread ransomware attacks.Multi-Factor Authentication (MFA)protects against credential theft and ensures that even if passwords are compromised, accounts are not easily accessible.Network segmentationbreaks the flat network into secure zones, limiting lateral movement by attackers. SD-WAN and BGP relate to network routing and efficiency, not security architecture specifically. Remote access VPN secures external access but does not solve internal flat network issues. Network Access Control (NAC) is helpful but secondary compared to PAM, MFA, and segmentation in this context.
NEW QUESTION # 203
You are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements:
. The application does not need to know the users' credentials.
. An approval interaction between the users and the HTTP service must be orchestrated.
. The application must have limited access to users' data.
INSTRUCTIONS
Use the drop-down menus to select the action items for the appropriate locations. All placeholders must be filled.
Answer:
Explanation:
See the complete solution below in Explanation:
Explanation:
Select the Action Items for the Appropriate Locations:
* Authorization Server:
* Action Item: Grant access
* Explanation: The authorization server's role is to authenticate the user and then issue an authorization code or token that the client application can use to access resources. Granting access involves the server authenticating the resource owner and providing the necessary tokens for the client application.
* Resource Server:
* Action Item: Access issued tokens
* Explanation: The resource server is responsible for serving the resources requested by the client application. It must verify the issued tokens from the authorization server to ensure the client has the right permissions to access the requested data.
* B2B Client Application:
* Action Item: Authorize access to other applications
* Explanation: The B2B client application must handle the OAuth flow to authorize access on behalf of the user without requiring direct knowledge of the user's credentials. This includes obtaining authorization tokens from the authorization server and using them to request access to the resource server.
Detailed Explanation:
OAuth 2.0 is designed to provide specific authorization flows for web applications, desktop applications, mobile phones, and living room devices. The integration involves multiple steps and components, including:
* Resource Owner (User):
* The user owns the data and resources that are being accessed.
* Client Application (B2B Client Application):
* Requests access to the resources controlled by the resource owner but does not directly handle the user's credentials. Instead, it uses tokens obtained through the OAuth flow.
* Authorization Server:
* Handles the authentication of the resource owner and issues the access tokens to the client application upon successful authentication.
* Resource Server:
* Hosts the resources that the client application wants to access. It verifies the access tokens issued by the authorization server before granting access to the resources.
OAuth Workflow:
* The resource owner accesses the client application.
* The client application redirects the resource owner to the authorization server for authentication.
* The authorization server authenticates the resource owner and asks for consent to grant access to the client application.
* Upon consent, the authorization server issues an authorization code or token to the client application.
* The client application uses the authorization code or token to request access to the resources from the resource server.
* The resource server verifies the token with the authorization server and, if valid, grants access to the requested resources.
References:
* CompTIA Security+ Study Guide: Provides comprehensive information on various authentication and authorization protocols, including OAuth.
* OAuth 2.0 Authorization Framework (RFC 6749): The official documentation detailing the OAuth
2.0 framework, its flows, and components.
* OAuth 2.0 Simplified: A book by Aaron Parecki that provides a detailed yet easy-to-understand explanation of the OAuth 2.0 protocol.
By ensuring that each component in the OAuth workflow performs its designated role, the B2B client application can securely access the necessary resources without compromising user credentials, adhering to the principle of least privilege.
NEW QUESTION # 204
Based on the results of a SAST report on a legacy application, a security engineer is reviewing the following snippet of code flagged as vulnerable:
Which of the following is the vulnerable line of code that must be changed?
- A. Line 108]
- B. Line (02]
- C. Line [07]
- D. Line [04]
- E. Line [10]
Answer: E
Explanation:
The vulnerability lies in line [10], where the function strcpy(transmit, input) is used. The strcpy function does not perform boundary checking when copying strings. Since input is defined with a size of 256 characters and transmit only has 20 characters allocated, the strcpy operation will cause a buffer overflow when the contents of input exceed the allocated size of transmit. This creates a significant security vulnerability, as attackers can overwrite adjacent memory, potentially injecting malicious code or altering program execution.
Lines [02], [04], [07], and [08] are not inherently vulnerable by themselves. Line [04] defines the oversized input, but the vulnerability only materializes when combined with the unsafe copy in line [10]. Secure coding practices recommend using safer alternatives like strncpy, which includes a length parameter, or implementing runtime checks to ensure the destination buffer size is not exceeded.
Thus, the vulnerable line that must be changed is line [10], where strcpy is used.
NEW QUESTION # 205
An organization determines existing business continuity practices are inadequate to support critical internal process dependencies during a contingency event. A compliance analyst wants the Chief Information Officer (CIO) to identify the level of residual risk that is acceptable to guide remediation activities. Which of the following does the CIO need to clarify?
- A. Impact
- B. Appetite
- C. Mitigation
- D. Likelihood
Answer: B
Explanation:
Comprehensive and Detailed Explanation:
* Understanding Residual Risk:
* Residual risk is the amount of risk remaining after controls and mitigations have been applied.
* Risk appetite defines the level of risk an organization is willing to accept before taking additional actions.
* Why Option D is Correct:
* The CIO must clarify the organization's "Risk Appetite" to determine how much residual risk is acceptable.
* If risk exceeds the appetite, additional security measures need to be implemented.
* This aligns with ISO 31000 and NIST Risk Management Framework (RMF).
* Why Other Options Are Incorrect:
* A (Mitigation): Mitigation refers to reducing risk, but it doesn't define the acceptable level of residual risk.
* B (Impact): Impact assessment measures potential damage, but it does not determine what is acceptable.
* C (Likelihood): Likelihood is the probability of risk occurring, but not what level is acceptable
.
NEW QUESTION # 206
A software company deployed a new application based on its internal code repository Several customers are reporting anti-malware alerts on workstations used to test the application Which of the following is the most likely cause of the alerts?
- A. Misconfigured code commit
- B. Unsecure bundled libraries
- C. Invalid code signing certificate
- D. Data leakage
Answer: B
Explanation:
The most likely cause of the anti-malware alerts on customer workstations is unsecure bundled libraries. When developing and deploying new applications, it is common for developers to use third-party libraries. If these libraries are not properly vetted for security, they can introduce vulnerabilities or malicious code.
Why Unsecure Bundled Libraries?
Third-Party Risks: Using libraries that are not secure can lead to malware infections if the libraries contain malicious code or vulnerabilities.
Code Dependencies: Libraries may have dependencies that are not secure, leading to potential security risks.
Common Issue: This is a frequent issue in software development where libraries are used for convenience but not properly vetted for security.
Other options, while relevant, are less likely to cause widespread anti-malware alerts:
A . Misconfigured code commit: Could lead to issues but less likely to trigger anti-malware alerts.
C . Invalid code signing certificate: Would lead to trust issues but not typically anti-malware alerts.
D . Data leakage: Relevant for privacy concerns but not directly related to anti-malware alerts.
Reference:
CompTIA SecurityX Study Guide
"Securing Open Source Libraries," OWASP
"Managing Third-Party Software Security Risks," Gartner Research
NEW QUESTION # 207
Which of the following AI concerns is most adequately addressed by input sanitation?
- A. Model inversion
- B. Prompt Injection
- C. Non-explainable model
- D. Data poisoning
Answer: B
Explanation:
Input sanitation is a critical process in cybersecurity that involves validating and cleaning data provided by users to prevent malicious inputs from causing harm. In the context of AI concerns:
A . Model inversion involves an attacker inferring sensitive data from model outputs, typically requiring sophisticated methods beyond just manipulating input data.
B . Prompt Injection is a form of attack where an adversary provides malicious input to manipulate the behavior of AI models, particularly those dealing with natural language processing (NLP). Input sanitation directly addresses this by ensuring that inputs are cleaned and validated to remove potentially harmful commands or instructions that could alter the AI's behavior.
C . Data poisoning involves injecting malicious data into the training set to compromise the model. While input sanitation can help by filtering out bad data, data poisoning is typically addressed through robust data validation and monitoring during the model training phase, rather than real-time input sanitation.
D . Non-explainable model refers to the lack of transparency in how AI models make decisions. This concern is not addressed by input sanitation, as it relates more to model design and interpretability techniques.
Input sanitation is most relevant and effective for preventing Prompt Injection attacks, where the integrity of user inputs directly impacts the performance and security of AI models.
Reference:
CompTIA Security+ Study Guide
"Security of Machine Learning" by Battista Biggio, Blaine Nelson, and Pavel Laskov OWASP (Open Web Application Security Project) guidelines on input validation and injection attacks Top of Form Bottom of Form
NEW QUESTION # 208
Users are willing passwords on paper because of the number of passwords needed in an environment. Which of the following solutions is the best way to manage this situation and decrease risks?
- A. implementing an SSO solution and integrating with applications
- B. Increasing password complexity to require 31 least 16 characters
- C. Implementing an MFA solution to avoid reliance only on passwords
- D. Requiring users to use an open-source password manager
Answer: A
Explanation:
Implementing a Single Sign-On (SSO) solution and integrating it with applications is the best way to manage the situation and decrease risks.
Reduced Password Fatigue: SSO allows users to log in once and gain access to multiple applications and systems without needing to remember and manage multiple passwords. This reduces the likelihood of users writing down passwords.
Improved Security: By reducing the number of passwords users need to manage, SSO decreases the attack surface and potential for password-related security breaches. It also allows for the implementation of stronger authentication methods.
User Convenience: SSO improves the user experience by simplifying the login process, which can lead to higher productivity and satisfaction.
NEW QUESTION # 209
A user reports application access issues to the help desk. The help desk reviews the logs for the user
Which of the following is most likely The reason for the issue?
- A. The user inadvertently tripped the impossible travel security rule in the SSO system.
- B. The user did not attempt to connect from an approved subnet
- C. A threat actor has compromised the user's account and attempted to lop, m
- D. The user is not allowed to access the human resources system outside of business hours
Answer: A
Explanation:
Based on the provided logs, the user has accessed various applications from different geographic locations within a very short timeframe. This pattern is indicative of the "impossible travel"security rule, a common feature in Single Sign-On (SSO) systems designed to detect and prevent fraudulent access attempts.
Analysis of Logs:
At 8:47 p.m., the user accessed a VPN from Toronto.
At 8:48 p.m., the user accessed email from Los Angeles.
At 8:48 p.m., the user accessed the human resources system from Los Angeles.
At 8:49 p.m., the user accessed email again from Los Angeles.
At 8:52 p.m., the user attempted to access the human resources system from Toronto, which was denied.
These rapid changes in location are physically impossible and typically trigger security measures to prevent unauthorized access. The SSO system detected these inconsistencies and likely flagged the activity as suspicious, resulting in access denial.
NEW QUESTION # 210
A company lined an email service provider called my-email.com to deliver company emails. The company stalled having several issues during the migration. A security engineer is troubleshooting and observes the following configuration snippet:
Which of the following should the security engineer modify to fix the issue? (Select two).
- A. The TXT record must be Changed to "v=dkim ip4:192.168.1.10 include:email-all"
- B. The TXT record must be Changed to "v=dmarc ip4:192.168.1.10 include:my-email.com -all"
- C. The srvo1 A record must be changed to a type CNAME record pointing to the email server
- D. The email CNAMErecord must be changed to a type A record pointing to 192.168.1.10
- E. The srv01 A record must be changed to a type CNAME record pointing to the web01 server
- F. The email CNAME record must be changed to a type A record pointing to 192.168.111
- G. The TXT record must be changed to "v=dkim ip4:l92.168.1.11 include my-email.com -ell"
Answer: B,D
Explanation:
The security engineer should modify the following to fix the email migration issues:
Email CNAME Record: The email CNAME record must be changed to a type A record pointing to
192.168.1.10. This is because CNAME records should not be used where an IP address (A record) is required.
Changing it to an A record ensures direct pointing to the correct IP.
TXT Record for DMARC: The TXT record must be changed to "v=dmarc ip4:192.168.1.10 include com -all". This ensures proper configuration of DMARC (Domain-based Message Authentication, Reporting
& Conformance) to include the correct IP address and the email service provider domain.
DMARC: Ensuring the DMARC record is correctly set up helps in preventing email spoofing and phishing, aligning with email security best practices.
References:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
RFC 7489: Domain-based Message Authentication, Reporting & Conformance (DMARC) NIST Special Publication 800-45: Guidelines on Electronic Mail Security
NEW QUESTION # 211
Which of the following best describes the reason PQC implementation is important?
- A. To leverage asymmetric encryption for large amounts of data
- B. To protect data against decryption due to increases in computational resource availability
- C. To have larger key lengths available through key stretching
- D. To improve encryption performance and speed using lightweight cryptography
Answer: B
NEW QUESTION # 212
A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware static of a domain controller. The forensic team cryptographically validated that com the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LOAP. Which of the following is best way to reduce the risk oi reoccurrence?
- A. Using code signing to verify the source of OS updates
- B. Enforcing allow lists for authorized network pons and protocols
- C. Measuring and attesting to the entire boot chum
- D. Rolling the cryptographic keys used for hardware security modules
Answer: B
Explanation:
The scenario describes a sophisticated attack where the threat actor used steganography within LDAP to exfiltrate data. Given that the hardware and OS firmware were validated and found uncompromised, the attack vector likely exploited a network communication channel. To mitigate such risks, enforcing allow lists for authorized network ports and protocols is the most effective strategy.
Port and Protocol Restrictions: By creating an allow list, the organization can restrict communications to only those ports and protocols that are necessary for legitimate business operations. This reduces the attack surface by preventing unauthorized or unusual traffic.
Network Segmentation: Enforcing such rules helps in segmenting the network and ensuring that only approved communications occur, which is critical in preventing data exfiltration methods like steganography.
Preventing Unauthorized Access: Allow lists ensure that only predefined, trusted connections are allowed, blocking potential paths that attackers could use to infiltrate or exfiltrate data. Other options, while beneficial in different contexts, are not directly addressing the network communication threat:
NEW QUESTION # 213
......
Verified CAS-005 Exam Dumps Q&As - Provide CAS-005 with Correct Answers: https://www.lead1pass.com/CompTIA/CAS-005-practice-exam-dumps.html
Pass Your CAS-005 Dumps Free Latest CompTIA Practice Tests: https://drive.google.com/open?id=12qJCzP79ickIIXwum8iEGpRqa0GRVBQ7