CompTIA CAS-005 Exam Dumps

CompTIA CAS-005 Sample Question Answers

Question # 1

 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 34 6d be 66 00 00 00 00 00 00 00 00 e0 00 0f 03 0b 01 05 00 00 70 00 00 00 10 00 00 00 d0 00 00 70 4c 01 00 00 e0 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 02 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 Attempts to run the code in a sandbox produce no results. Which of the following should the malware analyst do next to further analyze the malware and discover useful IoCs?

 A.Convert the hex-encoded sample to binary and attempt to decompile it. 
B.Run the encoded sample through an online vulnerability tool and check for any matches. 
C.Pad the beginning and end of the sample with binary executables and attempt to execute it. 
D.Use a disassembler on the unencoded snippet to convert from binary to ASCII text. 

Show Answer

Question # 2

 A company plans to deploy a new online application that provides video training for its customers. As part of the design, the application must be: Fast for all users Available for users worldwide Protected against attacks Which of the following are the best components the company should use to meet these requirements? (Select two). 

A.WAF 
B.IPS 
C.CDN 
D.SASE 
E.VPN 
F.CASB 

Show Answer

Question # 3

 A developer receives feedback about code quality and efficiency. The developer needs to identify and resolve the following coding issues before submitting the code changes for peer review: Indexing beyond arrays Dereferencing null pointers Potentially dangerous data type combinations Unreachable code Non-portable constructs Which of the following would be most appropriate for the developer to use in this situation? 

A. Linting 
B. SBoM 
C. DAST 
D. Branch protection 
E. Software composition analysis 

Show Answer

Question # 4

 A company discovers intellectual property data on commonly known collaboration web applications that allow the use of slide templates. The systems administrator is reviewing the configurations of each tool to determine how to prevent this issue. The following security solutions are deployed: CASB SASE WAF EDR Firewall IDS SIEM DLP endpoints Which of the following should the administrator do to address the issue? 

A. Enable blocking for all WAF policies. 
B. Enforce a policy to block unauthorized web applications within CASB. 
C. Create an alert within the SIEM for outgoing network traffic to the suspected website. 
D. Configure DLP endpoints to block sensitive data to removable storage. 

Show Answer

Question # 5

 A nation-state actor is exposed for attacking large corporations by establishing persistence in smaller companies that are likely to be acquired by these large corporations. The actor then provisions user accounts in the companies for use post-acquisition. Before an upcoming acquisition, a security officer conducts threat modeling with this attack vector. Which of the following practices is the best way to investigate this threat? 

A. Restricting internet traffic originating from countries in which the nation-state actor is known to operate 
B. Comparing all existing credentials to personnel and services 
C. Auditing vendors to mitigate supply chain risk during the acquisition 
D. Placing a hold on all information about corporate interest in acquisitions 

Show Answer

Question # 6

A security engineer wants to enhance the security posture of end-user systems in a Zero Trust environment. Given the following requirements: . Reduce the ability for potentially compromised endpoints to contact command-and-control infrastructure. . Track the requests that the malware makes to the IPs. . Avoid the download of additional payloads. Which of the following should the engineer deploy to meet these requirements? 

A. DNS sinkholing 
B. Browser isolation 
C. Zone transfer protection 
D. HIDS 

Show Answer

Question # 7

 In order to follow new regulations, the Chief Information Security Officer plans to use a defense-indepth approach for a perimeter network. Which of the following protections would best achieve this goal? 

A. SAST, DAST, IAST 
B. NGFW, IPS, EDR 
C. SASE, IDS, SAST 
D. CASB, DLP, EDR 

Show Answer

Question # 8

During a security review for the CI/CD process, a security engineer discovers the following information in a testing repository from the company: Which of the following options is the best countermeasure to prevent this issue in the future?

 A. Performing an application penetration test over the testing environment before moving to production 
B. Changing the repository technology to avoid inclusion of confidential information 
C. Automating the upload process of code to the repository and improving the software development life cycle 
D. Using a secrets management platform to share and manage confidential information 

Show Answer

Question # 9

Which of the following are the best ways to mitigate the threats that are the highest priority? (Select two). 

A. Isolate network systems using Zero Trust architecture with microsegmentation and SD-WAN 
B. Scan all systems and source code with access to sensitive data for vulnerabilities. 
C. Implement a cloud access security broker and place it in blocking mode to prevent information exfiltration. 
D. Apply data labeling to all sensitive information within the environment with special attention to payroll information. 
E. Institute a technical approval process that requires multiple parties to sign off on mass payroll changes. 

Show Answer

Question # 10

 A security engineer needs to remediate a SWEET32 vulnerability in an OpenSSH-based application and review existing configurations. Which of the following should the security engineer do? (Select two.) 

 A. Disable Twofish algorithms 
B. cat /etc/ashd/ash_config | grep "HMAC" 
C. Disable RSA algorithms 
D. cat /etc/sshd/ssh_config | grep "PermitRootLogin" 
E. Disable 3DES algorithms 
F. cat /etc/sshd/ssh_config | grep "Ciphers" 

Show Answer

Question # 11

 An organization wants to implement a secure cloud architecture across all instances. Given the following requirements: Establish a standard network template. Deployments must be consistent. Security policies must be able to be changed at scale. Which of the following technologies meets these requirements? 

A. Serverless deployment model 
B. Container orchestration 
C. Infrastructure as code 
D. CLI cloud administration 
E. API gateway 

Show Answer

Question # 12

 A security operations analyst is reviewing network traffic baselines for nightly database backups. Given the following information: Which of the following should the security analyst do next? 

A. Consult with a network engineer to determine the impact of bandwidth usage 
B. Quarantine PRDDB01 and then alert the database engineers 
C. Refer to the incident response playbook for the proper response 
D. Review all the network logs for further data exfiltration 

Show Answer

Question # 13

A security engineer is developing a solution to meet the following requirements: All endpoints should be able to establish telemetry with a SIEM. All endpoints should be able to be integrated into the XDR platform. SOC services should be able to monitor the XDR platform. Which of the following should the security engineer implement to meet the requirements? (Select Two.) 

A. EDR 
B. HIDS 
C. Web application firewall 
D. Central logging 
E. Host-based firewall 
F. TPM 

Show Answer

Question # 14

 An administrator reviews the following log and determines the root cause of a site-to-site tunnel failure: Which of the following actions should the administrator take to most effectively correct the failure? 

 A. Enable perfect forward secrecy on the remote peer. 
B. Update the cipher suites configured for use on the server side. 
C. Add a new subnet as a permitted initiator. 
D. Disable IKE version 1 and run IKE version 2. 

Show Answer

Question # 15

An application requires the storage of PII. A systems engineer needs to implement a solution that uses an external device for key management. Which of the following is the best solution? 

 A. TPM 
B. SBoM 
C. vTPM 
D. HSM 

Show Answer

Question # 16

An incident response analyst finds the following content inside of a log file that was collected from a compromised server: .2308464678 ... whoami ..... su2032829%72%322/// ...... /etc/passwd .... 2087031731467478432 ... $6490/./ ..< XML ?........nty. Which of the following is the best action to prevent future compromise? 

A. Blocking the processing of external files by forwarding them to another server for processing 
B. Implementing an allow list for all text boxes throughout the web application 
C. Filtering inserted characters for all user inputs and allowing only ASCII characters 
D. Improving file-parsing capabilities to stop external entities from executing commands 

Show Answer

Question # 17

 An organization recently experienced a security incident due to an exterior door in a busy area getting stuck open. The organization launches a security campaign focused on the motto, "See Something, Say Something." Which of the following best describes what the organization wants to educate employees about? 

A. Situational awareness 
B. Phishing 
C. Social engineering 
D. Tailgating 

Show Answer

Question # 18

 A company implements an Al model that handles sensitive and personally identifiable information. Which of the following threats is most likely the company's primary concern? 

A. Unsecured output handling 
B. Model theft 
C. Model poisoning 
D. Prompt injection 

Show Answer

Question # 19

A cybersecurity architect seeks to improve vulnerability management and orchestrate a large number of vulnerability checks. Key constraints include: . There are 512 containerized microservices. . Vulnerability data is sourced from multiple scanners. . CIS baselines must be enforced. . Scan activity must be scheduled. Which of the following automation workflows best meets this objective? 

A. Employing an endpoint data collection system 
B. Deploying an XCCDF scanner 
C. Utilizing CVSS reports for SOC analysts 
D. Using a repository scanner to enforce laC security 

Show Answer

Question # 20

 Which of the following most likely explains the reason a security engineer replaced ECC with a lattice-based cryptographic technique? 

A. It is computationally efficient and provides perfect forward secrecy. 
B. It is more resilient to brute-force attacks than ECC. 
C. It supports ephemeral key exchange and digital signatures. 
D. It is currently considered a robust PQC technique. 
E. It enables processing on data while remaining in an encrypted state. 

Show Answer

Question # 21

A security analyst is performing threat modeling for a new AI chatbot. The AI chatbot will be rolled out to help customers develop configuration information within the company's SaaS offering. Which of the following issues would require involvement from the company's internal legal team? 

A. An internal user finds a way to use prompt injection to disregard guardrails. 
B. A DoS vulnerability exists that could impact all customers who use the chatbot. 
C. A bug bounty of an exploitable model inversion vulnerability is submitted. 
D. User consent is not being collected before training models on customer data. 
E. An access control issue is allowing the model to be poisoned with incorrect information. 

Show Answer

Question # 22

 A company developed a new solution that needs to track any changes to the data, and the changes need to be quickly identified. If any changes are attempted without prior approval, multiple events must be triggered, such as: Raising alerts Blocking the unapproved changes Quickly removing access to the data Which of the following solutions best meets these requirements? 

A. Tracking all application logs, integrating them to the existing SIEM, flagging any changes, and making them visible on security dashboards 
B. Implementing a file integrity monitoring tool and integrating it via orchestration and automation with other security tools 
C. Introducing more granular access controls and allowing read-only access for non-privileged users 
D. Configuring CASB rules, making access to the data available only to authorized personnel 

Show Answer

Question # 23

 A security engineer reviews an after action report from a previous security breach and notes a long lag time between detection and containment of a compromised account. The engineer suggests using SOAR to address this concern. Which of the following best explains the engineer's goal? 

A. To prevent accounts from being compromised 
B. To enable log correlation using machine learning 
C. To orchestrate additional reporting for the security operations center 
D. To prepare runbooks to automate future incident response 

Show Answer

Question # 24

 During an incident response activity, the response team collected some artifacts from a compromised server, but the following information is missing: Source of the malicious files Initial attack vector Lateral movement activities The next step in the playbook is to reconstruct a timeline. Which of the following best supports this effort? 

A. Executing decompilation of binary files 
B. Analyzing all network routes and connections 
C. Performing primary memory analysis 
D. Collecting operational system logs and storage disk data 

Show Answer

Question # 25

 A company must meet the following security requirements when implementing controls in order to be compliant with government policy: Access to the system document repository must be MFA enabled. Ongoing risk monitoring must be displayed on a system dashboard. Staff must receive email notifications about periodic tasks. Which of the following best meets all of these requirements? 

A. Implementing a GRC tool 
B. Configuring a privileged access management system 
C. Launching a vulnerability management program 
D. Creating a risk register 

Show Answer

Question # 26

 While performing threat-hunting functions, an analyst is using the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target. Which of the following must the threat hunter document to use the model effectively? 

A. Knowledge 
B. Capabilities 
C. Phase 
D. Methodologies 

Show Answer

Question # 27

An organization must provide access to its internal system data. The organization requires that this access complies with the following: Access must be automated. Data confidentiality must be preserved. Access must be authenticated. Data must be preprocessed before it is retrieved. Which of the following actions should the organization take to meet these requirements? 

A. Configure a reverse proxy to protect the data. 
B. Implement an on-demand VPN connection. 
C. Deploy an API gateway protected with access tokens. 
D. Continually publish all relevant data to a CDN. 

Show Answer

Question # 28

Emails that the marketing department is sending to customers are going to the customers' spam folders. The security team is investigating the issue and discovers that the certificates used by the email server were reissued, but DNS records had not been updated. Which of the following should the security team update in order to fix this issue? (Select three). 

A. DMARC 
B. SPF 
C. DKIM 
D. DNSSEC 
E. SASE 
F. SAN 
G. SOA 
H. MX 

Show Answer

Question # 29

 A development team must create a website to share indicators of compromise. The team wants to use APIs between industry peers to aid in configuring SIEM and SOAR. The team needs to create a free tier of service, and the senior developer insists on configuring rate limiting. Which of the following best describes the senior developer's reasoning? 

A. To prevent password-spraying attacks on the services hosting the API 
B. To limit the likelihood of resource exhaustion occurring on the API server 
C. To address concerns the team has about API bandwidth utilization 
D. To reduce attack surface exposure of the API endpoints connecting peers 

Show Answer

Question # 30

An engineer wants to automate several tasks by running commands daily on a UNIX server. The engineer has only built-in, default tools available. Which of the following should the engineer use to best assist with this effort? (Select Two). 

A. Python 
B. Cron 
C. Ansible 
D. PowerShell 
E. Bash 
F. Task Scheduler 

Show Answer

Question # 31

 A security engineer needs to create multiple servers in a company's private cloud. The servers should have a virtual network infrastructure that supports connectivity, as well as security configurations applied using predefined templates. Which of the following is the best option for the security engineer to consider for the deployment? 

A. Installing a container orchestration solution locally, configuring the infrastructure, and cloning the solution 
B. Creating templates on the cloud provider marketplace and modeling the solution using those templates 
C. Using Terraform to implement an infrastructure as code model with the existing private cloud solution 
D. Integrating the cloud provider API to the CI/CD pipeline model used by the company 

Show Answer

Question # 32

While investigating an email server that crashed, an analyst reviews the following log files: Which of the following is most likely the root cause? 

A. The administrator's account credentials were intercepted and reused. 
B. The backup process did not complete and caused cascading failure. 
C. A hardware failure in the storage array caused the mailboxes to be inaccessible. 
D. A user with low privileges was able to escalate and erase all mailboxes. 

Show Answer

Question # 33

An organization is deploying a new data lake that will centralize records from several applications. During the design phase, the security architect identifies the following requirements: The sensitivity levels of the data is different. The data must be accessed through stateless API calls after authentication. Different users will have access to different data sets. Which of the following should the architect implement to best meet these requirements? 

A. Directory services 
B. 802.1X with EAP-TLS 
C. OpenID Connect 
D. CASB 

Show Answer

Question # 34

 A company wants to perform threat modeling on an internally developed, business-critical application. The Chief Information Security Officer (CISO) is most concerned that the application should maintain 99.999% availability and authorized users should only be able to gain access to data they are explicitly authorized to view. Which of the following threat-modeling frameworks directly addresses the CISO's concerns about this system? 

A. CAPEC 
B. STRIDE 
C. ATT&CK 
D. TAXII 

Show Answer