Free CompTIA CAS-005 Study Guides Exam Questions and Answer
CAS-005 Exam Dumps, CAS-005 Practice Test Questions
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 226
An engineering team determines the cost to mitigate certain risks is higher than the asset values The team must ensure the risks are prioritized appropriately. Which of the following is the best way to address the issue?
- A. Purchasing insurance
- B. Vulnerability assessments
- C. Branch protection
- D. Data labeling
Answer: A
Explanation:
When the cost to mitigate certain risks is higher than the asset values, the best approach is to purchase insurance. This method allows the company to transfer the risk to an insurance provider, ensuring that financial losses are covered in the event of an incident. This approach is cost-effective and ensures that risks are prioritized appropriately without overspending on mitigation efforts.
Reference:
CompTIA SecurityX Study Guide: Discusses risk management strategies, including risk transfer through insurance.
NIST Risk Management Framework (RMF): Highlights the use of insurance as a risk mitigation strategy.
"Information Security Risk Assessment Toolkit" by Mark Talabis and Jason Martin: Covers risk management practices, including the benefits of purchasing insurance.
NEW QUESTION # 227
A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems Given the following output:
Which of the following actions would address the root cause of this issue?
- A. Recompiling the affected programs with the most current patches
- B. Deploying a WAF with virtual patching upstream of the affected systems
- C. Automating the patching system to update base Images
- D. Disabling unused/unneeded ports on all servers
Answer: C
Explanation:
The output shows that multiple systems have outdated or vulnerable software versions (OpenSSL 1.01 and Java 11 runtime). This suggests that the systems are not being patched regularly or effectively.
A: Automating the patching system to update base images: Automating the patching process ensures that the latest security updates and patches are applied to all systems, including newly deployed ones. This addresses the root cause by ensuring that base images used for deployment are always up-to-date with the latest security patches.
B: Recompiling the affected programs with the most current patches: While this can fix the immediate vulnerabilities, it does not address the root cause of the problem, which is the lack of regular updates.
C: Disabling unused/unneeded ports on all servers: This improves security but does not address the specific issue of outdated software.
D: Deploying a WAF with virtual patching upstream of the affected systems: This can provide a temporary shield but does not resolve the underlying issue of outdated software.
Automating the patching system to update base images ensures that all deployed systems are using the latest, most secure versions of software, addressing the root cause of the vulnerability trend.
NEW QUESTION # 228
A government agency implements a configuration that disables cellular network access on government-issued devices while roaming internationally. The agency issues mobile hotspots and requires employees to use them for internet access. Which of the following best describes the agency's rationale?
- A. To defend from carrier OTA attack vectors
- B. To filter directed electromagnetic interference
- C. To block malicious radio connections
- D. To protect against SIM hijack vulnerabilities
- E. To prevent attempts to downgrade the protocol to legacy 3G
Answer: A
NEW QUESTION # 229
A systems engineer is configuring a system baseline for servers that will provide email services. As part of the architecture design, the engineer needs to improve performance of the systems by using an access vector cache, facilitating mandatory access control and protecting against:
* Unauthorized reading and modification of data and programs
* Bypassing application security mechanisms
* Privilege escalation
* interference with other processes
Which of the following is the most appropriate for the engineer to deploy?
- A. Privileged access management
- B. SELinux
- C. NIPS
- D. Self-encrypting disks
Answer: B
Explanation:
The most appropriate solution for the systems engineer to deploy is SELinux (Security-Enhanced Linux). Here's why:
Mandatory Access Control (MAC): SELinux enforces MAC policies, ensuring that only authorized users and processes can access specific resources. This helps in preventing unauthorized reading and modification of data and programs.
Access Vector Cache: SELinux utilizes an access vector cache (AVC) to improve performance. The AVC caches access decisions, reducing the need for repetitive policy lookups and thus improving system efficiency.
Security Mechanisms: SELinux provides a robust framework to enforce security policies and prevent bypassing of application security mechanisms. It controls access based on defined policies, ensuring that security measures are consistently applied.
Privilege Escalation and Process Interference: SELinux limits the ability of processes to escalate privileges and interfere with each other by enforcing strict access controls. This containment helps in isolating processes and minimizing the risk of privilege escalation attacks.
Reference:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
NSA's Guide to the Secure Configuration of Red Hat Enterprise Linux 5 (SELinux) NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 230
A company is adopting microservice architecture in order to quickly remediate vulnerabilities and deploy to production. All of the microservices run on the same Linux platform. Significant time was spent updating the base OS before deploying code. Which of the following should the company do to make the process efficient?
- A. Use Terraform scripts while creating golden images
- B. Create a cron job to run apt-update every 30 days.
- C. Use snapshots to deploy code to existing compute instances.
- D. Deploy a centralized update server.
Answer: A
Explanation:
The best approach is to use Terraform scripts while creating golden images (A). Terraform is an Infrastructure as Code (IaC) tool that allows organizations to automate infrastructure deployment consistently across environments. A golden image is a pre-configured, patched, and hardened system image used as a standard baseline. By creating golden images via Terraform scripts, the company ensures that every microservice instance is deployed on an already-updated and secure OS. This eliminates the need for repeatedly patching the base OS before code deployment.
Option B (cron job with apt-update) applies patches but introduces delays (every 30 days) and lacks consistency across new deployments. Option C (snapshots) saves deployment states but risks replicating outdated or unpatched images. Option D (centralized update server) is useful but still requires updates post-deployment, which slows the rollout of microservices.
NEW QUESTION # 231
A pharmaceutical lab hired a consultant to identify potential risks associated with Building 2, a new facility that is under construction. The consultant received the IT project plan, which includes the following VLAN design:
Which of the following TTPs should the consultant recommend be addressed first?
- A. Zone traversal
- B. Unauthorized execution
- C. Lateral movement
- D. Privilege escalation
Answer: A
Explanation:
Theregulated lab environment (Yes)shares the same VLAN (10.2.0.0/22) withusers, creatingzone traversalrisk from unregulated zones to sensitive datanetworks.
This allows pivoting and lateral movement from non-regulated user devices into regulated lab environments - a classiczone boundary violation.
Zone traversal should be mitigated with segmentation and firewall enforcement.
FromCAS-005, Domain 2: Risk Management and Mitigation Strategies:
"Zone traversal occurs when segmentation boundaries are misconfigured or merged, leading to regulatory and risk compliance failures."
NEW QUESTION # 232
An organization recently acquired another company that is running a different EDR solution. A SOC analyst wants to automate the isolation of endpoints that are found to be compromised. Which of the following workflows best mitigates the risk of false positives and reduces the spread of malicious code?
- A. Setting a policy on each EDR management console to isolate all endpoints that trigger any alerts
- B. Automating the suppression of all alerts that are not critical and sending an email asking SOC analysts to review these alerts
- C. Reviewing all alerts manually in the various portals and taking action to isolate them
- D. Using a SOAR solution to look up entities via a TIP platform and isolate endpoints via APIs
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
SecurityX CAS-005 emphasizes automation with validation in security operations. Security Orchestration, Automation, and Response (SOAR) platforms can integrate with Threat Intelligence Platforms (TIPs) to verify threat indicators before triggering automated endpoint isolation through EDR APIs. This approach reduces the spread of malware while minimizing the chance of isolating clean systems due to false positives.
* Isolating endpoints on any alert (B) is high-risk and can disrupt business operations.
* Manual review (C) is too slow for fast-moving threats.
* Suppressing alerts (D) risks missing critical events entirely.
NEW QUESTION # 233
An organization recently experienced a security incident due to an exterior door in a busy area getting stuck open. The organization launches a security campaign focused on the motto, "See Something, Say Something." Which of the following best describes what the organization wants to educate employees about?
- A. Social engineering
- B. Situational awareness
- C. Phishing
- D. Tailgating
Answer: B
NEW QUESTION # 234
A company finds logs with modified time stamps when compared to other systems. The security team decides to improve logging and auditing for incident response. Which of the following should the team do to best accomplish this goal?
- A. Rotate and back up logs every 24 hours, encrypting the backups.
- B. Implement a central logging server, allowing only log ingestion.
- C. Integrate a file-monitoring tool with the SIEM.
- D. Change the log solution and integrate it with the existing SIEM.
Answer: B
Explanation:
A central logging server ensures logs are collected in a tamper-proof manner and only ingested (not modified). This prevents attackers from altering logs locally.
Key concepts:
Logs should be centrally stored to prevent tampering.
Enabling log forwarding to a secure SIEM improves integrity.
Other options:
A (File monitoring tool) helps detect file changes but doesn't prevent log tampering.
B (Changing log solutions) does not inherently improve security.
D (Log rotation and encryption) is best practice but does not prevent modification before transmission.
NEW QUESTION # 235
An analyst has prepared several possible solutions to a successful attack on the company. The solutions need to be implemented with the least amount of downtime. Which of the following should the analyst perform?
- A. Implement every solution one at a time in a virtual lab, running an attack simulation each time while collecting metrics. Roll back each solution and then implement the next. Choose the best solution based on the best metrics.
- B. Implement all the solutions at once in a virtual lab and then run the attack simulation. Collect the metrics and then choose the best solution based on the metrics.
- C. Implement every solution one at a time in a virtual lab, running a metric collection each time. After the collection, run the attack simulation, roll back each solution, and then implement the next. Choose the best solution based on the best metrics.
- D. Implement all the solutions at once in a virtual lab and then collect the metrics. After collection, run the attack simulation. Choose the best solution based on the best metrics.
Answer: A
Explanation:
To minimize downtime, testing should occur in a virtual lab, not production. The best approach is to test solutions methodically: implement one solution at a time, run an attack simulation, collect metrics, roll back, and repeat. This isolates each solution's effectiveness, ensuring accurate metrics for decision-making without production impact.
* Option A:Testing all solutions simultaneously muddies the results-metrics won't show which solution worked.
* Option B:Collecting metrics before the simulation misses the point of testing against the attack.
* Option C:Correct-tests each solution independently with simulation and metrics, minimizing downtime via virtual lab use.
* Option D:Like A, combining solutions obscures individual effectiveness.
NEW QUESTION # 236
All organization is concerned about insider threats from employees who have individual access to encrypted material. Which of the following techniques best addresses this issue?
- A. SAE
- B. Account federation with hardware tokens
- C. SSO with MFA
- D. Key splitting
- E. Sating and hashing
Answer: D
Explanation:
The technique that best addresses the issue of insider threats from employees who have individual access to encrypted material is key splitting. Here's why:
Key Splitting: Key splitting involves dividing a cryptographic key into multiple parts and distributing these parts among different individuals or systems. This ensures that no single individual has complete access to the key, thereby mitigating the risk of insider threats.
Increased Security: By requiring multiple parties to combine their key parts to access encrypted material, key splitting provides an additional layer of security. This approach is particularly useful in environments where sensitive data needs to be protected from unauthorized access by insiders.
Compliance and Best Practices: Key splitting aligns with best practices and regulatory requirements for handling sensitive information, ensuring that access is tightly controlled and monitored.
NEW QUESTION # 237
Audit findings indicate several user endpoints are not utilizing full disk encryption During me remediation process, a compliance analyst reviews the testing details for the endpoints and notes the endpoint device configuration does not support full disk encryption Which of the following is the most likely reason me device must be replaced'
- A. The motherboard was not configured with a TPM from the OEM supplier.
- B. The HSM does not support sealing storage
- C. The HSM is vulnerable to common exploits and a firmware upgrade is needed
- D. The HSM is outdated and no longer supported by the manufacturer
- E. The vTPM was not properly initialized and is corrupt.
Answer: A
Explanation:
The most likely reason the device must be replaced is that the motherboard was not configured with a TPM (Trusted Platform Module) from the OEM (Original Equipment Manufacturer) supplier.
Why TPM is Necessary for Full Disk Encryption:
* Hardware-Based Security: TPM provides a hardware-based mechanism to store encryption keys securely, which is essential for full disk encryption.
* Compatibility: Full disk encryption solutions, such as BitLocker, require TPM to ensure that the encryption keys are securely stored and managed.
* Integrity Checks: TPM enables system integrity checks during boot, ensuring that the device has not been tampered with.
Other options do not directly address the requirement for TPM in supporting full disk encryption:
* A. The HSM is outdated: While HSM (Hardware Security Module) is important for security, it is not typically used for full disk encryption.
* B. The vTPM was not properly initialized: vTPM (virtual TPM) is less common and not typically a reason for requiring hardware replacement.
* C. The HSM is vulnerable to common exploits: This would require a firmware upgrade, not replacement of the device.
* E. The HSM does not support sealing storage: Sealing storage is relevant but not the primary reason for requiring TPM for full disk encryption.
References:
* CompTIA SecurityX Study Guide
* "Trusted Platform Module (TPM) Overview," Microsoft Documentation
* "BitLocker Deployment Guide," Microsoft Documentation
NEW QUESTION # 238
A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate. Which of the following is the best way to meet this objective?
- A. Configuring an API Integration to aggregate the different data sets
- B. Migrating application usage logs to on-premises storage
- C. Purchasing and deploying commercial off the shelf aggregation software
- D. Combining back-end application storage into a single, relational database
Answer: A
Explanation:
The best way to automate reporting from disparate security appliances that do not currently communicate is to configure an API Integration to aggregate the different data sets.
Interoperability: APIs allow different systems to communicate and share data, even if they were not originally designed to work together. This enables the integration of various security appliances into a unified reporting system.
Automation: API integrations can automate the process of data collection, aggregation, and reporting, reducing manual effort and increasing efficiency.
Scalability: APIs provide a scalable solution that can easily be extended to include additional security appliances or data sources as needed.
NEW QUESTION # 239
An organization wants to create a threat model to identity vulnerabilities in its infrastructure.
Which of the following, should be prioritized first?
- A. External facing Infrastructure with a low risk score and no known exploited vulnerabilities
- B. Internal infrastructure with high-seventy and Known exploited vulnerabilities
- C. External-facing Infrastructure with known exploited vulnerabilities
- D. External-facing infrastructure with a high risk score that can only be exploited with local access to the resource
Answer: C
Explanation:
External-facing infrastructure with known exploited vulnerabilities poses the highest immediate risk, as it is directly accessible to attackers and already associated with active threats.
This should be the top priority in any threat modeling effort.
NEW QUESTION # 240
A security engineer is reviewing the results of an annual penetration test. The report lists one of the results as "critical severity" on several domain-joined workstations:
SSL/TLS Weak Protocols Supported TLS 1.0, TLS 1.1
Which of the following should the security engineer implement to remediate this finding in the most centralized manner?
- A. A PowerShell script to disable weak protocols in the HKLM Schannel hive
- B. A registry script to disable weak protocols in the Schannel hive
- C. An SCCM patch to disable weak protocols in the Schannel hive
- D. A GPO to disable weak protocols in the Schannel hive
Answer: D
NEW QUESTION # 241
A financial technology firm works collaboratively with business partners in the industry to share threat intelligence within a central platform. This collaboration gives partner organizations the ability to obtain and share data associated with emerging threats from a variety of adversaries.
Which of the following should the organization most likely leverage to facilitate this activity?
(Choose two.)
- A. JTAG
- B. STIX
- C. YAKA
- D. TAXII
- E. CWPP
- F. ATTACK
Answer: B,D
Explanation:
STIX (Structured Threat Information eXpression): STIX is a standardized language for representing threat information in a structured and machine-readable format. It facilitates the sharing of threat intelligence by ensuring that data is consistent and can be easily understood by all parties involved.
TAXII (Trusted Automated eXchange of Indicator Information): TAXII is a transport mechanism that enables the sharing of cyber threat information over a secure and trusted network. It works in conjunction with STIX to automate the exchange of threat intelligence among organizations.
NEW QUESTION # 242
An IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.
Complete the configuration files to meet the following requirements:
* The EAP method must use mutual certificate-based authentication (With issued client certificates).
* The IKEv2 Cipher suite must be configured to the MOST secure
authenticated mode of operation,
* The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimumlength requirement of eight characters, INSTRUCTIONS Click on the AAA server and VPN concentrator to complete the configuration.
Fill in the appropriate fields and make selections from the drop-down menus.
VPN Concentrator:
AAA Server:
Answer:
Explanation:
VPN Concentrator:
A screenshot of a computer Description automatically generated
AAA Server:
A screenshot of a computer Description automatically generated
NEW QUESTION # 243
A company migrated a critical workload from its data center to the cloud. The workload uses a very large data set that requires computational-intensive data processing. The business unit that uses the workload is projecting the following growth pattern:
* Storage requirements will double every six months.
* Computational requirements will fluctuate throughout the year.
* Average computational requirements will double every year.
Which of the following should the company do to address the business unit's requirements?
- A. Deploy a cloud-based CDN for storage and a load balancer for compute.
- B. Plan for a horizontally scaling computing and storage infrastructure.
- C. Implement a load balancer for computing and storage resources.
- D. Combine compute and storage in vertically autoscaling mode.
Answer: B
Explanation:
Comprehensive and Detailed
SecurityX CAS-005 cloud architecture guidance emphasizes horizontal scaling for workloads that need to handle both predictable and fluctuating growth over time. Horizontal scaling allows the infrastructure to add nodes for both compute and storage dynamically, providing elasticity to meet fluctuating computational demands while accommodating exponential storage growth.
Vertical scaling (B) has hardware limits and is not as flexible for large, sustained growth.
CDN (A) is optimized for content distribution, not intensive compute workloads.
NEW QUESTION # 244
A company's internal network is experiencing a security breach, and the threat actor is still active. Due to business requirements, users in this environment are allowed to utilize multiple machines at the same time. Given the following log snippet:
Which of the following accounts should a security analyst disable to best contain the incident without impacting valid users?
- A. user-c
- B. user-d
- C. user-a
- D. user-b
Answer: A
Explanation:
Useruser-cis showinganomalous behavior across multiple machines, attempting to run administrative tools such as cmd.exe and appwiz.CPL, which are commonly used by attackers for system modification. The activity pattern suggests a lateral movement attempt, potentially indicating a compromised account.
user-a (A)anduser-b (B)attempted to run applications but only on one machine, suggesting less likelihood of compromise.
user-d (D)was blocked running cmd.com, but user-c's pattern is more consistent with an attack technique.
NEW QUESTION # 245
A central bank implements strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin. Which of the following best describes the cyberthreat to the bank?
- A. Physical Implants and tampering
- B. Non-conformance to accepted manufacturing standards
- C. Ability to obtain components during wartime
- D. Fragility and other availability attacks
Answer: A
Explanation:
The best description of the cyber threat to a central bank implementing strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin, is the risk of physical implants and tampering. Here's why:
* Supply Chain Security: The supply chain is a critical vector for hardware tampering and physical implants, which can compromise the integrity and security of hardware components before they reach the organization.
* Targeted Attacks: Banks and financial institutions are high-value targets, making them susceptible to sophisticated attacks, including those involving physical implants that can be introduced during manufacturing or shipping processes.
* Strict Mitigations: Implementing an allow list for specific countries aims to mitigate the risk of supply chain attacks by limiting the sources of hardware. However, the primary concern remains the introduction of malicious components through tampering.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-161: Supply Chain Risk Management Practices for Federal Information Systems and Organizations
* ISO/IEC 20243:2018 - Information Technology - Open Trusted Technology Provider Standard
NEW QUESTION # 246
A developer makes a small change to a resource allocation module on a popular social media website and causes a memory leak. During a peak utilization period, several web servers crash, causing the website to go offline. Which of the following testing techniques is the most efficient way to prevent this from reoccurring?
- A. Load
- B. Smoke
- C. Canary
- D. Regression
Answer: D
Explanation:
Step-by-Step Explanation:
Regression testing ensures that new changes do not break existing functionality. It would have identified the memory leak before deployment, preventing downtime.
NEW QUESTION # 247
Based on the results of a SAST report on a legacy application, a security engineer is reviewing the following snippet of code flagged as vulnerable:
Which of the following is the vulnerable line of code that must be changed?
- A. Line [04]
- B. Line [07]
- C. Line [10]
- D. Line (02]
- E. Line 108]
Answer: C
Explanation:
The vulnerability lies in line [10], where the function strcpy(transmit, input) is used. The strcpy function does not perform boundary checking when copying strings. Since input is defined with a size of 256 characters and transmit only has 20 characters allocated, the strcpy operation will cause a buffer overflow when the contents of input exceed the allocated size of transmit. This creates a significant security vulnerability, as attackers can overwrite adjacent memory, potentially injecting malicious code or altering program execution.
Lines [02], [04], [07], and [08] are not inherently vulnerable by themselves. Line [04] defines the oversized input, but the vulnerability only materializes when combined with the unsafe copy in line [10]. Secure coding practices recommend using safer alternatives like strncpy, which includes a length parameter, or implementing runtime checks to ensure the destination buffer size is not exceeded.
Thus, the vulnerable line that must be changed is line [10], where strcpy is used.
NEW QUESTION # 248
......
Latest CAS-005 Actual Free Exam Questions Updated 530 Questions: https://www.testkingit.com/CompTIA/latest-CAS-005-exam-dumps.html
Attested CAS-005 Dumps PDF Resource [2026]: https://drive.google.com/open?id=1wOB1xJ_fHU8pq-Uzjalp0lhwUgB689Nl