Verified CAS-005 Exam Dumps PDF [2025] Access using TestkingPDF
Try Best CAS-005 Exam Questions from Training Expert TestkingPDF
NEW QUESTION # 57
A company migrating to a remote work model requires that company-owned devices connect to a VPN before logging in to the device itself. The VPN gateway requires that a specific key extension is deployed to the machine certificates in the internal PKI. Which of the following best explains this requirement?
- A. The server connection uses SSL VPN, which uses certificates for secure communication.
- B. The certificate is an additional factor to meet regulatory MFA requirements for VPN access.
- C. The internal PKI certificate deployment allows for Wi-Fi connectivity before logging in to other systems.
- D. The VPN client selected the certificate with the correct key usage without user interaction.
Answer: D
Explanation:
Comprehensive and Detailed Explanation:
This scenario describes an enterprise VPN setup that requires machine authentication before a user logs in. The best explanation for this requirement is that the VPN client selects the appropriate certificate automatically based on the key extension in the machine certificate.
* Understanding the Key Extension Requirement:
* PKI (Public Key Infrastructure) issues machine certificates that include specific key usages such as Client Authentication or IPSec IKE Intermediate.
* Key usage extensions define how a certificate can be used, ensuring that only valid certificates are selected by the VPN client.
* Why Option B is Correct:
* The VPN automatically selects the correct machine certificate with the appropriate key extension.
* The process occurs without user intervention, ensuring seamless VPN authentication before login.
* Why Other Options Are Incorrect:
* A (MFA requirement): Certificates used in this scenario are for machine authentication, not user MFA. MFA typically involves user credentials plus a second factor (like OTPs or biometrics), which is not applicable here.
* C (Wi-Fi connectivity before login): This refers to pre-logon networking, which is a separate concept where devices authenticate to a Wi-Fi network before login, usually via 802.1X EAP- TLS. However, this question specifically mentions VPN authentication, not Wi-Fi authentication.
* D (SSL VPN with certificates): While SSL VPNs do use certificates, this scenario involves machine certificates issued by an internal PKI, which are commonly used in IPSec VPNs, not SSL VPNs.
NEW QUESTION # 58
Employees use their badges to track the number of hours they work. The badge readers cannot be upgraded due to facility constraints. The software for the badge readers uses a legacy platform and requires connectivity to the enterprise resource planning solution. Which of the following is the best to ensure the security of the badge readers?
- A. Vulnerability scans
- B. Segmentation
- C. Anti-malware
Answer: B
Explanation:
Segmentationis the best option to ensure the security of legacy badge readers that cannot be upgraded.
Segmentation isolates the legacy devices on a separate network segment to minimize their exposure to potential threats. This approach reduces the attack surface by preventing unauthorized access from other parts of the network while still allowing necessary connectivity to the enterprise resource planning (ERP) system.
* Vulnerability scans (B)are useful for identifying weaknesses but do not actively protect the badge readers.
* Anti-malware (C)is ineffective since the badge readers use a legacy platform that likely does not support modern endpoint protection solutions.
Reference:CompTIA SecurityX (CAS-005) Exam Objectives- Domain 2.0 (Security Architecture), Section onNetwork Segmentation & Attack Surface Management
NEW QUESTION # 59
A security analyst is reviewing the following authentication logs:
Which of the following should the analyst do first?
- A. Disable User12's account
- B. Disable User1's account
- C. Disable User2's account
- D. Disable User8's account
Answer: B
Explanation:
Based on the provided authentication logs, we observe that User1's accountexperienced multiple failed login attempts within a very short time span (at 8:01:23 AM on 12/15). This pattern indicates a potential brute-force attack or an attempt to gain unauthorized access. Here's a breakdown of why disabling User1's account is the appropriate first step:
Failed Login Attempts: The logs show that User1 had four consecutive failed login attempts:
VM01 at 8:01:23 AM
VM08 at 8:01:23 AM
VM01 at 8:01:23 AM
VM08 at 8:01:23 AM
Security Protocols and Best Practices: According to CompTIA Security+ guidelines, multiple failed login attempts within a short timeframe should trigger an immediate response to prevent further potential unauthorized access attempts. This typically involves temporarily disabling the account to stop ongoing brute- force attacks.
Account Lockout Policy: Implementing an account lockout policy is a standard practice to thwart brute-force attacks. Disabling User1's account will align with these best practices and prevent further failed attempts, which might lead to successful unauthorized access if not addressed.
References:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
CompTIA Security+ Certification Exam Objectives
NIST Special Publication 800-63B: Digital Identity Guidelines
By addressing User1's account first, we effectively mitigate the immediate threat of a brute-force attack, ensuring that further investigation can be conducted without the risk of unauthorized access continuing during the investigation period.
NEW QUESTION # 60
A security officer performs due diligence activities before implementing a third-party solution into the enterprise environment. The security officer needs evidence from the third party that a data subject access request handling process is in place. Which of the following is the security officer most likely seeking to maintain compliance?
- A. E-discovery requirements
- B. Information security standards
- C. Privacy regulations
- D. Certification requirements
- E. Reporting frameworks
Answer: C
Explanation:
Comprehensive and Detailed Step-by-Step
Privacy regulations (C), such as GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act), require companies to provide data subject access request (DSAR) handling processes. A DSAR allows individuals to request details about their personal data stored by a company and request modifications or deletions.
NEW QUESTION # 61
A security team determines that the most significant risks within the pipeline are:
* Unauthorized code changes
* The current inability to perform independent verification of software modules Which of the following best addresses these concerns?
- A. Lightweight cryptography
- B. Non-repudiation
- C. Code signing
- D. Digital signatures
Answer: C
Explanation:
Unauthorized code changesand lack ofindependent verificationare directly mitigated bycode signing, which ensures that code is from a trusted source and has not been altered.
While digital signatures are part of code signing, the broader practice of code signing encompasses signature management, version integrity, and trusted sources.
Lightweight cryptography is irrelevant in this context; it's more about efficiency in constrained devices.
Non-repudiation is a benefit of digital signatures but doesn't directly solve the verification/integrity concerns alone.
FromCAS-005 Guide, Domain 4: Security Architecture, Tools, and Technologies:
"Code signing ensures that the code has not been tampered with and originates from a trusted developer."
NEW QUESTION # 62
A company wants to use loT devices to manage and monitor thermostats at all facilities The thermostats must receive vendor security updates and limit access to other devices within the organization Which of the following best addresses the company's requirements''
- A. Only allowing Internet access to a set of specific domains
- B. Configuring IoT devices to always allow automatic updates
- C. Operating lot devices on a separate network with no access to other devices internally
- D. Only allowing operation for loT devices during a specified time window
Answer: C
Explanation:
The best approach for managing and monitoring IoT devices, such as thermostats, is to operate them on a separate network with no access to other internal devices. This segmentation ensures that the IoT devices are isolated from the main network, reducing the risk of potential security breaches affecting other critical systems. Additionally, this setup allows for secure vendor updates without exposing the broader network to potential vulnerabilities inherent in IoT devices.
Reference:
CompTIA SecurityX Study Guide: Recommends network segmentation for IoT devices to minimize security risks.
NIST Special Publication 800-183, "Network of Things": Advises on the isolation of IoT devices to enhance security.
"Practical IoT Security" by Brian Russell and Drew Van Duren: Discusses best practices for securing IoT devices, including network segmentation.
NEW QUESTION # 63
You are a security analyst tasked with interpreting an Nmap scan output from company's privileged network.
The company's hardening guidelines indicate the following:
There should be one primary server or service per device.
Only default ports should be used.
Non-secure protocols should be disabled.
INSTRUCTIONS
Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed.
For each device found by Nmap, add a device entry to the Devices Discovered list, with the following information:
The IP address of the device
The primary server or service of the device (Note that each IP should by associated with one service/port only) The protocol(s) that should be disabled based on the hardening guidelines (Note that multiple ports may need to be closed to comply with the hardening guidelines) If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
10.1.45.65 SFTP Server Disable 8080
10.1.45.66 Email Server Disable 415 and 443
10.1.45.67 Web Server Disable 21, 80
10.1.45.68 UTM Appliance Disable 21
NEW QUESTION # 64
A network engineer must ensure that always-on VPN access is enabled Curt restricted to company assets Which of the following best describes what the engineer needs to do''
- A. Create a wildcard certificate for connections from public networks
- B. Generate device certificates using the specific template settings needed
- C. Modify signing certificates in order to support IKE version 2
- D. Add the VPN hostname as a SAN entry on the root certificate
Answer: B
Explanation:
To ensure always-on VPN access is enabled and restricted to company assets, the network engineer needs to generate device certificates using the specific template settings required for thecompany's VPN solution.
These certificates ensure that only authorized devices can establish a VPN connection.
Why Device Certificates are Necessary:
Authentication: Device certificates authenticate company assets, ensuring that only authorized devices can access the VPN.
Security: Certificates provide a higher level of security compared to username and password combinations, reducing the risk of unauthorized access.
Compliance: Certificates help in meeting security policies and compliance requirements by ensuring that only managed devices can connect to the corporate network.
Other options do not provide the same level of control and security for always-on VPN access:
B: Modify signing certificates for IKE version 2: While important for VPN protocols, it does not address device-specific authentication.
C: Create a wildcard certificate: This is not suitable for device-specific authentication and could introduce security risks.
D: Add the VPN hostname as a SAN entry: This is more related to certificate management and does not ensure device-specific authentication.
NEW QUESTION # 65
An IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.
Complete the configuration files to meet the following requirements:
* The EAP method must use mutual certificate-based authentication (With issued client certificates).
* The IKEv2 Cipher suite must be configured to the MOST secure
authenticated mode of operation,
* The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimum length requirement of eight characters, INSTRUCTIONS Click on the AAA server and VPN concentrator to complete the configuration.
Fill in the appropriate fields and make selections from the drop-down menus.
VPN Concentrator:
AAA Server:
Answer:
Explanation:
See the answer below in Explanation.
Explanation:
VPN Concentrator:
A screenshot of a computer Description automatically generated
AAA Server:
A screenshot of a computer Description automatically generated
NEW QUESTION # 66
A security analyst Detected unusual network traffic related to program updating processes. The analyst collected artifacts from compromised user workstations. The discovered artifacts were binary files with the same name as existing, valid binaries but. With different hashes which of the following solutions would most likely prevent this situation from reoccurring?
- A. Improving patching processes
- B. Performing manual updates via USB ports
- C. Allowing only dies from internal sources
- D. Implementing digital signature
Answer: D
Explanation:
Implementing digital signatures ensures the integrity and authenticity of software binaries. When a binary is digitally signed, any tampering with the file (e.g., replacing it with a malicious version) would invalidate the signature. This allows systems to verify the origin and integrity of binaries before execution, preventing the execution of unauthorized or compromised binaries.
Implementing digital signatures: This ensures that only valid, untampered binaries are executed, preventing attackers from substituting legitimate binaries with malicious ones.
NEW QUESTION # 67 
An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.
Answer:
Explanation:
Explanation:
A computer screen shot of a diagram Description automatically generated
A screenshot of a computer error Description automatically generated
NEW QUESTION # 68
An analyst reviews a SIEM and generates the following report:
OnlyHOST002is authorized for internet traffic. Which of the following statements is accurate?
- A. The VM002 host is misconfigured and needs to be revised by the network team.
- B. The SIEM platform is reporting multiple false positives on the alerts.
- C. The HOST002 host is under attack, and a security incident should be declared.
- D. The network connection activity is unusual, and a network infection is highly possible.
Answer: D
Explanation:
Understanding the Security Event:
HOST002 is the only device authorized for internet traffic. However, theSIEM logs show that VM002 is making network connections to web.corp.local.
This indicatesunauthorized access, which could bea sign of lateral movement or network infection.
This is ared flagfor potential malware, unauthorized software, or a compromised host.
Why Option D is Correct:
Unusual network traffic patternsare often an indicator of acompromised system.
VM002 should not be communicating externally, but it is.
This suggests a possiblebreach or malware infectionattempting to communicate with a command-and-control (C2) server.
Why Other Options Are Incorrect:
A (Misconfiguration):While a misconfiguration could explain the unauthorized connections, the pattern of activity suggests something more malicious.
B (Security incident on HOST002):The issue is not with HOST002. The suspicious activity isfrom VM002.
C (False positives):The repeated pattern of unauthorized connections makes false positivesunlikely.
Reference:
CompTIASecurityX CAS-005 Official Study Guide:Chapter on SIEM & Incident Analysis MITRE ATT&CK Tactics:Lateral Movement & Network-based Attacks NIST 800-94:Guidelines for Network Intrusion Detection and Analysis
NEW QUESTION # 69
A building camera is remotely accessed and disabled from the remote console application during off-hours. A security analyst reviews the following logs:
Which of the following actions should the analyst take to best mitigate the threat?
- A. Only allowconnections from approved IPs.
- B. Implement WAF protection for the web application.
- C. Block IP 104.18.16.29 on the firewall.
- D. Upgrade the firmware on the camera.
Answer: A
Explanation:
The logs indicate unauthorized access from104.18.16.29, an external IP, to the building camera's administrative console during off-hours.Restricting access only to approved IPsensures that only authorized personnel can remotely control the cameras, reducing the risk of unauthorized access and manipulation.
* Implementing WAF protection (A)secures against web application attacks but does not restrict unauthorized administrative access.
* Upgrading the firmware (B)is good security hygiene but does not immediately mitigate the active threat.
* Blocking IP 104.18.16.29 (D)is a temporary measure, as an attacker can switch to another IP. A better long-term solution is whitelisting trusted IPs.
Reference:CompTIA SecurityX (CAS-005) Exam Objectives- Domain 4.0 (Security Operations), Section onAccess Control and Network Security
NEW QUESTION # 70
A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware static of a domain controller The forensic team cryptographically validated that com the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LOAP Which of the following is me best way to reduce the risk oi reoccurrence?
- A. Using code signing to verify the source of OS updates
- B. Measuring and attesting to the entire boot chum
- C. Enforcing allow lists for authorized network pons and protocols
- D. Rolling the cryptographic keys used for hardware security modules
Answer: A
Explanation:
The scenario describes a sophisticated attack where the threat actor used steganography within LDAP to exfiltrate data. Given that thehardware and OS firmware were validated and found uncompromised, the attack vector likely exploited a network communication channel. To mitigate such risks, enforcing allow lists for authorized network ports and protocols is the most effective strategy.
Here's why this option is optimal:
Port and Protocol Restrictions: By creating an allow list, the organization can restrict communications to only those ports and protocols that are necessary for legitimate business operations. This reduces the attack surface by preventing unauthorized or unusual traffic.
Network Segmentation: Enforcing such rules helps in segmenting the network and ensuring that only approved communications occur, which is critical in preventing data exfiltration methods like steganography.
Preventing Unauthorized Access: Allow lists ensure that only predefined, trusted connections are allowed, blocking potential paths that attackers could use to infiltrate or exfiltrate data.
Other options, while beneficial in different contexts, are not directly addressing the network communication threat:
B). Measuring and attesting to the entire boot chain: While this improves system integrity, it doesn't directly mitigate the risk of data exfiltration through network channels.
C). Rolling thecryptographic keys used for hardware security modules: This is useful for securing data and communications but doesn't directly address the specific method of exfiltration described.
D). Using code signing to verify the source of OS updates: Ensures updates are from legitimate sources, but it doesn't mitigate the risk of network-based data exfiltration.
References:
CompTIA SecurityX Study Guide
NIST Special Publication 800-41, "Guidelines on Firewalls and Firewall Policy" CIS Controls Version 8, Control 9: Limitation and Control of Network Ports, Protocols, and Services
NEW QUESTION # 71
A security engineer must resolve a vulnerability in a deprecated version of Python for a custom-developed flight simulation application that is monitored and controlled remotely. The source code is proprietary and built with Python functions running on the Ubuntu operating system. Version control is not enabled for the application in development or production. However, the application must remain online in the production environment using built-in features. Which of the following solutions best reduces the attack surface of these issues and meets the outlined requirements?
- A. Configure version designation within the Python interpreter. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- B. Configure code-signing within the CI/CD pipeline, update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- C. Enable branch protection in the GitHub repository. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- D. Use an NFS network share. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
Answer: B
Explanation:
Code-signing within the CI/CD pipeline ensures that only verified and signed code is deployed, mitigating the risk of supply chain attacks. Updating Python with aptitude and updating modules with pip ensures vulnerabilities are patched. Deploying the solution to production after testing maintains application availability while securing the development lifecycle.
Branch protection (B) applies only to version-controlled environments, which is not the case here.
NFS network share (C) does not address the deprecated Python vulnerability.
Version designation (D) does not eliminate security risks from outdated dependencies.
NEW QUESTION # 72
After a company discovered a zero-day vulnerability in its VPN solution, the company plans to deploy cloud- hosted resources to replace its current on-premises systems. An engineer must find an appropriate solution to facilitate trusted connectivity. Which of the following capabilities is the most relevant?
- A. Conditional access
- B. Container orchestration
- C. Secure access service edge (SASE)
- D. Microsegmentation
Answer: A
Explanation:
Conditional access is the most relevant capability for ensuring trusted connectivity to cloud-hosted resources after a VPN solution is found to be vulnerable. Conditional access enforces security policies based on user identity, device status, location, and risk level before granting access to cloud applications. This helps mitigate risks posed by compromised VPNs and ensures that only trusted users and devices can access critical resources.
* Container orchestration (A) is used for managing containers in a cloud environment but does not address secure access for users.
* Microsegmentation (B) helps in isolating workloads within the cloud or network but does not control external access.
* Secure access service edge (SASE) (D) is a broader security architecture that integrates SD-WAN and cloud security, but conditional access specifically ensures policy-based authentication and authorization, which is critical in replacing a compromised VPN.
NEW QUESTION # 73
A building camera is remotely accessed and disabled from the remote console application during off-hours. A security analyst reviews the following logs:
Which of the following actions should the analyst take to best mitigate the threat?
- A. Only allow connections from approved IPs.
- B. Implement WAF protection for the web application.
- C. Block IP 104.18.16.29 on the firewall.
- D. Upgrade the firmware on the camera.
Answer: A
Explanation:
The logs indicate unauthorized access from 104.18.16.29, an external IP, to the building camera's administrative console during off-hours. Restricting access only to approved IPs ensures that only authorized personnel can remotely control the cameras, reducing the risk of unauthorized access and manipulation.
Implementing WAF protection (A) secures against web application attacks but does not restrict unauthorized administrative access.
Upgrading the firmware (B) is good security hygiene but does not immediately mitigate the active threat.
Blocking IP 104.18.16.29 (D) is a temporary measure, as an attacker can switch to another IP. A better long-term solution is whitelisting trusted IPs.
NEW QUESTION # 74
Which of the following AI concerns is most adequately addressed by input sanitation?
- A. Data poisoning
- B. Non-explainable model
- C. Model inversion
- D. Prompt Injection
Answer: D
Explanation:
Input sanitation is a critical process in cybersecurity that involves validating and cleaning data provided by users to prevent malicious inputs from causing harm.
Input sanitation is most relevant and effective for preventing Prompt Injection attacks, where the integrity of user inputs directly impacts the performance and security of AI models.
NEW QUESTION # 75
Asecuntv administrator is performing a gap assessment against a specific OS benchmark The benchmark requires the following configurations be applied to endpomts:
* Full disk encryption
* Host-based firewall
* Time synchronization
* Password policies
* Application allow listing
* Zero Trust application access
Which of the following solutions best addresses the requirements? (Select two).
- A. SASE
- B. HIDS
- C. CASB
- D. SCAP
- E. SBoM
Answer: A,D
Explanation:
To address the specific OS benchmark configurations, the following solutions are most appropriate:
C: SCAP (Security Content Automation Protocol): SCAP helps in automating vulnerability management and policy compliance, including configurations like full disk encryption, host-based firewalls, and password policies.
D: SASE (Secure Access Service Edge): SASE provides a framework for Zero Trust network access and application allow listing, ensuring secure and compliant access to applications and data.
These solutions together cover the comprehensive security requirements specified in the OS benchmark, ensuring a robust security posture for endpoints.
References:
CompTIA SecurityX Study Guide: Discusses SCAP and SASE as part of security configuration management and Zero Trust architectures.
NIST Special Publication 800-126, "The Technical Specification for the Security Content Automation Protocol (SCAP)": Details SCAP's role in security automation.
"Zero Trust Networks: Building Secure Systems in Untrusted Networks" by Evan Gilman and Doug Barth:
Covers the principles of Zero Trust and how SASE can implement them.
By implementing SCAP and SASE, the organization ensures that all the specified security configurations are applied and maintained effectively.
NEW QUESTION # 76
A company wants to invest in research capabilities with the goal to operationalize the research output. Which of the following is the best option for a security architect to recommend?
- A. Honeypots
- B. Dark web monitoring
- C. Threat intelligence platform
- D. Continuous adversary emulation
Answer: C
Explanation:
Investing in a threat intelligence platform is the best option for a company looking to operationalize research output. A threat intelligence platform helps in collecting, processing, and analyzing threat data to provide actionable insights. These platforms integrate data from various sources, including dark web monitoring, honeypots, and other security tools, to offer a comprehensive view of the threat landscape.
Why a Threat Intelligence Platform?
Data Integration: It consolidates data from multiple sources, including dark web monitoring and honeypots, making it easier to analyze and derive actionable insights.
Actionable Insights: Provides real-time alerts and reports on potential threats, helping the organization take proactive measures.
Operational Efficiency: Streamlines the process of threat detection and response, allowing the security team to focus on critical issues.
Research and Development: Facilitates the operationalization of research output by providing a platform for continuous monitoring and analysis of emerging threats.
Other options, while valuable, do not offer the same level of integration and operationalization capabilities:
A: Dark web monitoring: Useful for specific threat intelligence but lacks comprehensive operationalization.
C: Honeypots: Effective for detecting and analyzing specific attack vectors but not for broader threat intelligence.
D: Continuous adversary emulation: Important for testing defenses but not for integrating and operationalizing threat intelligence.
NEW QUESTION # 77
A company receives reports about misconfigurations and vulnerabilities in a third-party hardware device that is part of its released products. Which of the following solutions is the best way for the company to identify possible issues at an earlier stage?
- A. Performing vulnerability tests on each device delivered by the providers
- B. Implementing a proper supply chain risk management program
- C. Implementing a monitoring process for the integration between the application and the vendor appliance
- D. Performing regular red-team exercises on the vendor production line
Answer: B
Explanation:
Addressing misconfigurations and vulnerabilities in third-party hardware requires a comprehensive approach to manage risks throughout the supply chain. Implementing a proper supply chain risk management (SCRM) program is the most effective solution as it encompasses the following:
* Holistic Approach: SCRM considers the entire lifecycle of the product, from initial design through to delivery and deployment. This ensures that risks are identified and managed at every stage.
* Vendor Management: It includes thorough vetting of suppliers and ongoing assessments of their security practices, which can identify and mitigate vulnerabilities early.
* Regular Audits and Assessments: A robust SCRM program involves regular audits and assessments, both internally and with suppliers, to ensure compliance with security standards and best practices.
* Collaboration and Communication: Ensures that there is effective communication and collaboration between the company and its suppliers, leading to faster identification and resolution of issues.
Other options, while beneficial, do not provide the same comprehensive risk management:
* A. Performing vulnerability tests on each device delivered by the providers: While useful, this is reactive and only addresses issues after they have been delivered.
* B. Performing regular red-team exercises on the vendor production line: This can identify vulnerabilities but is not as comprehensive as a full SCRM program.
* C. Implementing a monitoring process for the integration between the application and the vendor appliance: This is important but only covers the integration phase, not the entire supply chain.
References:
* CompTIA SecurityX Study Guide
* NIST Special Publication 800-161, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations"
* ISO/IEC 27036-1:2014, "Information technology - Security techniques - Information security for supplier relationships"
NEW QUESTION # 78
A Chief Information Security Officer (CISO) is concerned that a company's current data disposal procedures could result in data remanence. The company uses only SSDs. Which of the following would be the most secure way to dispose of the SSDs given the CISO's concern?
- A. Overwriting
- B. Shredding
- C. Degaussing
- D. Formatting
- E. Incinerating
Answer: E
Explanation:
For SSDs,incinerationis considered the most secure method of physical destruction, ensuring no data remanence. SSDs store data differently compared to traditional spinning disks, making degaussing ineffective.
Overwriting and formatting may not reliably erase all storage cells due to wear-leveling technologies.
Shredding may work if the granularity is extremely fine, but incineration guarantees complete destruction beyond recovery.
Reference:CompTIA SecurityX CAS-005, Domain 2.0: Apply secure media sanitization methods appropriate for device types such as SSDs.
NEW QUESTION # 79
A vulnerability can on a web server identified the following:
Which of the following actions would most likely eliminate on path decryption attacks? (Select two).
- A. Restricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA
- B. Disallowing cipher suites that use ephemeral modes of operation for key agreement
- C. Adding TLS_ECDHE_ECDSA_WITH_AE3_256_GCMS_HA256
- D. Removing support for CBC-based key exchange and signing algorithms
- E. Implementing HIPS rules to identify and block BEAST attack attempts
- F. Increasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA
Answer: C,D
Explanation:
On-path decryption attacks, such as BEAST (Browser Exploit Against SSL/TLS) and other related vulnerabilities, often exploit weaknesses in the implementation of CBC (Cipher Block Chaining) mode. To mitigate these attacks, the following actions are recommended:
* B. Removing support for CBC-based key exchange and signing algorithms: CBC mode is vulnerable to certain attacks like BEAST. By removing support for CBC-based ciphers, you can eliminate one of the primary vectors for these attacks. Instead, use modern cipher modes like GCM (Galois/Counter Mode) which offer better security properties.
* C. Adding TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA256: This cipher suite uses Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) for key exchange, which provides perfect forward secrecy.
It also uses AES in GCM mode, which is not susceptible to the same attacks as CBC. SHA-256 is a strong hash function that ensures data integrity.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-52 Rev. 2, "Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations"
* OWASP (Open Web Application Security Project) guidelines on cryptography and secure communication
NEW QUESTION # 80
During a gap assessment, an organization notes that OYOD usage is a significant risk. The organization implemented administrative policies prohibiting BYOD usage However, the organization has not implemented technical controls to prevent the unauthorized use of BYOD assets when accessing the organization's resources.
Which of the following solutions should the organization implement to reduce the risk of BYOD devices? (Select two).
- A. Cloud 1AM to enforce the use of token based MFA
- B. NAC, to enforce device configuration requirements
- C. PAM. to enforce local password policies
- D. DLP, to enforce data protection capabilities
- E. Conditional access, to enforce user-to-device binding
- F. SD-WAN. to enforce web content filtering through external proxies
Answer: B,E
Explanation:
To reduce the risk of unauthorized BYOD (Bring Your Own Device) usage, the organization should implement Conditional Access and Network Access Control (NAC).
Why Conditional Access and NAC?
Conditional Access:
User-to-Device Binding: Conditional access policies can enforce that only registered and compliant devices are allowed to access corporate resources.
Context-Aware Security: Enforces access controls based on the context of the access attempt, such as user identity, device compliance, location, and more.
Network Access Control (NAC):
Device Configuration Requirements: NAC ensures that only devices meeting specific security configurations are allowed to connect to the network.
Access Control: Provides granular control over network access, ensuring that BYOD devices comply with security policies before gaining access.
Other options, while useful, do not address the specific need to control and secure BYOD devices effectively:
A: Cloud IAM to enforce token-based MFA: Enhances authentication security but does not control device compliance.
D: PAM to enforce local password policies: Focuses on privileged account management, not BYOD control.
E: SD-WAN to enforce web content filtering: Enhances network performance and security but does not enforce BYOD device compliance.
F: DLP to enforce data protection capabilities: Protects data but does not control BYOD device access and compliance.
References:
CompTIA SecurityX Study Guide
"Conditional Access Policies," Microsoft Documentation
"Network Access Control (NAC)," Cisco Documentation
NEW QUESTION # 81
......
Latest 100% Passing Guarantee - Brilliant CAS-005 Exam Questions PDF: https://passleader.testkingpdf.com/CAS-005-testking-pdf-torrent.html
