Clear your concepts with CAS-005 Questions Before Attempting Real exam
Get professional help from our CAS-005 Dumps PDF
NEW QUESTION # 277
A developer makes a small change to a resource allocation module on a popular social media website and causes a memory leak. During a peak utilization period, several web servers crash, causing the website to go offline. Which of the following testing techniques is the most efficient way to prevent this from reoccurring?
- A. Smoke
- B. Load
- C. Canary
- D. Regression
Answer: D
Explanation:
Comprehensive and Detailed Step-by-Step
Regression testing ensures that new changes do not break existing functionality. It would have identified the memory leak before deployment, preventing downtime.
NEW QUESTION # 278
A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented. In order to meet contractual requirements, the company must achieve the following thresholds:
- 99.99% uptime
- Load time in 3 seconds
- Response time = <1.0 seconds
Starting with the computing environment, which of the following should a security engineer recommend to best meet the requirements? (Choose three.)
- A. Deploying a content delivery network
- B. Employing bare-metal loading of applications
- C. Installing a firewall at corporate headquarters
- D. Lowering storage input/output
- E. Implementing server clusters
- F. Implementing RAID on the backup servers
- G. Utilizing redundant power for all developer workstations
Answer: A,D,E
Explanation:
To meet the high uptime, load time, and response time requirements, the following recommendations would be most effective:
Deploying a content delivery network (CDN): A CDN can distribute content across multiple locations globally, reducing load times by serving content from the nearest edge server to the user.
Implementing server clusters: Server clusters can ensure high availability and load balancing, which is essential for maintaining 99.99% uptime and improving response times during high traffic periods.
Lowering storage input/output (I/O): Reducing storage I/O can improve performance by speeding up data access and enhancing the system's ability to meet load time and response time requirements.
These solutions directly address the performance and availability metrics that are required for the contract. Other options like implementing RAID, using redundant power for workstations, or installing firewalls would not directly contribute to the high availability or performance requirements.
NEW QUESTION # 279
A security officer received several complaints from users about excessive MFA push notifications at night. The security team investigates and suspects malicious activities regarding user account authentication. Which of the following is the best way for the security officer to restrict MFA notifications?
- A. Configuring prompt-driven MFA
- B. Enabling OTP via email
- C. Deploying a text message based on MFA
- D. Provisioning FID02 devices
Answer: A
Explanation:
Prompt-driven MFA means that MFA prompts are triggered only when there is suspicious activity or a specific need for authentication, rather than being sent regularly. This approach would reduce the excessive notifications while still ensuring security, addressing the user's complaints effectively.
NEW QUESTION # 280
During a recent security event, access from the non-production environment to the production environment enabled unauthorized users to:
Install unapproved software
Make unplanned configuration changes
During the investigation, the following findings were identified:
Several new users were added in bulk by the IAM team
Additional firewalls and routers were recently added
Vulnerability assessments have been disabled for more than 30 days
The application allow list has not been modified in two weeks
Logs were unavailable for various types of traffic
Endpoints have not been patched in over ten days
Which of the following actions would most likely need to be taken to ensure proper monitoring? (Select two)
- A. Extend log retention for all security and network devices to 180 days for all traffic
- B. Review the application allow list daily
- C. Ensure all network and security devices are sending relevant data to the SIEM
- D. Routinely update all endpoints and network devices as soon as new patches/hot fixes are available
- E. Disable bulk user creations by the IAM team
- F. Configure firewall rules to only allow production-to-non-production traffic
Answer: C,D,E
Explanation:
Comprehensive and Detailed
Understanding the Security Event:
Unauthorized users gained access from non-production to production.
IAM policies were weak, allowing bulk user creation.
Vulnerability assessments were disabled, and patching was delayed.
Logs were unavailable, making incident response difficult.
Why Options A, D, and E are Correct:
A (Disable bulk user creation by IAM team) → Prevents unauthorized mass user account creation, which could be exploited by attackers.
D (Routine updates for endpoints & network devices) → Patch management ensures vulnerabilities are not left open for attackers.
E (Ensure all security/network devices send logs to SIEM) → Helps with real-time monitoring and detection of unauthorized activities.
Why Other Options Are Incorrect:
B (180-day log retention) → While log retention is good, real-time monitoring is the priority.
C (Review application allow list daily) → Reviewing it daily is impractical. Regular audits are better.
F (Restrict production-to-non-production traffic) → The issue is unauthorized access, not traffic routing.
Reference:
CompTIA SecurityX CAS-005 Official Study Guide: IAM, Patch Management & SIEM Logging Best Practices NIST 800-53 (AC-2, AU-12): Audit Logging & Access Control
NEW QUESTION # 281
An organization mat performs real-time financial processing is implementing a new backup solution Given the following business requirements?
* The backup solution must reduce the risk for potential backup compromise
* The backup solution must be resilient to a ransomware attack.
* The time to restore from backups is less important than the backup data integrity
* Multiple copies of production data must be maintained
Which of the following backup strategies best meets these requirement?
- A. Utilizing two connected storage arrays and ensuring the arrays constantly sync
- B. Enabling remote journaling on the databases to ensure real-time transactions are mirrored
- C. Setting up antitempering on the databases to ensure data cannot be changed unintentionally
- D. Creating a secondary, immutable storage array and updating it with live data on a continuous basis
Answer: D
Explanation:
A: Creating a secondary, immutable storage array and updating it with live data on a continuous basis: An immutable storage array ensures that data, once written, cannot be altered or deleted. This greatly reduces the risk of backup compromise and provides resilience against ransomware attacks, as the ransomware cannot modify or delete the backup data. Maintaining multiple copies of production data with an immutable storage solution ensures data integrity and compliance with the requirement for multiple copies.
Other options:
B: Utilizing two connected storage arrays and ensuring the arrays constantly sync: While this ensures data redundancy, it does not provide protection against ransomware attacks, as both arrays could be compromised simultaneously.
C: Enabling remote journaling on the databases: This ensures real-time transaction mirroring but does not address the requirement for reducing the risk of backup compromise or resilience to ransomware.
D: Setting up anti-tampering on the databases: While this helps ensure data integrity, it does not provide a comprehensive backup solution that meets all the specified requirements.
NEW QUESTION # 282
A financial services organization is using Al lo fully automate the process of deciding client loan rates Which of the following should the organization be most concerned about from a privacy perspective?
- A. Exposure to social engineering
- B. Model explainability
- C. Credential Theft
- D. Possible prompt Injections
Answer: B
Explanation:
When using AI to fully automate the process of deciding client loan rates, the primary concern from a privacy perspective is model explainability.
Why Model Explainability is Critical:
* Transparency: It ensures that the decision-making process of the AI model can be understood and explained to stakeholders, including clients.
* Accountability: Helps in identifying biases and errors in the model, ensuring that the AI is making fair and unbiased decisions.
* Regulatory Compliance: Various regulations require that decisions, especially those affecting individuals' financial status, can be explained and justified.
* Trust: Builds trust among users and stakeholders by demonstrating that the AI decisions are transparent and justifiable.
Other options, such as credential theft, prompt injections, and social engineering, are significant concerns but do not directly address the privacy and fairness implications of automated decision-making.
References:
* CompTIA SecurityX Study Guide
* "The Importance of Explainability in AI," IEEE Xplore
* GDPR Article 22, "Automated Individual Decision-Making, Including Profiling"
NEW QUESTION # 283
A malicious actor exploited firmware vulnerabilities and used rootkits in an attack on an organization. After the organization recovered from the incident, an engineer needs to recommend a solution that reduces the likelihood of the same type of attack in the future. Which of the following is the most relevant solution?
- A. Implementing measured boot
- B. Configuring host-based encryption
- C. Installing self-encrypting drives
- D. Enabling software integrity checks
Answer: A
Explanation:
The best solution to reduce the likelihood of firmware-level attacks and rootkits is to implement measured boot. Measured boot is a hardware-assisted security mechanism that leverages Trusted Platform Module (TPM) and Secure Boot processes. It records cryptographic measurements of each stage of the boot process-from firmware to operating system loaders-and stores them in the TPM. Security software, such as attestation services, can then verify that the system booted into a known, trusted state. If firmware or boot-level code has been tampered with, the measurements will not match expected values, alerting administrators to compromise.
Option A (software integrity checks) validates application-level integrity but does not address firmware rootkits that load before the operating system. Option B (self-encrypting drives) protects data at rest but does not prevent rootkits. Option D (host-based encryption) ensures confidentiality but does not detect or mitigate firmware-level persistence.
NEW QUESTION # 284
A company wants to use loT devices to manage and monitor thermostats at all facilities. The thermostats must receive vendor security updates and limit access to other devices within the organization. Which of the following best addresses the company's requirements?
- A. Only allowing Internet access to a set of specific domains
- B. Configuring IoT devices to always allow automatic updates
- C. Only allowing operation for loT devices during a specified time window
- D. Operating lot devices on a separate network with no access to other devices internally
Answer: D
Explanation:
The best approach for managing and monitoring IoT devices, such as thermostats, is to operate them on a separate network with no access to other internal devices. This segmentation ensures that the IoT devices are isolated from the main network, reducing the risk of potential security breaches affecting other critical systems. Additionally, this setup allows for secure vendor updates without exposing the broader network to potential vulnerabilities inherent in IoT devices.
NEW QUESTION # 285
A security analyst is reviewing suspicious log-in activity and sees the following data in the SICM:
Which of the following is the most appropriate action for the analyst to take?
- A. implement automation to disable accounts that nave been associated with high-risk activity.
- B. Have the admin account owner change their password to avoid credential stuffing.
- C. Update the log configuration settings on the directory server that Is not being captured properly.
- D. Block employees from logging in to applications that are not part of their business area.
Answer: A
Explanation:
The log-in activity indicates a security threat, particularly involving the ADMIN account with a high-risk failure status. This suggests that the account may be targeted by malicious activities such as credential stuffing or brute force attacks.
Updating log configuration settings (A) may help in better logging future activities but does not address the immediate threat.
Changing the admin account password (B) is a good practice but may not fully mitigate the ongoing threat if the account has already been compromised.
Blocking employees (C) from logging into non-business applications might help in reducing attack surfaces but doesn't directly address the compromised account issue.
Implementing automation to disable accounts associated with high-risk activities ensures an immediate response to the detected threat, preventing further unauthorized access and allowing time for thorough investigation and remediation.
Reference:
CompTIA SecurityX guide on incident response and account management.
Best practices for handling compromised accounts.
Automation tools and techniques for security operations centers (SOCs).
NEW QUESTION # 286
Which of the following security features do email signatures provide?
- A. Body encryption
- B. Non-repudiation
- C. Code signing
- D. Sender authentication
- E. Chain of custody
Answer: B
Explanation:
Email signatures, often implemented using digital signatures, provide non-repudiation by verifying the identity of the sender and ensuring that the email has not been tampered with during transit. Non-repudiation means the sender cannot deny having sent the email because the digital signature is uniquely tied to the sender's private key.
NEW QUESTION # 287
A user tried to access a web page at http://10.1.1.1. Previously the web page did not require authentication, and now the browser is prompting for credentials. Which of the following actions would best prevent the issue from reoccurring and reduce the likelihood of credential exposure?
- A. Implementing 802.1x EAP-TTLS on access points to reduce the risk of evil twins
- B. Transitioning internal services to use DNS security
- C. Installing new rules for the IDS to detect impersonation attacks
- D. Modifying web server configuration and utilizing X509 certificates for authentication
Answer: D
Explanation:
Using X.509 certificates for authentication with HTTPS encrypts credentials in transit and provides server identity verification. In SecurityX CAS-005 objectives, securing internal web services with TLS and mutual authentication is a primary method to reduce credential interception or reuse.
802.1X EAP-TTLS is for network access control, not web authentication.
DNS security (DNSSEC) ensures DNS integrity, not web session encryption.
IDS rules help detect, but not prevent, credential exposure.
NEW QUESTION # 288
A company's SIEM is continuously reporting false positives and false negatives. The security operations team has implemented configuration changes to troubleshoot possible reporting errors. Which of the following sources of information best supports the required analysis process?
(Choose two.)
- A. Network traffic summaries
- B. Alert failures
- C. Trends
- D. Third-party reports and logs
- E. Dashboards
- F. Manual review processes
Answer: B,C
Explanation:
The best sources of information to support the analysis process for troubleshooting false positives and false negatives in a SIEM are:
Trends - Analyzing trends helps identify patterns in alerts, such as recurring false positives or missed detections (false negatives), allowing the team to adjust rules or thresholds accordingly.
Alert failures - Reviewing alert failures (e.g., missed detections or incorrect alerts) provides direct insight into why the SIEM is generating false positives or negatives, helping refine detection logic.
NEW QUESTION # 289
During a vulnerability assessment, a scan reveals the following finding:
Windows Server 2016 Missing hotfix KB87728 - CVSS 3.1 Score: 8.1 [High] - Affected host 172.16.15.2 Later in the review process, the remediation team marks the finding as a false positive. Which of the following is the best way to avoid this issue on future scans?
- A. Configuring the sensor with an advanced policy for fingerprinting servers
- B. Performing an authenticated scan on the servers
- C. Getting an up-to-date list of assets from the CMDB
- D. Coordinating the scan execution with the remediation team early in the process
Answer: B
Explanation:
Authenticated scans allow the scanner to verify installed patches and configurations, reducing false positives.
Other options:
A (CMDB updates) improve asset tracking but do not validate patch installations.
C (Advanced fingerprinting) improves accuracy but does not replace authentication.
D (Coordination with teams) is good practice but does not prevent false positives.
NEW QUESTION # 290
Operational technology often relies upon aging command, control, and telemetry subsystems that were created with the design assumption of:
- A. operating in an isolated/disconnected system.
- B. anticipated eavesdropping from malicious actors.
- C. untrustworthy users and systems being present.
- D. communicating over distributed environments
- E. an available EtherneVIP network stack for flexibility.
Answer: A
Explanation:
Comprehensive and Detailed Step by Step Explanation:
* Understanding the Scenario: The question focuses on the historical design assumptions behind older operational technology (OT) systems, particularly in the context of command, control, and telemetry.
* Analyzing the Answer Choices:
* A. operating in an isolated/disconnected system: This is the most accurate assumption for many legacy OT systems. Historically, these systems were designed to operate in air-gapped environments, completely isolated from external networks (including the internet).
NEW QUESTION # 291
A company that uses containers to run its applications is required to identify vulnerabilities on every container image in a private repository. The security team needs to be able to quickly evaluate whether to respond to a given vulnerability. Which of the following will allow the security team to achieve the objective with the least effort?
- A. CIS benchmark compliance reports
- B. SAST scan reports
- C. Centralized SBoM
- D. Credentialed vulnerability scan
Answer: C
Explanation:
A centralized Software Bill of Materials (SBoM) is the best solution for identifying vulnerabilities in container images in a private repository. An SBoM provides a comprehensive inventory of all components, dependencies, and their versions within a container image, facilitating quick evaluation and response to vulnerabilities.
Why Centralized SBoM?
Comprehensive Inventory: An SBoM lists all software components, including their versions and dependencies, allowing for thorough vulnerability assessments.
Quick Identification: Centralizing SBoM data enables rapid identification of affected containers when a vulnerability is disclosed.
Automation: SBoMs can be integrated into automated tools for continuous monitoring and alerting of vulnerabilities.
Regulatory Compliance: Helps in meeting compliance requirements by providing a clear and auditable record of all software components used.
NEW QUESTION # 292
After an incident occurred, a team reported during the lessons-learned review that the team.
* Lost important Information for further analysis.
* Did not utilize the chain of communication
* Did not follow the right steps for a proper response
Which of the following solutions is the best way to address these findinds?
- A. Requiring professional incident response certifications tor each new team member
- B. Requesting budget for better forensic tools to Improve technical capabilities for Incident response operations
- C. Publishing the incident response policy and enforcing it as part of the security awareness program
- D. Building playbooks for different scenarios and performing regular table-top exercises
Answer: D
Explanation:
Building playbooks for different scenarios and performing regular table-top exercises directly addresses the issues identified in the lessons-learned review. Here's why:
* Lost important information for further analysis: Playbooks outline step-by-step procedures for incident response, ensuring that team members know exactly what to document and how to preserve evidence.
* Did not utilize the chain of communication: Playbooks include communication protocols, specifying who to notify and when. Regular table-top exercises reinforce these communication channels, ensuring they are followed during actual incidents.
* Did not follow the right steps for a proper response: Playbooks provide a clear sequence of actions to be taken during various types of incidents, helping the team to respond in a structured and effective manner. Regular exercises allow the team to practice these steps, identifying and correcting any deviations from the plan.
Investing in better forensic tools (Option A) or requiring certifications (Option C) are also valuable, but they do not directly address the procedural and communication gaps identified. Publishing and enforcing the incident response policy (Option D) is important but not as practical and hands-on as playbooks and exercises in ensuring the team is prepared.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-61 Rev. 2, "Computer Security Incident Handling Guide"
* SANS Institute, "Incident Handler's Handbook"
NEW QUESTION # 293
A threat hunter is identifying potentially malicious activity associated with an APT. When the threat hunter runs queries against the SIEM platform with a date range of 60 to 90 days ago, the involved account seems to be typically most active in the evenings. When the threat hunter reruns the same query with a date range of 5 to 30 days ago, the account appears to be most active in the early morning. Which of the following techniques is the threat hunter using to better understand the data?
- A. OSINT analysis activities
- B. Adversary emulation
- C. TTP-based inquiries
- D. User behavior analytics
Answer: D
Explanation:
User behavior analytics (UBA) detects anomalous activity by analyzing historical patterns and comparing them to recent behavior. The time shift in account activity suggests potential compromise or misuse.
* TTP-based inquiries (A) focus on known attack tactics, techniques, and procedures but do not involve behavior tracking.
* Adversary emulation (C) simulates attacks but does not analyze real data trends.
* OSINT analysis (D) gathers intelligence from public sources, which is unrelated to internal account behavior analysis.
NEW QUESTION # 294
After an incident response exercise, a security administrator reviews the following table:
Which of the following should the administrator do to beat support rapid incident response in the future?
- A. Send emails for failed log-In attempts on the public website
- B. Configure automated Isolation of human resources systems
- C. Automate alerting to IT support for phone system outages.
- D. Enable dashboards for service status monitoring
Answer: D
Explanation:
Enabling dashboards for service status monitoring is the best action to support rapid incident response. The table shows various services with different risk, criticality, and alert severity ratings. To ensure timely and effective incident response, real-time visibility into the status of these services is crucial.
Why Dashboards for Service Status Monitoring?
Real-time Visibility: Dashboards provide an at-a-glance view of the current status of all critical services, enabling rapid detection of issues.
CentralizedMonitoring: A single platform to monitor the status of multiple services helps streamline incident response efforts.
Proactive Alerting: Dashboards can be configured to show alerts and anomalies immediately, ensuring that incidents are addressed as soon as they arise.
Improved Decision Making: Real-time data helps incident response teams make informed decisions quickly, reducing downtime and mitigating impact.
Other options, while useful, do not offer the same level of comprehensive, real-time visibility and proactive alerting:
A . Automate alerting to IT support for phone system outages: This addresses one service but does not provide a holistic view.
C . Send emails for failed log-in attempts on the public website: This is a specific alert for one type of issue and does not cover all services.
D . Configure automated isolation of human resources systems: This is a reactive measure for a specific service and does not provide real-time status monitoring.
Reference:
CompTIA SecurityX Study Guide
NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide"
"Best Practices for Implementing Dashboards," Gartner Research
NEW QUESTION # 295
......
Achieve the CAS-005 Exam Best Results with Help from CompTIA Certified Experts: https://www.braindumpquiz.com/CAS-005-exam-material.html
Give You Free Regular Updates on CAS-005 Exam Questions: https://drive.google.com/open?id=11mlW3pEKcprGqlvCM6JBtDwXZ-vroxly