New CompTIA SecurityX CAS-005 Exam Dumps (V8.02) – Brilliant CompTIA CAS-005 Exam Questions for Proven Exam Success

1. A security analyst discovered requests associated with IP addresses known for born legitimate 3nd bot-related traffic .

Which of the following should the analyst use to determine whether the requests are malicious?

2. A user reports application access issues to the help desk.

The help desk reviews the logs for the user

Which of the following is most likely The reason for the issue?

3. A company wants to invest in research capabilities with the goal to operationalize the research output .

Which of the following is the best option for a security architect to recommend?

A. Dark web monitoring

B. Threat intelligence platform

C. Honeypots

D. Continuous adversary emulation

4. A security configure is building a solution to disable weak CBC configuration for remote access connections lo Linux systems .

Which of the following should the security engineer modify?

5. A software company deployed a new application based on its internal code repository Several customers are reporting anti-malware alerts on workstations used to test the application.

Which of the following is the most likely cause of the alerts?

A. Misconfigured code commit

B. Unsecure bundled libraries

C. Invalid code signing certificate

D. Data leakage

6. A security engineer wants to reduce the attack surface of a public-facing containerized application.

Which of the following will best reduce the application's privilege escalation attack surface?

A. Implementing the following commands in the Dockerfile: RUN echo user:x:1000:1000iuser:/home/user:/dew/null > /ete/passwd

B. Installing an EDR on the container's host with reporting configured to log to a centralized SIFM and Implementing the following alerting rules TF PBOCESS_USEB=rooC ALERT_TYPE=critical

C. Designing a muiticontainer solution, with one set of containers that runs the mam application, and another set oi containers that perform automatic remediation by replacing compromised containers or disabling compromised accounts

D. Running the container in an isolated network and placing a load balancer in a public-facing network. Adding the following ACL to the load balancer: PZRKZI HTTES from 0-0.0.0.0/0 pert 443

7. A systems engineer is configuring a system baseline for servers that will provide email services.

As part of the architecture design, the engineer needs to improve performance of the systems by using an access vector cache, facilitating mandatory access control and protecting against:

• Unauthorized reading and modification of data and programs

• Bypassing application security mechanisms

• Privilege escalation

• interference with other processes

Which of the following is the most appropriate for the engineer to deploy?

8. A global manufacturing company has an internal application mat is critical to making products This application cannot be updated and must Be available in the production area A security architect is implementing security for the application .

Which of the following best describes the action the architect should take-?

A. Disallow wireless access to the application.

B. Deploy Intrusion detection capabilities using a network tap

C. Create an acceptable use policy for the use of the application

D. Create a separate network for users who need access to the application

9. The identity and access management team is sending logs to the SIEM for continuous monitoring. The deployed log collector is forwarding logs to the SIEM. However, only false positive alerts are being generated .

Which of the following is the most likely reason for the inaccurate alerts?

10. A company is having issues with its vulnerability management program New devices/lPs are added and dropped regularly, making the vulnerability report inconsistent.

Which of the following actions should the company lake to most likely improve the vulnerability management process?

11. After remote desktop capabilities were deployed in the environment, various vulnerabilities were noticed.

• Exfiltration of intellectual property

• Unencrypted files

• Weak user passwords

Which of the following is the best way to mitigate these vulnerabilities? (Select two).

A. Implementing data loss prevention

B. Deploying file integrity monitoring

C. Restricting access to critical file services only

D. Deploying directory-based group policies

E. Enabling modem authentication that supports MFA

F. Implementing a version control system

G. Implementing a CMDB platform

12. An organization is planning for disaster recovery and continuity of operations.

INSTRUCTIONS

Review the following scenarios and instructions. Match each relevant finding to the affected host.

After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.

Each finding may be used more than once.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

13. A financial services organization is using Al lo fully automate the process of deciding client loan rates.

Which of the following should the organization be most concerned about from a privacy perspective?

14. A security analyst received a report that an internal web page is down after a company-wide update to the web browser Given the following error message:

Which of the following is the b«« way to fix this issue?

A. Rewriting any legacy web functions

B. Disabling all deprecated ciphers

C. Blocking all non-essential pons

D. Discontinuing the use of self-signed certificates

15. An organization is implementing Zero Trust architecture A systems administrator must increase the effectiveness of the organization's context-aware access system .

Which of the following is the best way to improve the effectiveness of the system?

16. A central bank implements strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin .

Which of the following best describes the cyberthreat to the bank?

17. A natural disaster may disrupt operations at Site A, which would then cause unreliable internet connectivity at Site B due to route flapping.

INSTRUCTIONS

Match each relevant finding to the affected host by clicking on the host name and selecting the appropriate number.

For findings 1 and 2, select the items that should be replicated to Site B. For finding 3, select the item requiring configuration changes, then select the appropriate corrective action from the drop-down menu.

See the complete solution below in Explanation:

18. A compliance officer is reviewing the data sovereignty laws in several countries where the organization has no presence.

Which of the following is the most likely reason for reviewing these laws?

A. The organization is performing due diligence of potential tax issues.

B. The organization has been subject to legal proceedings in countries where it has a presence.

C. The organization is concerned with new regulatory enforcement in other countries

D. The organization has suffered brand reputation damage from incorrect media coverage

19. A financial technology firm works collaboratively with business partners in the industry to share threat intelligence within a central platform This collaboration gives partner organizations the ability to obtain and share data associated with emerging threats from a variety of adversaries.

Which of the following should the organization most likely leverage to facilitate this activity? (Select two).

A. CWPP

B. YAKA

C. ATTACK

D. STIX

E. TAXII

F. JTAG

20. A security analyst received a notification from a cloud service provider regarding an attack detected on a web server.

The cloud service provider shared the following information about the attack:

• The attack came from inside the network.

• The attacking source IP was from the internal vulnerability scanners.

• The scanner is not configured to target the cloud servers.

Which of the following actions should the security analyst take first?

A. Create an allow list for the vulnerability scanner IPs m order to avoid false positives

B. Configure the scan policy to avoid targeting an out-of-scope host

C. Set network behavior analysis rules

D. Quarantine the scanner sensor to perform a forensic analysis

21. While reviewing recent modem reports, a security officer discovers that several employees were contacted by the same individual who impersonated a recruiter .

Which of the following best describes this type of correlation?

22. A security architect is establishing requirements to design resilience in un enterprise system trial will be extended to other physical locations.

The system must

• Be survivable to one environmental catastrophe

• Re recoverable within 24 hours of critical loss of availability

• Be resilient to active exploitation of one site-to-site VPN solution

23. During a security assessment using an CDR solution, a security engineer generates the following report about the assets in me system:

After five days, the EDR console reports an infection on the host 0WIN23 by a remote access Trojan.

Which of the following is the most probable cause of the infection?

A. OW1N23 uses a legacy version of Windows that is not supported by the EDR

B. LN002 was not supported by the EDR solution and propagates the RAT

C. The EDR has an unknown vulnerability that was exploited by the attacker.

D. 0W1N29 spreads the malware through other hosts in the network

24. An organization wants to implement a platform to better identify which specific assets are affected by a given vulnerability .

Which of the following components provides the best foundation to achieve this goal?

25. During a gap assessment, an organization notes that OYOD usage is a significant risk. The organization implemented administrative policies prohibiting BYOD usage However, the organization has not implemented technical controls to prevent the unauthorized use of BYOD assets when accessing the organization's resources .

Which of the following solutions should the organization implement to b»« reduce the risk of OYOD devices? (Select two).

A. Cloud 1AM to enforce the use of token based MFA

B. Conditional access, to enforce user-to-device binding

C. NAC, to enforce device configuration requirements

D. PAM. to enforce local password policies

E. SD-WAN. to enforce web content filtering through external proxies

F. DLP, to enforce data protection capabilities

26. You are a security analyst tasked with interpreting an Nmap scan output from company’s privileged network.

The company’s hardening guidelines indicate the following:

There should be one primary server or service per device.

Only default ports should be used.

Non-secure protocols should be disabled.

INSTRUCTIONS

Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed.

For each device found by Nmap, add a device entry to the Devices Discovered list, with the following information:

The IP address of the device

The primary server or service of the device (Note that each IP should by associated with one service/port only)

The protocol(s) that should be disabled based on the hardening guidelines (Note that multiple ports may need to be closed to comply with the hardening guidelines)

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

See explanation below.

27. A security analyst reviews the following report:

Which of the following assessments is the analyst performing?

A. System

B. Supply chain

C. Quantitative

D. Organizational

28. A security architect for a global organization with a distributed workforce recently received funding lo deploy a CASB solution.

Which of the following most likely explains the choice to use a proxy-based CASB?

29. An organization mat performs real-time financial processing is implementing a new backup solution Given the following business requirements?

* The backup solution must reduce the risk for potential backup compromise

* The backup solution must be resilient to a ransomware attack.

* The time to restore from backups is less important than the backup data integrity

* Multiple copies of production data must be maintained

Which of the following backup strategies best meets these requirement?

A. Creating a secondary, immutable storage array and updating it with live data on a continuous basis

B. Utilizing two connected storage arrays and ensuring the arrays constantly sync

C. Enabling remote journaling on the databases to ensure real-time transactions are mirrored

D. Setting up antitempering on the databases to ensure data cannot be changed unintentionally

30. A company wants to use loT devices to manage and monitor thermostats at all facilities The thermostats must receive vendor security updates and limit access to other devices within the organization.

Which of the following best addresses the company's requirements''

31. An audit finding reveals that a legacy platform has not retained loos for more than 30 days The platform has been segmented due to its interoperability with newer technology. As a temporary solution, the IT department changed the log retention to 120 days .

Which of the following should the security engineer do to ensure the logs are being properly retained?

32. A security analyst is reviewing the following log:

Which of the following possible events should the security analyst investigate further?

33. A security analyst is troubleshooting the reason a specific user is having difficulty accessing company resources.

The analyst reviews the following information:

Which of the following is most likely the cause of the issue?

A. The local network access has been configured to bypass MFA requirements.

B. A network geolocation is being misidentified by the authentication server

C. Administrator access from an alternate location is blocked by company policy

D. Several users have not configured their mobile devices to receive OTP codes

34. A software development team requires valid data for internal tests. Company regulations, however do not allow the use of this data in cleartext .

Which of the following solutions best meet these requirements?