CompTIA CAS-005 Dumps – 100% Cover Real Exam Questions (Updated 329 Questions) [Q186-Q200]

Rate this post

CompTIA CAS-005 Dumps – 100% Cover Real Exam Questions (Updated 329 Questions)

Real CAS-005 dumps – Real CompTIA dumps PDF

Q186. During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.
INSTRUCTIONS
Review each of the events and select the appropriate analysis and remediation options for each IoC.

Q187. A systems administrator wants to reduce the number of failed patch deployments in an organization. The administrator discovers that system owners modify systems or applications in an ad hoc manner. Which of the following is the best way to reduce the number of failed patch deployments?

Compliance tracking

Situational awareness

Change management

Quality assurance

Q188. A company wants to invest in research capabilities with the goal to operationalize the research output. Which of the following is the best option for a security architect to recommend?

Dark web monitoring

Threat intelligence platform

Honeypots

Continuous adversary emulation

Q189. A security engineer discovers that some legacy systems are still in use or were not properly decommissioned. After further investigation, the engineer identifies that an unknown and potentially malicious server is also sending emails on behalf of the company. The security engineer extracts the following data for review:

Which of the following actions should the security engineer take next? (Select two).

Rotate the DKIM selector to use another key.

Change the DMARC policy to reject and remove Reference to the server.

Remove the unnecessary servers from the SPF record.

Change the SPF record to enforce the hard fail parameter.

Update the MX record to contain only the primary email server.

Change the DMARC policy to none and monitor email flow to establish a new baseline.

Q190. A security manager at a local hospital wants to secure patient medical records. The manager needs to:
* Choose an access control model that clearly defines who has access to sensitive information.
* Prevent those who enter new patient information from specifying who has access to this data.
Which of the following access control models is the best way to ensure the lowest risk of granting unintentional access?

Rule-based

Attribute-based

Mandatory

Discretionary

Q191. A systems administrator needs to identify new attacks that could be carried out against the environment. The administrator plans to proactively seek out and observe new attacks. Which of the following is the best way to accomplish this goal?

Configuring an IPS

Implementing sandboxing

Scanning for IoCs

Deploying a honeypot

Q192. SIMULATION
During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.
INSTRUCTIONS
Review each of the events and select the appropriate analysis and remediation options for each IoC.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Q193. Users are experiencing a variety of issues when trying to access corporate resources examples include
* Connectivity issues between local computers and file servers within branch offices
* Inability to download corporate applications on mobile endpoints wtiilc working remotely
* Certificate errors when accessing internal web applications
Which of the following actions are the most relevant when troubleshooting the reported issues? (Select two).

Review VPN throughput

Check IPS rules

Restore static content on lite CDN.

Enable secure authentication using NAC

Implement advanced WAF rules.

Validate MDM asset compliance

Q194. A global company with a remote workforce implemented a new VPN solution. After deploying the VPN solution to several hundred users, the help desk starts receiving reports of slow access to both internally and externally available applications. A security analyst reviews the following:
VPN client routing: 0.0.0.0/0 → eth1
Which of the following solutions should the analyst use to fix this issue?

Move the servers to a screened subnet.

Enable split tunneling.

Configure an NAC solution.

Implement DNS over HTTPS.

Q195. A global organization is reviewing potential vendors to outsource a critical payroll function. Each vendor’s plan includes using local resources in multiple regions to ensure compliance with all regulations. The organization’s Chief Information Security Officer is conducting a risk assessment on the potential outsourcing vendors’ subprocessors. Which of the following best explains the need for this risk assessment?

Risk mitigations must be more comprehensive than the existing payroll provider.

Due care must be exercised during all procurement activities.

The responsibility of protecting PII remains with the organization.

Specific regulatory requirements must be met in each jurisdiction.

Q196.

An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.

Q197. A company has a requirement in customer contracts that states applications must undergo external audits to identify vulnerabilities. Which of the following is the best action for the company to complete before hiring an external auditor?

Gather evidence for the audit.

Conduct an internal audit assessment.

Identify lessons learned from the audit.

Select samples for audit testing.

Q198. To prevent data breaches, security leaders at a company decide to expand user education to:
* Create a healthy security culture.
* Comply with regulatory requirements.
* Improve incident reporting.
Which of the following would best meet their objective?

Performing a DoS attack

Scheduling regular penetration tests

Simulating a phishing campaign

Deploying fake ransomware

Q199. Embedded malware has been discovered in a popular PDF reader application and is currently being exploited in the wild. Because the supply chain was compromised, this malware is present in versions 10.0 through 10.3 of the software’s official versions. The malware is not present in version 10.4.
Since the details around this malware are still emerging, the Chief Information Security Officer has asked the senior security analyst to collaborate with the IT asset inventory manager to find instances of the installed software in order to begin response activities. The asset inventory manager has asked an analyst to provide a regular expression that will identify the affected versions. The software installation entries are formatted as follows:
Reader 10.0
Reader 10.1
Reader 10.2
Reader 10.3
Reader 10.4
Which of the following regular expression entries will accurately identify all the affected versions?

Reader(*)[1][0].[0-4:

Reader[11[01X.f0-3′

Reader( )[1][0].[0-3:

Reader( )[1][0] X.[1-3:

Q200. A security analyst wants to use lessons learned from a poor incident response to reduce dwell lime in the future The analyst is using the following data points

Which of the following would the analyst most likely recommend?

Adjusting the SIEM to alert on attempts to visit phishing sites

Allowing TRACE method traffic to enable better log correlation

Enabling alerting on all suspicious administrator behavior

utilizing allow lists on the WAF for all users using GFT methods

In the context of improving incident response and reducing dwell time, the security analyst needs to focus on proactive measures that can quickly detect and alert on potential security breaches. Here’s a detailed analysis of the options provided:
A). Adjusting the SIEM to alert on attempts to visit phishing sites: While this is a useful measure to prevent phishing attacks, it primarily addresses external threats and doesn’t directly impact dwell time reduction, which focuses on the time a threat remains undetected within a network.
B). Allowing TRACE method traffic to enable better log correlation: The TRACE method in HTTP is used for debugging purposes, but enabling it can introduce security vulnerabilities. It’s not typically recommended for enhancing security monitoring or incident response.
C). Enabling alerting on all suspicious administrator behavior: This option directly targets the potential misuse of administrator accounts, which are often high-value targets for attackers. By monitoring and alerting on suspicious activities from admin accounts, the organization can quickly identify and respond to potential breaches, thereby reducing dwell time significantly. Suspicious behavior could include unusual login times, access to sensitive data not usually accessed by the admin, or any deviation from normal behavior patterns.
This proactive monitoring is crucial for quick detection and response, aligning well with best practices in incident response.
D). Utilizing allow lists on the WAF for all users using GET methods: This measure is aimed at restricting access based on allowed lists, which can be effective in preventing unauthorized access but doesn’t specifically address the need for quick detection and response to internal threats.
References:
CompTIA SecurityX Study Guide: Emphasizes the importance of monitoring and alerting on admin activities as part of a robust incident response plan.
NIST Special Publication 800-61 Revision 2,”Computer Security Incident Handling Guide”: Highlights best practices for incident response, including the importance of detecting and responding to suspicious activities quickly.
“Incident Response & Computer Forensics” by Jason T. Luttgens, Matthew Pepe, and Kevin Mandia:
Discusses techniques for reducing dwell time through effective monitoring and alerting mechanisms, particularly focusing on privileged account activities.
By focusing on enabling alerting for suspicious administrator behavior, the security analyst addresses a critical area that can help reduce the time a threat goes undetected, thereby improving the overall security posture of the organization.
Top of Form
Bottom of Form

CompTIA CAS-005 Exam Syllabus Topics:

Topic	Details
Topic 1	Security Architecture: This domain focuses on analyzing requirements to design resilient systems, including the configuration of firewalls and intrusion detection systems.
Topic 2	Governance, Risk, and Compliance: This section of the exam measures the skills of CompTIA security architects that cover the implementation of governance components based on organizational security requirements, including developing policies, procedures, and standards. Candidates will learn about managing security programs, including awareness training on phishing and social engineering.
Topic 3	Security Engineering: This section measures the skills of CompTIA security architects that involve troubleshooting common issues related to identity and access management (IAM) components within an enterprise environment. Candidates will analyze requirements to enhance endpoint and server security while implementing hardware security technologies. This domain also emphasizes the importance of advanced cryptographic concepts in securing systems.
Topic 4	Security Operations: This domain is designed for CompTIA security architects and covers analyzing data to support monitoring and response activities, as well as assessing vulnerabilities and recommending solutions to reduce attack surfaces. Candidates will apply threat-hunting techniques and utilize threat intelligence concepts to enhance operational security.