Pass CompTIA CAS-005 Actual Free Exam Q&As Updated Dump Feb 26, 2025
Latest CAS-005 Actual Free Exam Updated 232 Questions
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 112
Third parties notified a company's security team about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries. Which of the following solutions best addresses the reported vulnerabilities?
- A. Creating a bug bounty program
- B. Using laC to include the newest dependencies
- C. Implementing a continuous security assessment program
- D. Integrating a SASI tool as part of the pipeline
Answer: D
Explanation:
The best solution to address reported vulnerabilities in third-party libraries is integrating a Static Application Security Testing (SAST) tool as part of the development pipeline. Here's why:
* Early Detection: SAST tools analyze source code for vulnerabilities before the code is compiled. This allows developers to identify and fix security issues early in the development process.
* Continuous Security: By integrating SAST tools into the CI/CD pipeline, the organization ensures continuous security assessment of the codebase, including third-party libraries, with each code commit and build.
* Comprehensive Analysis: SAST tools provide a detailed analysis of the code, identifying potential vulnerabilities in both proprietary code and third-party dependencies, ensuring that known issues in libraries are addressed promptly.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* OWASP Static Analysis Security Testing (SAST) Cheat Sheet
* NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 113
A developer needs to improve the cryptographic strength of a password-storage component in a web application without completely replacing the crypto-module. Which of the following is the most appropriate technique?
- A. Key rotation
- B. Key stretching
- C. Key encryption
- D. Key escrow
- E. Key splitting
Answer: B
Explanation:
The most appropriate technique to improve the cryptographic strength of a password-storage component in a web application without completely replacing the crypto-module is key stretching. Here's why:
* Enhanced Security: Key stretching algorithms, such as PBKDF2, bcrypt, and scrypt, increase the computational effort required to derive the encryption key from the password, making brute-force attacks more difficult and time-consuming.
* Compatibility: Key stretching can be implemented alongside existing cryptographic modules, enhancing their security without the need for a complete overhaul.
* Industry Best Practices: Key stretching is a widely recommended practice for securely storing passwords, as it significantly improves resistance to password-cracking attacks.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-63B: Digital Identity Guidelines - Authentication and Lifecycle
* Management
* OWASP Password Storage Cheat Sheet
NEW QUESTION # 114
A security administrator needs to automate alerting. The server generates structured log files that need to be parsed to determine whether an alarm has been triggered Given the following code function:
Which of the following is most likely the log input that the code will parse?
- A.
- B.
- C.
- D.
Answer: D
Explanation:
The code function provided in the question seems to be designed to parse JSON formatted logs to check for an alarm state. Option A is a JSON format that matches the structure likely expected by the code. The presence of the "error_log" and "InAlarmState" keys suggests that this is the correct input format.
NEW QUESTION # 115
A company migrated a critical workload from its data center to the cloud. The workload uses a very large data set that requires computational-intensive data processing. The business unit that uses the workload is projecting the following growth pattern:
- Storage requirements will double every six months.
- Computational requirements will fluctuate throughout the year.
- Average computational requirements will double every year.
Which of the following should the company do to address the business unit's requirements?
- A. Implement a load balancer for computing and storage resources.
- B. Combine compute and storage in vertically autoscaling mode.
- C. Plan for a horizontally scaling computing and storage infrastructure.
- D. Deploy a cloud-based CDN for storage and a load balancer for compute.
Answer: C
NEW QUESTION # 116
Recent repents indicate that a software tool is being exploited Attackers were able to bypass user access controls and load a database. A security analyst needs to find the vulnerability and recommend a mitigation.
The analyst generates the following output:
Which of the following would the analyst most likely recommend?
- A. Adding additional time to software development to perform fuzz testing
- B. Installing appropriate EDR tools to block pass-the-hash attempts
- C. Not allowing users to change their local passwords
- D. Removing hard coded credentials from the source code
Answer: D
Explanation:
The output indicates that the software tool contains hard-coded credentials, which attackers can exploit to bypass user access controls and load the database. The most likely recommendation is to remove hard-coded credentials from the source code. Here's why:
* Security Best Practices: Hard-coded credentials are a significant security risk because they can be easily discovered through reverse engineering or simple inspection of the code. Removing them reduces the risk of unauthorized access.
* Credential Management: Credentials should be managed securely using environment variables, secure vaults, or configuration management tools that provide encryption and access controls.
* Mitigation of Exploits: By eliminating hard-coded credentials, the organization can prevent attackers from easily bypassing authentication mechanisms and gaining unauthorized access to sensitive systems.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* OWASP Top Ten: Insecure Design
* NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 117
SIMULATION
An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
Explanation:
Given that there is little connection between the two clouds when site A is down and cause an evacuation I would say directory server is damaged causing domain issues. 1 - Directory Server.
SCADA system controls the pumps so 2 - SCADA. Last is route flapping that is VPN concentrator, now dont make the mistake i did put 3 in site B not A as for the added option used the BGP routing, if bgp route is set to go through site A that might cause issues so 3 - VPM Concentrator (Site B) (BGP route option).
NEW QUESTION # 118
SIMULATION
An organization is planning for disaster recovery and continuity of operations, and has noted the following relevant findings:
1. A natural disaster may disrupt operations at Site A, which would then cause an evacuation.
Users are unable to log into the domain from-their workstations after relocating to Site B.
2. A natural disaster may disrupt operations at Site A, which would then cause the pump room at Site B to become inoperable.
3. A natural disaster may disrupt operations at Site A, which would then cause unreliable internet connectivity at Site B due to route flapping.
INSTRUCTIONS
Match each relevant finding to the affected host by clicking on the host name and selecting the appropriate number.
For findings 1 and 2, select the items that should be replicated to Site B.
For finding 3, select the item requiring configuration changes, then select the appropriate corrective action from the drop- down menu.
Answer:
Explanation:
Matching Relevant Findings to the Affected Hosts:
Finding 1:
Affected Host: DNS
Reason: Users are unable to log into the domain from their workstations after relocating to Site B, which implies a failure in domain name services that are critical for user authentication and domain login.
Finding 2:
Affected Host: Pumps
Reason: The pump room at Site B becoming inoperable directly points to the critical infrastructure components associated with pumping operations.
Finding 3:
Affected Host: VPN Concentrator
Reason: Unreliable internet connectivity at Site B due to route flapping indicates issues with network routing, which is often managed by VPN concentrators that handle site-to-site connectivity.
Corrective Actions for Finding 3:
Finding 3 Corrective Action:
Action: Modify the BGP configuration
Reason: Route flapping is often related to issues with Border Gateway Protocol (BGP) configurations. Adjusting BGP settings can stabilize routes and improve internet connectivity reliability.
Replication to Site B for Finding 1:
Affected Host: DNS
Domain Name System (DNS) services are essential for translating domain names into IP addresses, allowing users to log into the network. Replicating DNS services ensures that even if Site A is disrupted, users at Site B can still authenticate and access necessary resources.
Replication to Site B for Finding 2:
Affected Host: Pumps
The operation of the pump room is crucial for maintaining various functions within the infrastructure. Replicating the control systems and configurations for the pumps at Site B ensures that operations can continue smoothly even if Site A is affected.
Configuration Changes for Finding 3:
Affected Host: VPN Concentrator
Route flapping is a situation where routes become unstable, causing frequent changes in the best path for data to travel. This instability can be mitigated by modifying BGP configurations to ensure more stable routing. VPN concentrators, which manage connections between sites, are typically configured with BGP for optimal routing.
NEW QUESTION # 119
A user submits a help desk ticket stating then account does not authenticate sometimes. An analyst reviews the following logs for the user:
Which of the following best explains the reason the user's access is being denied?
- A. Account compromise
- B. Time-based access restrictions
- C. incorrectly typed password
- D. Invalid user-to-device bindings
Answer: B
Explanation:
The logs reviewed for the user indicate that access is being denied due to time-based access restrictions. These restrictions are commonly implemented to limit access to systems during specific hours to enhance security. If a user attempts to authenticate outside of the allowed time window, access will be denied. This measure helps prevent unauthorized access during non-business hours, reducing the risk of security incidents.
References:
* CompTIA SecurityX Study Guide: Covers various access control methods, including time-based restrictions, as a means of enhancing security.
* NIST Special Publication 800-53, "Security and Privacy Controls for Information Systems and Organizations": Recommends the use of time-based access restrictions as part of access control policies.
* "Access Control and Identity Management" by Mike Chapple and Aaron French: Discusses the implementation and benefits of time-based access restrictions.
NEW QUESTION # 120
Which of the following best explains the importance of determining organization risk appetite when operating with a constrained budget?
- A. Organizational risk appetite varies from organization to organization
- B. Budgetary pressure drives risk mitigation planning in all companies
- C. Risk appetite directly impacts acceptance of high-impact low-likelihood events.
- D. Risk appetite directly influences which breaches are disclosed publicly
Answer: C
Explanation:
Risk appetite is the amount of risk an organization is willing to accept to achieve its objectives.
When operating with a constrained budget, understanding the organization's risk appetite is crucial because:
It helps prioritize security investments based on the level of risk the organization is willing to tolerate.
High-impact, low-likelihood events may be deemed acceptable if they fall within the organization's risk appetite, allowing for budget allocation to other critical areas. Properly understanding and defining risk appetite ensures that limited resources are used effectively to manage risks that align with the organization's strategic goals.
NEW QUESTION # 121
A security configure is building a solution to disable weak CBC configuration for remote access connections lo Linux systems. Which of the following should the security engineer modify?
- A. The /etc/hosts file, updating the IP parameter
- B. The /etc/openssl.conf file, updating the virtual site parameter
- C. The /etc/nsswith.conf file, updating the name server
- D. The /etc/etc/sshd, configure file updating the ciphers
Answer: D
Explanation:
The sshd_config file is the main configuration file for the OpenSSH server. To disable weak CBC (Cipher Block Chaining) ciphers for SSH connections, the security engineer should modify the sshd_config file to update the list of allowed ciphers. This file typically contains settings for the SSH daemon, including which encryption algorithms are allowed.
By editing the /etc/ssh/sshd_config file and updating the Ciphers directive, weak ciphers can be removed, and only strong ciphers can be allowed. This change ensures that the SSH server does not use insecure encryption methods.
References:
* CompTIA Security+ Study Guide
* OpenSSH manual pages (man sshd_config)
* CIS Benchmarks for Linux
NEW QUESTION # 122 
Which of the following is the security engineer most likely doing?
- A. Threat hunting for suspicious activity from an insider threat
- B. Baselining user behavior to support advanced analytics
- C. Reporting on remote log-in activities to track team metrics
- D. Assessing log in activities using geolocation to tune impossible Travel rate alerts
Answer: D
Explanation:
In the given scenario, the security engineer is likely examining login activities and their associated geolocations. This type of analysis is aimed at identifying unusual login patterns that might indicate an impossible travel scenario. An impossible travel scenario is when a single user account logs in from geographically distant locations in a short time, which is physically impossible. By assessing login activities using geolocation, the engineer can tune alerts to identify and respond to potential security breaches more effectively.
NEW QUESTION # 123
A web application server that provides services to hybrid modern and legacy financial applications recently underwent a scheduled upgrade to update common libraries, including OpenSSL. Multiple users are now reporting failed connection attempts to the server. The technician performing initial triage identified the following:
- Client applications more than five years old appear to be the most
affected.
- Web server logs show initial connection attempts by affected hosts.
- For the failed connections, logs indicate "cipher unavailable."
Which of the following is most likely to safely remediate this situation?
- A. The server needs to be configured for backward compatibility to SSL 3.0 applications.
- B. The client TLS configuration must be set to enforce electronic codebook modes of operation.
- C. The client applications need to be modified to support AES in Galois/Counter Mode or equivalent.
- D. The server-side digital signature algorithm needs to be modified to support elliptic curve cryptography.
Answer: C
NEW QUESTION # 124
A company implements a live, video-based facial recognition system. A SOC analyst is concerned about unexpected phrases used by a user during an interaction. However, after the user answers all challenge questions successfully, the analyst is no longer concerned. Upon further investigation, the user was determined to be an attacker who was using AI-assisted social engineering. Which of the following impaired the SOC analyst's ability to identify this threat in real time?
- A. Insufficient existing security measures
- B. Overreliance on existing security technologies
- C. Lack of education and training around emerging technologies
- D. Budget constraints associated with new threat vectors
Answer: B
NEW QUESTION # 125
A company needs a highly secure method to transfer documents over an insecure network. The documents are highly sensitive, and the documents' encryption must be guaranteed even if the network traffic is intercepted. Which of the following encryption techniques is the best option?
- A. One-time pad
- B. Lightweight
- C. Symmetric
- D. Asymmetric
Answer: A
NEW QUESTION # 126
A company wants to use loT devices to manage and monitor thermostats at all facilities. The thermostats must receive vendor security updates and limit access to other devices within the organization. Which of the following best addresses the company's requirements?
- A. Operating lot devices on a separate network with no access to other devices internally
- B. Only allowing Internet access to a set of specific domains
- C. Configuring IoT devices to always allow automatic updates
- D. Only allowing operation for loT devices during a specified time window
Answer: A
Explanation:
The best approach for managing and monitoring IoT devices, such as thermostats, is to operate them on a separate network with no access to other internal devices. This segmentation ensures that the IoT devices are isolated from the main network, reducing the risk of potential security breaches affecting other critical systems. Additionally, this setup allows for secure vendor updates without exposing the broader network to potential vulnerabilities inherent in IoT devices.
NEW QUESTION # 127
An organization is developing on Al-enabled digital worker to help employees complete common tasks such as template development, editing, research, and scheduling. As part of the Al workload the organization wants to Implement guardrails within the platform. Which of the following should the company do to secure the Al environment?
- A. Limn the platform's abilities to only non-sensitive functions
- B. Enhance the training model's effectiveness.
- C. Grant the system the ability to self-govern
- D. Require end-user acknowledgement of organizational policies.
Answer: A
Explanation:
Limiting the platform's abilities to only non-sensitive functions helps to mitigate risks associated with AI operations. By ensuring that the AI-enabled digital worker is only allowed to perform tasks that do not involve sensitive or critical data, the organization reduces the potential impact of any security breaches or misuse.
Enhancing the training model's effectiveness (Option B) is important but does not directly address security guardrails. Granting the system the ability to self-govern (Option C) could increase risk as it may act beyond the organization's control. Requiring end-user acknowledgement of organizational policies (Option D) is a good practice but does not implement technical guardrails to secure the AI environment.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-53 Rev. 5, "Security and Privacy Controls for Information Systems and Organizations"
* ISO/IEC 27001, "Information Security Management"
NEW QUESTION # 128
An engineering team determines the cost to mitigate certain risks is higher than the asset values.
The team must ensure the risks are prioritized appropriately. Which of the following is the best way to address the issue?
- A. Branch protection
- B. Purchasing insurance
- C. Data labeling
- D. Vulnerability assessments
Answer: B
Explanation:
When the cost to mitigate certain risks is higher than the asset values, the best approach is to purchase insurance. This method allows the company to transfer the risk to an insurance provider, ensuring that financial losses are covered in the event of an incident. This approach is cost-effective and ensures that risks are prioritized appropriately without overspending on mitigation efforts.
NEW QUESTION # 129
An organization is implementing Zero Trust architecture A systems administrator must increase the effectiveness of the organization's context-aware access system. Which of the following is the best way to improve the effectiveness of the system?
- A. Always-on VPN
- B. Accurate asset inventory
- C. Secure zone architecture
- D. Microsegmentation
Answer: D
Explanation:
Microsegmentation is a critical strategy within Zero Trust architecture that enhances context-aware access systems by dividing the network into smaller, isolated segments. This reduces the attack surface and limits lateral movement of attackers within the network. It ensures that even if one segment is compromised, the attacker cannot easily access other segments. This granular approach to network security is essential for enforcing strict access controls and monitoring within Zero Trust environments.
NEW QUESTION # 130
A company is preparing to move a new version of a web application to production. No major issues were reported during security scanning or quality assurance in the CI/CD pipeline. Which of the following actions should the company take next?
- A. Perform a peer review on the test branch.
- B. Perform threat modeling on the production application.
- C. Conduct unit testing on the submitted code.
- D. Merge the test branch to the main branch.
Answer: D
NEW QUESTION # 131
A financial technology firm works collaboratively with business partners in the industry to share threat intelligence within a central platform This collaboration gives partner organizations the ability to obtain and share data associated with emerging threats from a variety of adversaries Which of the following should the organization most likely leverage to facilitate this activity? (Select two).
- A. YAKA
- B. JTAG
- C. STIX
- D. TAXII
- E. ATTACK
- F. CWPP
Answer: C,D
Explanation:
* D. STIX (Structured Threat Information eXpression): STIX is a standardized language for representing threat information in a structured and machine-readable format. It facilitates the sharing of threat intelligence by ensuring that data is consistent and can be easily understood by all parties involved.
* E. TAXII (Trusted Automated eXchange of Indicator Information): TAXII is a transport mechanism that enables the sharing of cyber threat information over a secure and trusted network. It works in conjunction with STIX to automate the exchange of threat intelligence among organizations.
Other options:
* A. CWPP (Cloud Workload Protection Platform): This focuses on securing cloud workloads and is not directly related to threat intelligence sharing.
* B. YARA: YARA is used for malware research and identifying patterns in files, but it is not a platform for sharing threat intelligence.
* C. ATT&CK: This is a knowledge base of adversary tactics and techniques but does not facilitate the sharing of threat intelligence data.
* F. JTAG: JTAG is a standard for testing and debugging integrated circuits, not related to threat intelligence.
References:
* CompTIA Security+ Study Guide
* "STIX and TAXII: The Backbone of Threat Intelligence Sharing" by MITRE
* NIST SP 800-150, "Guide to Cyber Threat Information Sharing"
NEW QUESTION # 132
A mobile device hardware manufacturer receives the following requirements from a company that wants to produce and sell a new mobile platform:
- The platform should store biometric data.
- The platform should prevent unapproved firmware from being loaded.
- A tamper-resistant, hardware-based counter should track if unapproved firmware was loaded.
Which of the following should the hardware manufacturer implement? (Select three).
- A. eFuse
- B. SELinux
- C. Secure enclave
- D. Secure boot
- E. SED
- F. Shell restriction
- G. ASLR
- H. NX
Answer: A,C,D
Explanation:
To meet the mobile platform security requirements, the manufacturer should implement the following technologies:
eFuse: This hardware feature helps track and prevent unauthorized firmware by physically
"blowing" fuses to record events, such as firmware tampering, making it impossible to revert to older, unapproved firmware.
Secure boot: This ensures that only trusted and authorized firmware can be loaded during the boot process, preventing malicious or unauthorized software from running.
Secure enclave: A secure enclave is used to store sensitive information like biometric data in a hardware-isolated environment, protecting it from tampering or unauthorized access.
These three solutions provide the tamper resistance, secure firmware validation, and protection of sensitive data required for the platform.
NEW QUESTION # 133
After an increase in adversarial activity, a company wants to implement security measures to mitigate the risk of a threat actor using compromised accounts to mask unauthorized activity.
Which of the following is the best way to mitigate the issue?
- A. Threat intelligence platforms
- B. Reverse engineering
- C. Web application firewall
- D. User and entity behavior analytics
Answer: D
NEW QUESTION # 134
......
Online Questions - Valid Practice CAS-005 Exam Dumps Test Questions: https://www.trainingdumps.com/CAS-005_exam-valid-dumps.html
100% Real CAS-005 dumps - Brilliant CAS-005 Exam Questions PDF: https://drive.google.com/open?id=1IzoEXI9Qyos4SMpW2omRln_THeC0AzD3
