Verified & Latest CAS-004 Dump Q&As with Correct Answers [Q116-Q134]

Verified & Latest CAS-004 Dump Q&As with Correct Answers

Latest CAS-004 dumps - Instant Download PDF

The CASP+ certification exam is designed for experienced IT professionals with a minimum of ten years of experience in IT administration, including at least five years of hands-on technical security experience. CAS-004 exam is intended to validate the critical thinking and judgment skills required to design, implement, and manage complex security solutions. Candidates for the certification exam should be familiar with the latest cybersecurity technologies and trends, as well as possess a deep understanding of the business and regulatory environment in which they operate.

The CASP+ certification exam is highly respected in the industry and is intended to validate the skills and knowledge required for IT security professionals to design, implement, and manage complex security solutions. CompTIA Advanced Security Practitioner (CASP+) Exam certification covers advanced topics such as risk management, enterprise security architecture, research, and collaboration. The CASP+ certification is ideal for individuals seeking to advance their career in IT security and cybersecurity.

CompTIA CASP+ certification exam covers advanced-level security concepts, such as risk management, enterprise security architecture, research and analysis, and integration of computing, communications, and business disciplines. These concepts are essential for IT professionals who are responsible for designing, implementing, and managing complex security solutions in an organization. CAS-004 exam is designed to verify that candidates have the skills and knowledge required to secure enterprise systems and applications.

NEW QUESTION # 116
A security architect is tasked with securing a new cloud-based videoconferencing and collaboration platform to support a new distributed workforce. The security architect's key objectives are to:
* Maintain customer trust
* Minimize data leakage
* Ensure non-repudiation
Which of the following would be the BEST set of recommendations from the security architect?

A. Enable the user authentication requirement, enable end-to-end encryption, and enable waiting rooms.
B. Enable end-to-end encryption, disable video recording, and disable file exchange.
C. Enable watermarking, enable the user authentication requirement, and disable video recording.
D. Disable file exchange, enable watermarking, and enable the user authentication requirement.

Answer: D

Explanation:
Disabling file exchange can help to minimize data leakage by preventing users from sharing sensitive documents or data through the videoconferencing platform. Enabling watermarking can help to maintain customer trust and ensure non-repudiation by adding a visible or invisible mark to the video stream that identifies the source or owner of the content. Enabling the user authentication requirement can help to secure the videoconferencing sessions by verifying the identity of the participants and preventing unauthorized access. Verified Reference:
https://www.rev.com/blog/marketing/follow-these-7-video-conferencing-security-best-practices
https://www.paloaltonetworks.com/blog/2020/04/network-video-conferencing-security/
https://www.megameeting.com/news/best-practices-secure-video-conferencing/

NEW QUESTION # 117
After investigating a recent security incident, a SOC analyst is charged with creating a reference guide for the entire team to use. Which of the following should the analyst create to address future incidents?

A. Communication plan
B. Root cause analysis
C. Lessons learned
D. Runbook

Answer: D

Explanation:
A runbook is a detailed guide that provides step-by-step instructions on how to respond to specific types of incidents. It is used by the SOC team to ensure a consistent, organized, and efficient response to incidents. In this case, after the incident investigation, creating a runbook would help standardize the response process for future security incidents, enabling the team to act quickly and effectively.

NEW QUESTION # 118
A pharmaceutical company uses a cloud provider to host thousands of independent resources in object storage. The company needs a practical and effective means of discovering data, monitoring changes, and identifying suspicious activity. Which of the following would best meet these requirements?

A. An automated data classification system
B. A machine-learning-based data security service
C. A cloud configuration assessment and compliance service
D. A file integrity monitoring service

Answer: B

Explanation:
A machine-learning-based data security service provides dynamic discovery, anomaly detection, and behavioral analysis. It effectively identifies changes and suspicious activity across large-scale environments, such as object storage in the cloud.

NEW QUESTION # 119
The Chief Information Security Officer is concerned about the possibility of employees downloading 'malicious files from the internet and 'opening them on corporate workstations. Which of the following solutions would be BEST to reduce this risk?

A. Execute the files in the sandbox on the web proxy.
B. Scan all downloads using an antivirus engine on the web proxy.
C. Block known malware sites on the web proxy.
D. Integrate the web proxy with threat intelligence feeds.

Answer: A

Explanation:
Executing the files in the sandbox on the web proxy is the best solution to reduce the risk of employees downloading and opening malicious files from the internet. A sandbox is a secure and isolated environment that can run untrusted or potentially harmful code without affecting the rest of the system. By executing the files in the sandbox, the web proxy can analyze their behavior and detect any malicious activity before allowing them to reach the corporate workstations.

NEW QUESTION # 120
A small firm's newly created website has several design flaws.
The developer created the website to be fully compatible with ActiveX scripts in order to use various digital certificates and trusting certificate authorities.
However, vulnerability testing indicates sandboxes were enabled, which restricts the code's access to resources within the user's computer.
Which of the following is the MOST likely cause of the error"?

A. The developer established a corporate account with a non-reputable certification authority.
B. The developer used fuzzy logic to determine how the web browser would respond once ports 80 and 443 were both open
C. The developer did not consider that mobile code would be transmitted across the network.
D. The developer inadvertently used Java applets.

Answer: D

NEW QUESTION # 121
A common industrial protocol has the following characteristics:
* Provides for no authentication/security
* Is often implemented in a client/server relationship
* Is implemented as either RTU or TCP/IP
Which of the following is being described?

A. Profinet
B. Z-Wave
C. Zigbee
D. Modbus

Answer: D

Explanation:
The protocol described is Modbus, which is a commonly used industrial protocol that lacks built-in authentication and security features. Modbus operates in a client/server model and can be implemented over RTU (Remote Terminal Unit) or TCP/IP for communication between devices. The other protocols mentioned either have different characteristics or are used in different contexts (such as Profinet for industrial automation, Zigbee for wireless IoT devices, and Z-Wave for home automation). CASP+ identifies Modbus as a critical protocol in industrial environments that lacks security and requires additional protective measures.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 4.0 - Industrial Control Systems (ICS) and Modbus Protocol CompTIA CASP+ Study Guide: Industrial Protocols and Modbus Security

NEW QUESTION # 122
A security analyst is researching containerization concepts for an organization. The analyst is concerned about potential resource exhaustion scenarios on the Docker host due to a single application that is overconsuming available resources.
Which of the following core Linux concepts BEST reflects the ability to limit resource allocation to containers?

A. Cgroups
B. Device mapper
C. Linux namespaces
D. Union filesystem overlay

Answer: A

NEW QUESTION # 123
An organization has an operational requirement with a specific equipment vendor The organization is located in the United States, but the vendor is located in another region Which of the following risks would be most concerning to the organization in the event of equipment failure?

A. Shipping delays could cost the organization money
B. The organization requires authorized vendor specialists.
C. Each region has different regulatory frameworks to follow
D. Support may not be available during all business hours

Answer: D

Explanation:
The primary risk for an organization working with vendors in different time zones is that support might not be available during the organization's regular business hours. This can lead to delays in receiving necessary support or assistance when equipment issues arise, which could be critical if there's an equipment failure.

NEW QUESTION # 124
A SOC analyst received an alert about a potential compromise and is reviewing the following SIEM logs:

Which of the following is the most appropriate action for the SOC analyst to recommend?

A. Isolating laptop314 from the network
B. Disabling account JDoe to prevent further lateral movement
C. Alerting JDoe about the potential account compromise
D. Creating HIPS and NIPS rules to prevent logins

Answer: A

Explanation:
The SIEM logs indicate suspicious behavior that could be a sign of a compromise, such as the launching of cmd.exe after Outlook.exe, which is atypical user behavior and could indicate that a machine has been compromised to perform lateral movement within the network. Isolating laptop314 from the network would contain the threat and prevent any potential spread to other systems while further investigation takes place.

NEW QUESTION # 125
A Chief Information Security Officer (CISO) reviewed data from a cyber exercise that examined all aspects of the company's response plan. Which of the following best describes what the CISO reviewed?

A. An after-action report
B. A tabletop exercise
C. A system security plan
D. A disaster recovery plan

Answer: A

Explanation:
An after-action report is a document that summarizes the performance of a team during a cybersecurity incident. It is used to review all aspects of the incident response plan, including what was done correctly, what needs improvement, and how the team responded to the incident. The CISO's review of data from a cyber exercise would typically result in an after-action report, which helps in improving future responses to incidents.

NEW QUESTION # 126
A company is rewriting a vulnerable application and adding the inprotect () system call in multiple parts of the application's code that was being leveraged by a recent exploitation tool. Which of the following should be enabled to ensure the application can leverage the new system call against similar attacks in the future?

A. TPM
B. NX bit
C. Secure boot
D. HSM

Answer: B

NEW QUESTION # 127
The primary advantage of an organization creating and maintaining a vendor risk registry is to:

A. ensure that all assets have low residual risk.
B. study a variety of risks and review the threat landscape.
C. ensure that inventory of potential risk is maintained.
D. define the risk assessment methodology.

Answer: C

Explanation:
The primary advantage of creating and maintaining a vendor risk registry is to ensure that an inventory of potential risks is maintained. A vendor risk registry helps organizations keep track of the risks associated with third-party vendors, especially as they may introduce vulnerabilities or non- compliance issues. By maintaining this registry, the organization can continuously monitor and manage vendor-related risks in a structured way, improving its overall security posture.
CASP+ emphasizes the importance of vendor risk management in an organization's broader risk management strategy.

NEW QUESTION # 128
A security analyst is designing a touch screen device so users can gain entry into a locked room by touching buttons numbered zero through nine in a specific numerical sequence. The analyst designs the keypad so that the numbers are randomly presented to the user each time the device is used. Which of the following best describes the design trade-offs? (Select two.)

A. The risk of someone overseeing a pattern as a user enters the numbers is decreased.
B. This design makes entering numbers more difficult for users.
C. The routines to generate the random sequences are trivial to implement.
D. End users will have a more difficult time remembering the access numbers.
E. The device needs to have additional power to compute the numbers.
F. Weak or easily guessed access numbers are more likely.

Answer: A,B

Explanation:
A: Randomizing the keypad reduces the risk of shoulder-surfing attacks by eliminating predictable patterns.
C: Randomization increases the cognitive load on users, making it harder to input numbers quickly.
D: Additional computational power is minimal and not typically a trade-off.
E and F: Remembering access numbers or weak passwords are unrelated to keypad randomization.

NEW QUESTION # 129
Which of the following protocols is a low power, low data rate that allows for the creation of PAN networks?

A. Modbus
B. Zigbee
C. CAN
D. DNP3

Answer: B

Explanation:
Reference: https://urgentcomm.com/2007/11/01/connecting-on-a-personal-level/

NEW QUESTION # 130
A security analyst is using data provided from a recent penetration test to calculate CVSS scores to prioritize remediation. Which of the following metric groups would the analyst need to determine to get the overall scores? (Select THREE).

A. Attack vector
B. Integrity
C. Impact
D. Base
E. Availability
F. Temporal
G. Environmental
H. Confidentiality

Answer: D,F,G

Explanation:
The three metric groups that are needed to calculate CVSS scores are Base, Temporal, and Environmental.
The Base metrics represent the intrinsic characteristics of a vulnerability that are constant over time and across user environments.
The Temporal metrics represent the characteristics of a vulnerability that may change over time but not across user environments.
The Environmental metrics represent the characteristics of a vulnerability that are relevant and unique to a particular user's environment.
Verified References:
https://nvd.nist.gov/vuln-metrics/cvss
https://www.first.org/cvss/specification-document

NEW QUESTION # 131
Two companies that recently merged would like to unify application access between the companies, without initially merging internal authentication stores. Which of the following technical strategies would best meet this objective?

A. ABAC
B. Federation
C. MFA
D. TACACS+
E. RADIUS

Answer: B

Explanation:
Federation is the best strategy for unifying application access between two companies without merging their internal authentication stores. Federation allows users from different organizations to authenticate and access resources using their existing credentials through trusted third-party identity providers. This enables seamless access without the need to merge or consolidate internal authentication systems. CASP+ emphasizes federation as a key technology for enabling cross-organizational authentication while maintaining the integrity of separate identity stores.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 2.0 - Enterprise Security Operations (Federated Identity and Authentication) CompTIA CASP+ Study Guide: Federated Identity Management for Mergers and Cross-Company Access

NEW QUESTION # 132
A developer is creating a new mobile application for a company. The application uses REST API and TLS 1.2 to communicate securely with the external back-end server. Due to this configuration, the company is concerned about HTTPS interception attacks.
Which of the following would be the BEST solution against this type of attack?

A. Wildcard certificates
B. Cookies
C. HSTS
D. Certificate pinning

Answer: D

Explanation:
Reference: https://cloud.google.com/security/encryption-in-transit
Certificate pinning is a technique that can prevent HTTPS interception attacks by hardcoding the expected certificate or public key of the server in the application code, so that any certificate presented by an intermediary will be rejected. Cookies are small pieces of data that are stored by browsers to remember user preferences or sessions, but they do not prevent HTTPS interception attacks. Wildcard certificates are certificates that can be used for multiple subdomains of a domain, but they do not prevent HTTPS interception attacks. HSTS (HTTP Strict Transport Security) is a policy that forces browsers to use HTTPS connections, but it does not prevent HTTPS interception attacks. Verified References: https://www.comptia.org/blog/what- is-certificate-pinning https://partners.comptia.org/docs/default-source/resources/casp-content-guide

NEW QUESTION # 133
Clients are reporting slowness when attempting to access a series of load-balanced APIs that do not require authentication. The servers that host the APIs are showing heavy CPU utilization. No alerts are found on the WAFs sitting in front of the APIs.
Which of the following should a security engineer recommend to BEST remedy the performance issues in a timely manner?