New (2022) CompTIA CAS-003 Exam Dumps [Q287-Q309]

NEW QUESTION 287
An advanced threat emulation engineer is conducting testing against a client’s network. The engineer conducts the testing in as realistic a manner as possible. Consequently, the engineer has been gradually ramping up the volume of attacks over a long period of time. Which of the following combinations of techniques would the engineer MOST likely use in this testing?
(Choose three.)

Black box testing

Gray box testing

Code review

Social engineering

Vulnerability assessment

Pivoting

Self-assessment

White teaming

External auditing

NEW QUESTION 288
A network administrator with a company’s NSP has received a CERT alert for targeted adversarial behavior at the company. In addition to the company’s physical security, which of the following can the network administrator use to detect the presence of a malicious actor physically accessing the company’s network or information systems from within?
(Select TWO).

RAS

Vulnerability scanner

HTTP intercept

HIDS

Port scanner

Protocol analyzer

NEW QUESTION 289
A security consultant is conducting a penetration test against a customer enterprise local comprises local hosts and cloud-based servers The hosting service employs a multitenancy model with elastic provisioning to meet customer demand The customer runs multiple virtualized servers on each provisioned cloud host. The security consultant is able to obtain multiple sets of administrator credentials without penetrating the customer network. Which of the following is the MOST likely risk the tester exploited?

Data-at-rest encryption misconfiguration and repeated key usage

Offline attacks against the cloud security broker service

The ability to scrape data remnants in a multitenancy environment

VM escape attacks against the customer network hypervisors

NEW QUESTION 290
A company has adopted and established a continuous-monitoring capability, which has proven to be
effective in vulnerability management, diagnostics, and mitigation. The company wants to increase the
likelihood that it is able to discover and therefore respond to emerging threats earlier in the life cycle.
Which of the following methodologies would BEST help the company to meet this objective? (Choose two.)

Install and configure an IPS.

Enforce routine GPO reviews.

Form and deploy a hunt team.

Institute heuristic anomaly detection.

Use a protocol analyzer with appropriate connectors.

NEW QUESTION 291
A user has a laptop configured with multiple operating system installations. The operating systems are all installed on a single SSD, but each has its own partition and logical volume.
Which of the following is the BEST way to ensure confidentiality of individual operating system data?

Encryption of each individual partition

Encryption of the SSD at the file level

FDE of each logical volume on the SSD

FDE of the entire SSD as a single disk

NEW QUESTION 292
A Chief Information Security Officer (CISO) is developing a new BIA for the organization. The CISO wants to gather requirements to determine the appropriate RTO and RPO for the organization’s ERP. Which of the following should the CISO interview as MOST qualified to provide RTO/RPO metrics?

Datacustodian

Dataowner

Securityanalyst

Businessunitdirector

ChiefExecutiveOfficer(CEO)

NEW QUESTION 293
Ann, a Physical Security Manager, is ready to replace all 50 analog surveillance cameras with IP cameras with built-in web management.
Ann has several security guard desks on different networks that must be able to view the cameras without unauthorized people viewing the video as well.
The selected IP camera vendor does not have the ability to authenticate users at the camera level.
Which of the following should Ann suggest to BEST secure this environment?

Create an IP camera network and deploy NIPS to prevent unauthorized access.

Create an IP camera network and only allow SSL access to the cameras.

Create an IP camera network and deploy a proxy to authenticate users prior to accessing the cameras.

Create an IP camera network and restrict access to cameras from a single management host.

NEW QUESTION 294
Joe an application security engineer is performing an audit of an environmental control application He has implemented a robust SDLC process and is reviewing API calls available to the application During the review.
Joe finds the following in a log file.

Which of the following would BEST mitigate the issue Joe has found?

Ensure the API uses SNMPv1.

Perform authentication via a secure channel

Verify the API uses HTTP GET instead of POST

Deploy a WAF in front of the API and implement rate limiting

NEW QUESTION 295
ABC Corporation has introduced token-based authentication to system administrators due to the risk of password compromise. The tokens have a set of HMAC counter-based codes and are valid until they are used.
Which of the following types of authentication mechanisms does this statement describe?

TOTP

PAP

CHAP

HOTP

NEW QUESTION 296
Company leadership believes employees are experiencing an increased number of cyber attacks; however, the metrics do not show this. Currently, the company uses “Number of successful phishing attacks” as a KRI, but it does not show an increase.
Which of the following additional information should be the Chief Information Security Officer (CISO) include in the report?

The ratio of phishing emails to non-phishing emails

The number of phishing attacks per employee

The number of unsuccessful phishing attacks

The percent of successful phishing attacks

NEW QUESTION 297
The Chief Executive Officer (CEO) instructed the new Chief Information Security Officer (CISO) to provide a list of enhancements to the company’s cybersecurity operation. As a result, the CISO has identified the need to align security operations with industry best practices. Which of the following industry references is appropriate to accomplish this?

OSSM

NIST

PCI

OWASP

NEW QUESTION 298
A security engineer is assisting a developer with input validation, and they are studying the following code block:

The security engineer wants to ensure strong input validation is in place for customer-provided account identifiers. These identifiers are ten-digit numbers. The developer wants to ensure input validation is fast because a large number of people use the system.
Which of the following would be the BEST advice for the security engineer to give to the developer?

Replace code with Java-based type checks

Parse input into an array

Use regular expressions

Canonicalize input into string objects before validation

NEW QUESTION 299
An attacker wants to gain information about a company’s database structure by probing the database listener.
The attacker tries to manipulate the company’s database to see if it has any vulnerabilities that can be exploited to help carry out an attack. To prevent this type of attack, which of the following should the company do to secure its database?

Mask the database banner

Tighten database authentication and limit table access

Harden web and Internet resources

Implement challenge-based authentication

NEW QUESTION 300
A company wants to extend its help desk availability beyond business hours. The Chief Information Officer (CIO) decides to augment the help desk with a third-party service that will answer calls and provide Tier 1 problem resolution, such as password resets and remote assistance. The security administrator implements the following firewall change:

The administrator provides the appropriate path and credentials to the third-party company. Which of the following technologies is MOST likely being used to provide access to the third company?

LDAP

WAYF

OpenID

RADIUS

SAML

NEW QUESTION 301
An aircraft manufacturer is developing software that will perform automatic flight control (auto-pilot) Given the high safety criticality of the software the developer can BEST prove software correctness to a requirement’s specification by employing:

static code analyzers

formal methods

test harnesses

dynamic analysis methods

NEW QUESTION 302
A company’s employees are not permitted to access company systems while traveling internationally. The company email system is configured to block logins based on geographic location, but some employees report their mobile phones continue to sync email traveling . Which of the following is the MOST likely explanation? (Select TWO.)

Outdated escalation attack

Privilege escalation attack

VPN on the mobile device

Unrestricted email administrator accounts

Chief use of UDP protocols

Disabled GPS on mobile devices

NEW QUESTION 303
An organization is currently performing a market scan for managed security services and EDR capability.
Which of the following business documents should be released to the prospective vendors in the first step of the process? (Select TWO).

MSA

RFP

NDA

RFI

MOU

RFQ

NEW QUESTION 304
An infrastructure team is at the end of a procurement process and has selected a vendor. As part of the
final negotiations, there are a number of outstanding issues, including:
1. Indemnity clauses have identified the maximum liability
2. The data will be hosted and managed outside of the company’s geographical location
The number of users accessing the system will be small, and no sensitive data will be hosted in the
solution. As the security consultant on the project, which of the following should the project’s security
consultant recommend as the NEXT step?

Develop a security exemption, as it does not meet the security policies

Mitigate the risk by asking the vendor to accept the in-country privacy principles

Require the solution owner to accept the identified risks and consequences

Review the entire procurement process to determine the lessons learned

NEW QUESTION 305
During a recent audit of servers, a company discovered that a network administrator, who required remote access, had deployed an unauthorized remote access application that communicated over common ports already allowed through the firewall. A network scan showed that this remote access application had already been installed on one third of the servers in the company. Which of the following is the MOST appropriate action that the company should take to provide a more appropriate solution?

Implement an IPS to block the application on the network

Implement the remote application out to the rest of the servers

Implement SSL VPN with SAML standards for federation

Implement an ACL on the firewall with NAT for remote access

NEW QUESTION 306
The Chief Financial Officer (CFO) of an organization wants the IT department to add the CFO’s account to the domain administrator group The IT department thinks this is nsky and wants support from the security manager before proceeding. Which of the following BEST supports the argument against providing the CFO with domain administrator access?

Discretionary access control

Separation of duties

Data classification

Mandatory access control

NEW QUESTION 307
An organization is moving internal core data-processing functions related to customer data to a global public cloud provider that uses aggregated services from other partner organizations. Which of the following compliance issues will MOST likely be introduced as a result of the migration?

Internal data integrity standards and outsourcing contracts and partnerships

Data ownership, internal data classification, and risk profiling of outsourcers

Company audit functions, cross-boarding jurisdictional challenges, and export controls

Data privacy regulations, data sovereignty, and third-party providers

NEW QUESTION 308
As a security administrator, you are asked to harden a server running Red Hat Enterprise Server 5.5 64-bit.
This server is being used as a DNS and time server. It is not used as a database, web server, or print server.
There are no wireless connections to the server, and it does not need to print.
The command window will be provided along with root access. You are connected via a secure shell with root access.
You may query help for a list of commands.
Instructions:
You need to disable and turn off unrelated services and processes.
It is possible to simulate a crash of your server session.
The simulation can be reset, but the server cannot be rebooted.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

NEW QUESTION 309
A systems administrator recently joined an organization and has been asked to perform a security assessment of controls on the organization’s file servers, which contain client data from a number of sensitive systems. The administrator needs to compare documented access requirements to the access implemented within the file system.
Which of the following is MOST likely to be reviewed during the assessment? (Select two.)

Access control list

Security requirements traceability matrix

Data owner matrix

Roles matrix

Data design document

Data access policies