CAS-005 Pre-Exam Practice Tests (Updated 329 Questions) [Q175-Q193]

Rate this post

CAS-005 Pre-Exam Practice Tests | (Updated 329 Questions)

Valid CAS-005 Exam Q&A PDF – One Year Free Update

CompTIA CAS-005 Exam Syllabus Topics:

Topic	Details
Topic 1	Security Engineering: This section measures the skills of CompTIA security architects that involve troubleshooting common issues related to identity and access management (IAM) components within an enterprise environment. Candidates will analyze requirements to enhance endpoint and server security while implementing hardware security technologies. This domain also emphasizes the importance of advanced cryptographic concepts in securing systems.
Topic 2	Governance, Risk, and Compliance: This section of the exam measures the skills of CompTIA security architects that cover the implementation of governance components based on organizational security requirements, including developing policies, procedures, and standards. Candidates will learn about managing security programs, including awareness training on phishing and social engineering.
Topic 3	Security Architecture: This domain focuses on analyzing requirements to design resilient systems, including the configuration of firewalls and intrusion detection systems.
Topic 4	Security Operations: This domain is designed for CompTIA security architects and covers analyzing data to support monitoring and response activities, as well as assessing vulnerabilities and recommending solutions to reduce attack surfaces. Candidates will apply threat-hunting techniques and utilize threat intelligence concepts to enhance operational security.

NEW QUESTION 175
A product development team has submitted code snippets for review prior to release.
INSTRUCTIONS
Analyze the code snippets, and then select one vulnerability, and one fix for each code snippet.
Code Snippet 1

Code Snippet 2

Vulnerability 1:
SQL injection
Cross-site request forgery
Server-side request forgery
Indirect object reference
Cross-site scripting
Fix 1:
Perform input sanitization of the userid field.
Perform output encoding of queryResponse,
Ensure usex:ia belongs to logged-in user.
Inspect URLS and disallow arbitrary requests.
Implement anti-forgery tokens.
Vulnerability 2
1) Denial of service
2) Command injection
3) SQL injection
4) Authorization bypass
5) Credentials passed via GET
Fix 2
A) Implement prepared statements and bind
variables.
B) Remove the serve_forever instruction.
C) Prevent the “authenticated” value from being overridden by a GET parameter.
D) HTTP POST should be used for sensitive parameters.
E) Perform input sanitization of the userid field.

NEW QUESTION 176
An organization is implementing advanced security controls associated with the execution of software applications on corporate endpoints. The organization must implement a deny-all, permit-by-exception approach to software authorization for all systems regardless of OS. Which of the following should be implemented to meet these requirements?

SELinux

MDM

XDR

Block list

Atomic execution

Step by Step
Understanding the Scenario: The organization wants a strict application control policy: deny all software execution by default and only allow specifically authorized applications. This must be enforced across all operating systems. It is implied that they mean an Allow list, but Block List is the only reasonable answer.
Analyzing the Answer Choices:
A . SELinux (Security-Enhanced Linux): SELinux is a security module for the Linux kernel that provides Mandatory Access Control (MAC). While it can enforce application control, it’s specific to Linux and doesn’t meet the “regardless of OS” requirement.
Reference:
B . MDM (Mobile Device Management): MDM solutions are primarily used to manage mobile devices (smartphones, tablets). While some MDM solutions offer application control features, they are not designed for comprehensive application control across all OS types (including desktops).
C . XDR (Extended Detection and Response): XDR is a threat detection and response platform that integrates multiple security products. While important for security, it’s not designed to enforce application controlpolicies.
D . Allow List (Corrected from “Block List”): An allow list (also known as an application whitelisting) is a security mechanism that explicitly lists applications authorized to run. All other applications are blocked by default. This directly aligns with the “deny-all, permit-by-exception” approach.
E . Atomic execution: This is not a recognized security control or term related to application control.
Why D (Corrected to Allow List) is the Correct answer:
An allow list perfectly implements the required security policy. By defining a list of approved applications, the organization ensures that only those applications can execute.
This approach is effective across different operating systems, as long as the OS has a mechanism to implement application allow lists (most modern OSs do).
CASP+ Relevance: Allow listing is a critical security control discussed in CASP+ as a method to reduce the attack surface, prevent malware execution, and enhance endpoint security.
Implementation Considerations (Elaboration based on CASP+ principles):
Creating the Allow List: This requires careful planning and inventorying of all necessary applications.
Enforcement Mechanisms: Different OSs have different tools for enforcing application control policies. Windows has AppLocker, macOS has its own mechanisms, and various third-party endpoint security solutions also provide this functionality.
Updating the Allow List: A process must be in place to add new applications to the allow list when needed, ensuring proper vetting and authorization.
Exceptions: There might be a need for exceptions for certain users or systems, requiring careful consideration and management.
In conclusion, an allow list (application whitelisting) is the most appropriate solution to implement a “deny-all, permit-by-exception” application control policy across all operating systems. It’s a powerful security control aligned with the principles of least privilege and is a core concept covered in the CASP+ exam objectives. It is implied that the question was intended to be Allow List, but as written, Block List is the only reasonable answer.

NEW QUESTION 177
After a penetration test on the internal network, the following report was generated:
Attack Target Result
Compromised host ADMIN01S.CORP.LOCAL Successful
Hash collected KRBTGT.CORP.LOCAL Successful
Hash collected SQLSV.CORP.LOCAL Successful
Pass the hash SQLSV.CORP.LOCAL Failed
Domain control CORP.LOCAL Successful
Which of the following should be recommended to remediate the attack?

Deleting SQLSV

Reimaging ADMIN01S

Rotating KRBTGT password

Resetting the local domain

NEW QUESTION 178
A security engineer wants to enhance the security posture of end-user systems in a Zero Trust environment. Given the following requirements:
. Reduce the ability for potentially compromised endpoints to contact command-and-control infrastructure.
. Track the requests that the malware makes to the IPs.
. Avoid the download of additional payloads.
Which of the following should the engineer deploy to meet these requirements?

DNS sinkholing

Browser isolation

Zone transfer protection

HIDS

NEW QUESTION 179
A company reduced its staff 60 days ago, and applications are now starting to fail. The security analyst is investigating to determine if there is malicious intent for the application failures. The security analyst reviews the following logs:
Mar 5 22:09:50 akj3 sshd
[21502]: Success login for userOl from 192.168.2.5
Mar 5 22:10:00 akj3 sshd
[21502]: Failed login for userID from 192.168.2.5
Which of the following is the most likely reason for the application failures?

The user’s account was set as a service account.

The user’s home directory was deleted.

The user does not have sudo access.

The root password has been changed.

NEW QUESTION 180
A company is having issues with its vulnerability management program New devices/lPs are added and dropped regularly, making the vulnerability report inconsistent. Which of the following actions should the company lake to most likely improve the vulnerability management process?

Request a weekly report with all new assets deployed and decommissioned

Extend the DHCP lease lime to allow the devices to remain with the same address for a longer period.

Implement a shadow IT detection process to avoid rogue devices on the network

Perform regular discovery scanning throughout the 11 landscape using the vulnerability management tool

NEW QUESTION 181

An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.

NEW QUESTION 182
Which of the following best describes the challengesassociated with widespread adoption of homomorphic encryption techniques?

Incomplete mathematical primitives

No use cases to drive adoption

Quantum computers not yet capable

Insufficient coprocessor support

NEW QUESTION 183
A security analyst is developing a threat model that focuses on attacks associated with the organization’s storage products. The products:
* Are used in commercial and government user environments
* Are required to comply with crypto-export requirements
* Include both hardware and software components that are developed by external vendors in Europe and Asia Which of the following are the most important for the analyst to consider when developing the model? (Select two).

Contractual obligations

Legal hold obligations

Trust boundaries

Cloud services enumeration

Supply chain access

Homomorphic encryption usage

NEW QUESTION 184
A company that relies on an COL system must keep it operating until a new solution is available.
Which of the following is the most secure way to meet this goal?

Isolating the system and enforcing firewall rules to allow access to only required endpoints

Enforcing strong credentials and improving monitoring capabilities

Restricting system access to perform necessary maintenance by the IT team

Placing the system in a screened subnet and blocking access from internal resources

NEW QUESTION 185
An organization wants to implement a secure cloud architecture across all instances. Given the following requirements:
* Establish a standard network template.
* Deployments must be consistent.
* Security policies must be able to be changed at scale.
Which of the following technologies meets these requirements?

Serverless deployment model

Container orchestration

Infrastructure as code

CLI cloud administration

API gateway

NEW QUESTION 186
An endpoint security engineer finds that a newly acquired company has a variety of non-standard applications running and no defined ownership for those applications. The engineer needs to find a solution that restricts malicious programs and software from running in that environment, while allowing the non-standard applications to function without interruption. Which of the following application control configurations should the engineer apply?

Deny list

Allow list

Audit mode

MAC list

NEW QUESTION 187
A security analyst detects a possible RAT infection on a computer in the internal network. After reviewing the details of the alert, the analyst identifies the initial vector of the attack was an email that was forwarded to multiple recipients in the same organizational unit. Which of the following should the analyst do first to minimize this type of threat in the future?

Move from an anti-malware software to an EDR solution.

Perform a penetration test to detect technology gaps on the anti-spam solution.

Configure an IPS solution in the internal network to mitigate infections.

Implement a security awareness program in the organization.

NEW QUESTION 188
A company receives several complaints from customers regarding its website. An engineer implements a parser for the web server logs that generates the following output:

which of the following should the company implement to best resolve the issue?

IDS

CDN

WAF

NAC

NEW QUESTION 189
A company that uses containers to run its applications is required to identify vulnerabilities on every container image in a private repository The security team needs to be able to quickly evaluate whether to respond to a given vulnerability Which of the following, will allow the security team to achieve the objective with the last effort?

SAST scan reports

Centralized SBoM

CIS benchmark compliance reports

Credentialed vulnerability scan

NEW QUESTION 190
A news organization wants to implement workflows that allow users to request that untruthful data be retraced and scrubbed from online publications to comply with the right to be forgotten Which of the following regulations is the organization most likely trying to address’

GDPR

COPPA

CCPA

DORA

NEW QUESTION 191
A central bank implements strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin. Which of the following best describes the cyberthreat to the bank?

Ability to obtain components during wartime

Fragility and other availability attacks

Physical Implants and tampering

Non-conformance to accepted manufacturing standards

NEW QUESTION 192
After an incident response exercise, a security administrator reviews the following table:

Which of the following should the administrator do to beat support rapid incident response in the future?

Automate alerting to IT support for phone system outages.

Enable dashboards for service status monitoring

Send emails for failed log-In attempts on the public website

Configure automated Isolation of human resources systems

NEW QUESTION 193
A hospital provides tablets to its medical staff to enable them to more quickly access and edit patients’ charts.
The hospital wants to ensure that if a tablet is Identified as lost or stolen and a remote command is issued, the risk of data loss can be mitigated within seconds. The tablets are configured as follows to meet hospital policy
* Full disk encryption is enabled
* “Always On” corporate VPN is enabled
* ef-use-backed keystore is enabled’ready.
* Wi-Fi 6 is configured with SAE.
* Location services is disabled.
*Application allow list is configured

Revoking the user certificates used for VPN and Wi-Fi access

Performing cryptographic obfuscation

Using geolocation to find the device

Configuring the application allow list to only per mil emergency calls

Returning on the device’s solid-state media to zero