[Jun-2022] Free CAS-003 Exam Dumps to Improve Exam Score [Q180-Q198]

给本帖评分

[Jun-2022] Free CAS-003 Exam Dumps to Improve Exam Score

2022 Realistic CAS-003 Dumps Exam Tips Test Pdf Exam Material

4 Books to Consider When Preparing for CAS-003 Exam

Although there are different ways of studying for certification tests, books remain some of the most helpful resources. CompTIA itself provides its own guide for CAS-003 exam that can be bought on the official website. Also, you can first download the free sample and check if this material meets your needs.

第 180 号 The director of sales asked the development team for some small changes to increase the usability of an application used by the sales team. Prior security reviews of the code showed no significant vulnerabilities, and since the changes were small, they were given a peer review and then pushed to the live environment.
Subsequent vulnerability scans now show numerous flaws that were not present in the previous versions of the code.
Which of the following is an SDLC best practice that should have been followed?

Versioning

Regression testing

Continuous integration

Integration testing

NO.181 A SaaS-based email service provider often receives reports from legitimate customers that their IP netblocks are on blacklists and they cannot send email. The SaaS has confirmed that affected customers typically have IP addresses within broader network ranges and some abusive customers within the same IP ranges may have performed spam campaigns.
Which of the following actions should the SaaS provider perform to minimize legitimate customer impact?

Inform the customer that the service provider does not have any control over third-party blacklist entries. The customer should reach out to the blacklist operator directly

Perform a takedown of any customer accounts that have entries on email blacklists because this is a strong indicator of hostile behavior

Work with the legal department and threaten legal action against the blacklist operator if the netblocks are not removed because this is affecting legitimate traffic

Establish relationship with a blacklist operators so broad entries can be replaced with more granular entries and incorrect entries can be quickly pruned

NO.182 A company’s user community is being adversely affected by various types of emails whose authenticity cannot be trusted. The Chief Information Security Officer (CISO) must address the problem.
Which of the following solutions would BEST support trustworthy communication solutions?

Enabling spam filtering and DMARC.

Using MFA when logging into email clients and the domain.

Enforcing HTTPS everywhere so web traffic, including email, is secure.

Enabling SPF and DKIM on company servers.

Enforcing data classification labels before an email is sent to an outside party.

NO.183 A security controls assessor intends to perform a holistic configuration compliance test of networked assets. The assessor has been handed a package of definitions provided in XML format, and many of the files have two common tags within them: “<object object_ref=… />” and
“<state state_ref=… />”. Which of the following tools BEST supports the use of these definitions?

HTTP interceptor

Static code analyzer

SCAP scanner

XML fuzzer

NO.184 The Information Security Officer (ISO) is reviewing new policies that have been recently made effective and now apply to the company. Upon review, the ISO identifies a new requirement to implement two-factor authentication on the company’s wireless system. Due to budget constraints, the company will be unable to implement the requirement for the next two years. The ISO is required to submit a policy exception form to the Chief Information Officer (CIO). Which of the following are MOST important to include when submitting the exception form? (Select THREE).

Business or technical justification for not implementing the requirements.

Risks associated with the inability to implement the requirements.

Industry best practices with respect to the technical implementation of the current controls.

All sections of the policy that may justify non-implementation of the requirements.

A revised DRP and COOP plan to the exception form.

Internal procedures that may justify a budget submission to implement the new requirement.

Current and planned controls to mitigate the risks.

The Exception Request must include:
A description of the non-compliance.
The anticipated length of non-compliance (2-year maximum). The proposed assessment of risk associated with non-compliance. The proposed plan for managing the risk associated with non- compliance. The proposed metrics for evaluating the success of risk management (if risk is significant). The proposed review date to evaluate progress toward compliance. An endorsement of the request by the appropriate Information Trustee (VP or Dean).

NO.185 The administrator is troubleshooting availability issues on an FCoE-based storage array that uses deduplication. The single controller in the storage array has failed, so the administrator wants to move the drives to a storage array from a different manufacturer in order to access the data.
Which of the following issues may potentially occur?

The data may not be in a usable format.

The new storage array is not FCoE based.

The data may need a file system check.

The new storage array also only has a single controller.

Fibre Channel over Ethernet (FCoE) is a computer network technology that encapsulates Fibre Channel frames over Ethernet networks. This allows Fibre Channel to use 10 Gigabit Ethernet networks (or higher speeds) while preserving the Fibre Channel protocol. When moving the disks to another storage array, you need to ensure that the array supports FCoE, not just regular Fiber Channel. Fiber Channel arrays and Fiber Channel over Ethernet arrays use different network connections, hardware and protocols. Fiber Channel arrays use the Fiber Channel protocol over a dedicated Fiber Channel network whereas FCoE arrays use the Fiber Channel protocol over an Ethernet network.

NO.186 After investigating virus outbreaks that have cost the company $1,000 per incident, the company’s Chief Information Security Officer (CISO) has been researching new antivirus software solutions to use and be fully supported for the next two years. The CISO has narrowed down the potential solutions to four candidates that meet all the company’s performance and capability requirements:

Using the table above, which of the following would be the BEST business-driven choice among five possible solutions?

Product A

Product B

Product C

Product D

Product E

部分：（无）

NO.187 A security manager recently categorized an information system. During the categorization effort, the manager determined the loss of integrity of a specific information type would impact business significantly.
Based on this, the security manager recommends the implementation of several solutions. Which of the following, when combined, would BEST mitigate this risk? (Select TWO.)

Accesscontrol

Whitelisting

Signing

Validation

Bootattestation

NO.188 A security technician is incorporating the following requirements in an RFP for a new SIEM:
* New security notifications must be dynamically implemented by the SIEM engine
* The SIEM must be able to identify traffic baseline anomalies
* Anonymous attack data from all customers must augment attack detection and risk scoring Based on the above requirements, which of the following should the SIEM support?
(选择两个）。

Autoscaling search capability

Machine learning

Multisensor deployment

Big Data analytics

Cloud-based management

Centralized log aggregation

NO.189 An assessor identifies automated methods for identifying security control compliance through validating sensors at the endpoint and at Tier 2. Which of the following practices satisfy continuous monitoring of authorized information systems?

Independent verification and validation

Security test and evaluation

Risk assessment

Ongoing authorization

说明
Ongoing assessment and authorization is often referred to as continuous monitoring. It is a process that determines whether the set of deployed security controls in an information system continue to be effective with regards to planned and unplanned changes that occur in the system and its environment over time.
Continuous monitoring allows organizations to evaluate the operating effectiveness of controls on or near a real-time basis. Continuous monitoring enables the enterprise to detect control failures quickly because it transpires immediately or closely after events in which the key controls are utilized.

NO.190 The Chief Financial Officer (CFO) of a major hospital system has received a ransom letter that demands a large sum of cryptocurrency be transferred to an anonymous account. If the transfer does not take place within ten hours, the letter states that patient information will be released on the dark web. A partial listing of recent patients is included in the letter. This is the first indication that a breach took place. Which of the following steps should be done FIRST?

Review audit logs to determine the extent of the breach

Pay the hacker under the condition that all information is destroyed

Engage a counter-hacking team to retrieve the data

Notify the appropriate legal authorities and legal counsel

说明/参考：

NO.191 It has come to the IT administrator’s attention that the “post your comment” field on the company blog page has been exploited, resulting in cross-site scripting attacks against customers reading the blog. Which of the following would be the MOST effective at preventing the “post your comment” field from being exploited?

Update the blog page to HTTPS

Filter metacharacters

Install HIDS on the server

Patch the web application

Perform client side input validation

说明
A general rule of thumb with regards to XSS is to “Never trust user input and always filter meta-characters.”

NO.192 After a large organization has completed the acquisition of a smaller company, the smaller company must implement new host-based security controls to connect its employees’ devices to the network. Given that the network requires 802.1X EAP-PEAP to identify and authenticate devices, which of the following should the security administrator do to integrate the new employees’ devices into the network securely?

Distributea NACclientanduse the clienttopush the company’sprivatekeytoallthe newdevices.

Distributethe device connection policyanda unique public/private keypair toeach newemployee’s device.

Installaself-signed SSL certificate on the company’sRADIUS server anddistribute thecertificate’s public key to all new client devices.

Installan 802.1Xsupplicantonall new devicesandleteachdevice generate a self-signed certificateto use for network access.

NO.193 A security analyst who is concerned about sensitive data exfiltration reviews the following:

Which of the following tools would allow the analyst to confirm if data exfiltration is occuring?

Port scanner

SCAP tool

File integrity monitor

Protocol analyzer

NO.194 A company provides on-demand cloud computing resources for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for customer access to the administrative website. The security administrator at the company has uncovered a breach in data confidentiality. Sensitive data from customer A was found on a hidden directory within the VM of company
B. Company B is not in the same industry as company A and the two are not competitors. Which of the following has MOST likely occurred?

Both VMs were left unsecured and an attacker was able to exploit network vulnerabilities to access each and move the data.

A stolen two factor token was used to move data from one virtual guest to another host on the same network segment.

A hypervisor server was left un-patched and an attacker was able to use a resource exhaustion attack to gain unauthorized access.

An employee with administrative access to the virtual guests was able to dump the guest memory onto a mapped disk.

说明
In this question, two virtual machines have been accessed by an attacker. The question is asking what is MOST likely to have occurred.
It is common for operating systems to not be fully patched. Of the options given, the most likely occurrence is that the two VMs were not fully patched allowing an attacker to access each of them. The attacker could then copy data from one VM and hide it in a hidden folder on the other VM.

NO.195 A security administrator has been asked to select a cryptographic algorithm to meet the criteria of a new application. The application utilizes streaming video that can be viewed both on computers and mobile devices. The application designers have asked that the algorithm support the transport encryption with the lowest possible performance overhead.
Which of the following recommendations would BEST meet the needs of the application designers? (Select TWO).

Use AES in Electronic Codebook mode

Use RC4 in Cipher Block Chaining mode

Use RC4 with Fixed IV generation

Use AES with cipher text padding

Use RC4 with a nonce generated IV

Use AES in Counter mode

In cryptography, an initialization vector (IV) is a fixed-size input to a cryptographic primitive that is typically required to be random or pseudorandom. Randomization is crucial for encryption schemes to achieve semantic security, a property whereby repeated usage of the scheme under the same key does not allow an attacker to infer relationships between segments of the encrypted message.
Some cryptographic primitives require the IV only to be non-repeating, and the required randomness is derived internally. In this case, the IV is commonly called a nonce (number used once), and the primitives are described as stateful as opposed to randomized. This is because the IV need not be explicitly forwarded to a recipient but may be derived from a common state updated at both sender and receiver side. An example of stateful encryption schemes is the counter mode of operation, which uses a sequence number as a nonce.
AES is a block cipher. Counter mode turns a block cipher into a stream cipher. It generates the next keystream block by encrypting successive values of a “counter”. The counter can be any function which produces a sequence which is guaranteed not to repeat for a long time, although an actual increment-by-one counter is the simplest and most popular.

NO.196 The government is concerned with remote military missions being negatively being impacted by the use of technology that may fail to protect operational security. To remediate this concern, a number of solutions have been implemented, including the following:
* End-to-end encryption of all inbound and outbound communication, including personal email and chat sessions that allow soldiers to securely communicate with families.
* Layer 7 inspection and TCP/UDP port restriction, including firewall rules to only allow TCP port 80 and 443 and approved applications
* A host-based whitelist of approved websites and applications that only allow mission-related tools and sites
* The use of satellite communication to include multiple proxy servers to scramble the source IP address Which of the following is of MOST concern in this scenario?

Malicious actors intercepting inbound and outbound communication to determine the scope of the mission

Family members posting geotagged images on social media that were received via email from soldiers

The effect of communication latency that may negatively impact real-time communication with mission control

The use of centrally managed military network and computers by soldiers when communicating with external parties

NO.197 A technician is validating compliance with organizational policies. The user and machine accounts in the AD are not set to expire, which is non-compliant. Which of the following network tools would provide this type of information?

SIEM server

IDS appliance

SCAP scanner

HTTP interceptor

SIEM is a logging which I guess could find this but I don’t think this is the right answer since this doesnt indicate it was a change made by anyone and I don’t think a logging tool would just pull that information without reason.
IDS does not monitor this. This is not a part of what an IDS does.
HTTP interceptor is completely irrelevant to this question.

NO.198 A security consultant is attempting to discover if the company is utilizing databases on client machines to store the customer data. The consultant reviews the following information:

Which of the following commands would have provided this output?