CompTIA Advanced Security Practitioner (CASP+) CAS-004 v1.0

Page:    1 / 27   
Exam contains 400 questions

A developer is creating a new mobile application for a company. The application uses REST API and TLS 1.2 to communicate securely with the external back-end server. Due to this configuration, the company is concerned about HTTPS interception attacks.
Which of the following would be the BEST solution against this type of attack?

  • A. Cookies
  • B. Wildcard certificates
  • C. HSTS
  • D. Certificate pinning


Answer : C

Reference:
https://cloud.google.com/security/encryption-in-transit

A user in the finance department uses a laptop to store a spreadsheet that contains confidential financial information for the company. Which of the following would be the BEST way to protect the file while the user travels between locations? (Choose two.)

  • A. Encrypt the laptop with full disk encryption.
  • B. Back up the file to an encrypted flash drive.
  • C. Place an ACL on the file to only allow access to specified users.
  • D. Store the file in the user profile.
  • E. Place an ACL on the file to deny access to everyone.
  • F. Enable access logging on the file.


Answer : AB

A threat hunting team receives a report about possible APT activity in the network.
Which of the following threat management frameworks should the team implement?

  • A. NIST SP 800-53
  • B. MITRE ATT&CK
  • C. The Cyber Kill Chain
  • D. The Diamond Model of Intrusion Analysis


Answer : A

Reference:
https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf

Device event logs sourced from MDM software as follows:

Which of the following security concerns and response actions would BEST address the risks posed by the device in the logs?

  • A. Malicious installation of an application; change the MDM configuration to remove application ID 1220.
  • B. Resource leak; recover the device for analysis and clean up the local storage.
  • C. Impossible travel; disable the deviceג€™s account and access while investigating.
  • D. Falsified status reporting; remotely wipe the device.


Answer : C

An energy company is required to report the average pressure of natural gas used over the past quarter. A PLC sends data to a historian server that creates the required reports.
Which of the following historian server locations will allow the business to get the required reports in an ׀׀¢ and IT environment?

  • A. In the ׀׀¢ environment, use a VPN from the IT environment into the ׀׀¢ environment.
  • B. In the ׀׀¢ environment, allow IT traffic into the ׀׀¢ environment.
  • C. In the IT environment, allow PLCs to send data from the ׀׀¢ environment to the IT environment.
  • D. Use a screened subnet between the ׀׀¢ and IT environments.


Answer : C

Which of the following is a benefit of using steganalysis techniques in forensic response?

  • A. Breaking a symmetric cipher used in secure voice communications
  • B. Determining the frequency of unique attacks against DRM-protected media
  • C. Maintaining chain of custody for acquired evidence
  • D. Identifying least significant bit encoding of data in a .wav file


Answer : D

Reference:
https://www.garykessler.net/library/fsc_stego.html

A new web server must comply with new secure-by-design principles and PCI DSS. This includes mitigating the risk of an on-path attack. A security analyst is reviewing the following web server configuration:

Which of the following ciphers should the security analyst remove to support the business requirements?

  • A. TLS_AES_128_CCM_8_SHA256
  • B. TLS_DHE_DSS_WITH_RC4_128_SHA
  • C. TLS_CHACHA20_POLY1305_SHA256
  • D. TLS_AES_128_GCM_SHA256


Answer : C

A security analyst notices a number of SIEM events that show the following activity:

Which of the following response actions should the analyst take FIRST?

  • A. Disable powershell.exe on all Microsoft Windows endpoints.
  • B. Restart Microsoft Windows Defender.
  • C. Configure the forward proxy to block 40.90.23.154.
  • D. Disable local administrator privileges on the endpoints.


Answer : A

A company has hired a third party to develop software as part of its strategy to be quicker to market. The company's policy outlines the following requirements:
✑ The credentials used to publish production software to the container registry should be stored in a secure location.
✑ Access should be restricted to the pipeline service account, without the ability for the third-party developer to read the credentials directly.
Which of the following would be the BEST recommendation for storing and monitoring access to these shared credentials?

  • A. TPM
  • B. Local secure password file
  • C. MFA
  • D. Key vault


Answer : D

Reference:
https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/tpm-fundamentals

A business stores personal client data of individuals residing in the EU in order to process requests for mortgage loan approvals.
Which of the following does the business's IT manager need to consider?

  • A. The availability of personal data
  • B. The right to personal data erasure
  • C. The companyג€™s annual revenue
  • D. The language of the web application


Answer : B

Reference:
https://gdpr.eu/right-to-be-forgotten/#:~:text=Also%20known%20as%20the%20right,to%20delete%20their%20personal%20data.&text=The%
20General%20Data%20Protection%20Regulation,collected%2C%20processed%2C%20and%20erased

A company publishes several APIs for customers and is required to use keys to segregate customer data sets.
Which of the following would be BEST to use to store customer keys?

  • A. A trusted platform module
  • B. A hardware security module
  • C. A localized key store
  • D. A public key infrastructure


Answer : D

Reference:
https://developer.android.com/studio/publish/app-signing

An organization wants to perform a scan of all its systems against best practice security configurations.
Which of the following SCAP standards, when combined, will enable the organization to view each of the configuration checks in a machine-readable checklist format for full automation? (Choose two.)

  • A. ARF
  • B. XCCDF
  • C. CPE
  • D. CVE
  • E. CVSS
  • F. OVAL


Answer : BF

Reference:
https://www.govinfo.gov/content/pkg/GOVPUB-C13-9ecd8eae582935c93d7f410e955dabb6/pdf/GOVPUB-C13-
9ecd8eae582935c93d7f410e955dabb6.pdf
(p.12)

A company is migrating from company-owned phones to a BYOD strategy for mobile devices. The pilot program will start with the executive management team and be rolled out to the rest of the staff in phases. The company's Chief Financial Officer loses a phone multiple times a year.
Which of the following will MOST likely secure the data on the lost device?

  • A. Require a VPN to be active to access company data.
  • B. Set up different profiles based on the personג€™s risk.
  • C. Remotely wipe the device.
  • D. Require MFA to access company applications.


Answer : C

A security architect works for a manufacturing organization that has many different branch offices. The architect is looking for a way to reduce traffic and ensure the branch offices receive the latest copy of revoked certificates issued by the CA at the organization's headquarters location. The solution must also have the lowest power requirement on the CA.
Which of the following is the BEST solution?

  • A. Deploy an RA on each branch office.
  • B. Use Delta CRLs at the branches.
  • C. Configure clients to use OCSP.
  • D. Send the new CRLs by using GPO.


Answer : C

Reference:
https://www.sciencedirect.com/topics/computer-science/revoke-certificate

After a security incident, a network security engineer discovers that a portion of the company's sensitive external traffic has been redirected through a secondary
ISP that is not normally used.
Which of the following would BEST secure the routes while allowing the network to function in the event of a single provider failure?

  • A. Disable BGP and implement a single static route for each internal network.
  • B. Implement a BGP route reflector.
  • C. Implement an inbound BGP prefix list.
  • D. Disable BGP and implement OSPF.


Answer : B

Page:    1 / 27   
Exam contains 400 questions

Talk to us!


Have any questions or issues ? Please dont hesitate to contact us

Certlibrary.com is owned by MBS Tech Limited: Room 1905 Nam Wo Hong Building, 148 Wing Lok Street, Sheung Wan, Hong Kong. Company registration number: 2310926
Certlibrary doesn't offer Real Microsoft Exam Questions. Certlibrary Materials do not contain actual questions and answers from Cisco's Certification Exams.
CFA Institute does not endorse, promote or warrant the accuracy or quality of Certlibrary. CFA® and Chartered Financial Analyst® are registered trademarks owned by CFA Institute.
Terms & Conditions | Privacy Policy