CAS-005 practice questions 121–130

1. Question 121 · 393 in bank

   An analyst reviews a SIEM and generates the following report:

   

   Only HOST002 is authorized for internet traffic. Which of the following statements is accurate?

   • AThe VM002 host is misconfigured and needs to be revised by the network team.
   • BThe HOST002 host is under attack, and a security incident should be declared.
   • CThe SIEM platform is reporting multiple false positives on the alerts.
   • DThe network connection activity is unusual, and a network infection is highly possible.

   Show answer

   Answer: C

   Next question

2. Question 122 · 393 in bank

   A company wants to implement a three-tier approach to separate the web, database, and application servers. A security administrator must harden the environment. Which of the following is the best solution?

   • ADeploying a VPN to prevent remote locations from accessing server VLANs
   • BConfiguring a SASE solution to restrict users to server communication
   • CImplementing microsegmentation on the server VLANs
   • DInstalling a firewall and making it the network core

   Show answer

   Answer: C

   Next question

3. Question 123 · 393 in bank

   A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate. Which of the following is the best way to meet this objective?

   • AConfiguring an API integration to aggregate the different data sets
   • BCombining back-end application storage into a single, relational database
   • CPurchasing and deploying commercial off-the-shelf aggregation software
   • DMigrating application usage logs to on-premises storage

   Show answer

   Answer: A

   Next question

4. Question 124 · 393 in bank

   Select 2

   A vulnerability scan on a web server identified the following:

   

   Which of the following actions would most likely eliminate on-path decryption attacks? (Choose two.)

   • ADisallowing cipher suites that use ephemeral modes of operation for key agreement
   • BRemoving support for CBC-based key exchange and signing algorithms
   • CAdding TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA256
   • DImplementing HIPS rules to identify and block BEAST attack attempts
   • ERestricting cipher suites to only allow TLS_RSA_WITH_AES_128_CBC_SHA
   • FIncreasing the key length to 256 for TLS_RSA_WITH_AES_128_CBC_SHA

   Show answer

   Answer: BC

   Next question

5. Question 125 · 393 in bank

   A company’s help desk is experiencing a large number of calls from the finance department stating access issues to www.bank.com. The security operations center reviewed the following security logs:

   

   Which of the following is most likely the cause of the issue?

   • ARecursive DNS resolution is failing.
   • BThe DNS record has been poisoned.
   • CDNS traffic is being sinkholed.
   • DThe DNS was set up incorrectly.

   Show answer

   Answer: B

   Next question

6. Question 126 · 393 in bank

   A financial services organization is using AI to fully automate the process of deciding client loan rates. Which of the following should the organization be most concerned about from a regulatory perspective?

   • AModel explain ability
   • BCredential theft
   • CPossible prompt injections
   • DExposure to social engineering

   Show answer

   Answer: A

   Next question

7. Question 127 · 393 in bank

   A security analyst is reviewing the following log:

   

   Which of the following possible events should the security analyst investigate further?

   • AA macro that was prevented from running
   • BA text file containing passwords that were leaked
   • CA malicious file that was run in this environment
   • DA PDF that exposed sensitive information improperly

   Show answer

   Answer: C

   Next question

8. Question 128 · 393 in bank

   A security operations engineer needs to prevent inadvertent data disclosure when encrypted SSDs are reused within an enterprise. Which of the following is the most secure way to achieve this goal?

   • AExecuting a script that deletes and overwrites all data on the SSD three times
   • BWiping the SSD through degaussing
   • CSecurely deleting the encryption keys used by the SSD
   • DWriting non-zero, random data to all cells of the SSD

   Show answer

   Answer: C

   Next question

9. Question 129 · 393 in bank

   A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems. Given the following output:

   

   Which of the following actions would address the root cause of this issue?

   • AAutomating the patching system to update base images
   • BRecompiling the affected programs with the most current patches
   • CDisabling unused/unneeded ports on all servers
   • DDeploying a WAF with virtual patching upstream of the affected systems.

   Show answer

   Answer: A

   Next question

10. Question 130 · 393 in bank

    A company established a new process for business analysts to receive emails that contain links for purchase requests. The new process requires links to be submitted through new emails. Which of the following is the best way to secure this process without disrupting order fulfillment?

    • ADeploying a browser isolation solution
    • BBlocking all potentially malicious links
    • CEnforcing security awareness training
    • DImplementing DNS filtering

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CAS-005 practice, question 121. 393 questions available.