CAS-005 practice questions 131–140

1. Question 131 · 393 in bank

   An organization receives OSINT reports about an increase in ransomware targeting fileshares at peer companies. The organization wants to deploy hardening policies to its servers and workstations in order to contain potential ransomware. Which of the following should an engineer do to best achieve this goal?

   • AAllow only interactive log-in for users on workstations and restrict port 445 traffic to fileshares.
   • BEnable biometric authentication mechanisms on user workstations and block port 53 traffic.
   • CInstruct users to use a password manager when generating new credentials and secure port 443 traffic.
   • DGive users permission to rotate administrator passwords and deny port 80 traffic.

   Show answer

   Answer: A

   Next question

2. Question 132 · 393 in bank

   A malicious actor exploited firmware vulnerabilities and used rootkits in an attack on an organization. After the organization recovered from the incident, an engineer needs to recommend a solution that reduces the likelihood of the same type of attack in the future. Which of the following is the most relevant solution?

   • AEnabling software integrity checks
   • BInstalling self-encrypting drives
   • CImplementing measured boot
   • DConfiguring host-based encryption

   Show answer

   Answer: C

   Next question

3. Question 133 · 393 in bank

   Which of the following enables the meaningful manipulation of encrypted data when the processor does not know the encryption key?

   • ASimultaneous authentication of equals
   • BEnvelope encryption
   • CAuthenticated encryption with associated data
   • DHomomorphic encryption

   Show answer

   Answer: D

   Next question

4. Question 134 · 393 in bank

   Select 3

   Emails that the marketing department is sending to customers are going to the customers’ spam folders. The security team is investigating the issue and discovers that the certificates used by the email server were reissued, but DNS records had not been updated. Which of the following should the security team update in order to fix this issue? (Choose three.)

   • ADMARC
   • BSPF
   • CDKIM
   • DDNSSEC
   • ESASE
   • FSAN
   • GSOA
   • HMX

   Show answer

   Answer: ABC

   Next question

5. Question 135 · 393 in bank

   A security engineer performed a code scan that resulted in many false positives. The security engineer must find a solution that improves the quality of scanning results before application deployment. Which of the following is the best solution?

   • ALimiting the tool to a specific coding language and tuning the rule set
   • BConfiguring branch protection rules and dependency checks
   • CUsing an application vulnerability scanner to identify coding flaws in production
   • DPerforming updates on code libraries before code development

   Show answer

   Answer: A

   Next question

6. Question 136 · 393 in bank

   A global company with a remote workforce implemented a new VPN solution. After deploying the VPN solution to several hundred users, the help desk starts receiving reports of slow access to both internally and externally available applications. A security analyst reviews the following: VPN client routing: 0.0.0.0/0 eth1 Which of the following solutions should the analyst use to fix this issue?

   • AMove the servers to a screened subnet.
   • BEnable split tunneling.
   • CConfigure an NAC solution.
   • DImplement DNS over HTTPS.

   Show answer

   Answer: B

   Next question

7. Question 137 · 393 in bank

   A security analyst is reviewing suspicious log-in activity and sees the following data in the SIEM:

   

   Which of the following is the most appropriate action for the analyst to take?

   • AUpdate the log configuration settings on the directory server that is not being captured properly.
   • BHave the admin account owner change their password to avoid credential stuffing.
   • CBlock employees from logging in to applications that are not part of their business area.
   • DImplement automation to disable accounts that have been associated with high-risk activity.

   Show answer

   Answer: A

   Next question

8. Question 138 · 393 in bank

   An organization determined its preparedness for a ransomware attack is inadequate. A security administrator is working on ways to improve and monitor the organization's response to ransomware attacks. Which of the following is the best action for the administrator to take?

   • AConduct backup testing.
   • BDefine the recovery point objective.
   • CPerform a business impact analysis.
   • DVerify the encryption key length.

   Show answer

   Answer: A

   Next question

9. Question 139 · 393 in bank

   A security engineer receives an alert from the SIEM platform indicating a possible malicious action on the internal network. The engineer generates a report that outputs the logs associated with the incident:

   

   Which of the following actions best enables the engineer to investigate further?

   • AConsulting logs from the enterprise password manager
   • BSearching dark web monitoring resources for exposure
   • CReviewing audit logs from privileged actions
   • DQuerying user behavior analytics data

   Show answer

   Answer: C

   Next question

10. Question 140 · 393 in bank

    A security engineer must integrate device attestation into user authentication and authorization workflows for mobile devices. Which of the following best meets the requirements?

    • AEnforcing a security boundary for all devices outside the perimeter network
    • BEnabling multifactor authentication using biometrics on access attempts
    • CImplementing single sign-on to centralize access control enforcement
    • DConfiguring device profiling for patch level and jailbreak status

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CAS-005 practice, question 131. 393 questions available.