CAS-005 practice questions 181–190

1. Question 181 · 393 in bank

   A security analyst is reviewing the following authentication logs:

   

   Which of the following should the analyst do first?

   • ADisable User2’s account.
   • BDisable User12’s account
   • CDisable User8’s account
   • DDisable User1’s account

   Show answer

   Answer: D

   Next question

2. Question 182 · 393 in bank

   A game developer wants to reach new markets and is advised by legal counsel to include specific age-related sign-up requirements. Which of the following best describes the legal counsel's concerns?

   • AGDPR
   • BLGPD
   • CPCI DSS
   • DCOPPA

   Show answer

   Answer: D

   Next question

3. Question 183 · 393 in bank

   During a recent audit, a company's systems were assessed Given the following information:

   

   Which of the following is the best way to reduce the attack surface?

   • ADeploying an EDR solution to all impacted machines in manufacturing
   • BSegmenting the manufacturing network with a firewall and placing the rules in monitor mode
   • CSetting up an IDS inline to monitor and detect any threats to the software
   • DImplementing an application-aware firewall and writing strict rules for the application access

   Show answer

   Answer: D

   Next question

4. Question 184 · 393 in bank

   A global manufacturing company has an internal application that is critical to making products. This application cannot be updated and must be available in the production area. A security architect is implementing security for the application. Which of the following best describes the action the architect should take?

   • ADisallow wireless access to the application.
   • BDeploy intrusion detection capabilities using a network tap
   • CCreate an acceptable use policy for the use of the application
   • DCreate a separate network for users who need access to the application

   Show answer

   Answer: D

   Next question

5. Question 185 · 393 in bank

   A company wants to perform threat modeling on an internally developed, business-critical application. The Chief Information Security Officer (CISO) is most concerned that the application should maintain 99.999% availability and authorized users should only be able to gain access to data they are explicitly authorized to view. Which of the following threat-modeling frameworks directly addresses the CISO’s concerns about this system?

   • ACAPEC
   • BSTRIDE
   • CATT&CK
   • DTAXII

   Show answer

   Answer: B

   Next question

6. Question 186 · 393 in bank

   A company's internal network is experiencing a security breach and the threat actor is still active Due to business requirements, users in this environment are allowed to utilize multiple machines at the same time. Given the following log snippet:

   

   Which of the following accounts should a security analyst disable to best contain the incident without impacting valid users?

   • Auser-а
   • Buser-b
   • Cuser-с
   • Duser-d

   Show answer

   Answer: D

   Next question

7. Question 187 · 393 in bank

   A security team is responding to malicious activity and needs to determine the scope of impact. The malicious activity appears to affect a certain version of an application used by the organization. Which of the following actions best enables the team to determine the scope of impact?

   • APerforming a port scan
   • BInspecting egress network traffic
   • CReviewing the asset inventory
   • DAnalyzing user behavior

   Show answer

   Answer: C

   Next question

8. Question 188 · 393 in bank

   An organization recently implemented a policy that requires all passwords to be rotated every 90 days. An administrator sees a large volume of failed sign-on logs from multiple servers that are often accessed by users. The administrator determines users are disconnecting from the RDP session but not logging off. Which of the following should the administrator do to prevent account lockouts?

   • AIncrease the account lockout threshold
   • BEnforce password complexity
   • CAutomate logout of inactive sessions
   • DExtend the allowed session length

   Show answer

   Answer: C

   Next question

9. Question 189 · 393 in bank

   A security review revealed that not all of the client proxy traffic is being captured. Which of the following architectural changes best enables the capture of traffic for analysis?

   • AAdding an additional proxy server to each segmented VLAN
   • BSetting up a reverse proxy for client logging at the gateway
   • CConfiguring a span port on the perimeter firewall to ingest logs
   • DEnabling client device logging and system event auditing

   Show answer

   Answer: A

   Next question

10. Question 190 · 393 in bank

    Select 2

    A security architect is onboarding a new EDR agent on servers that traditionally do not have internet access. In order for the agent to receive updates and report back to the management console, some changes must be made. Which of the following should the architect do to best accomplish this requirement? (Choose two.)

    • ACreate a firewall rule to only allow traffic from the subnet to the internet via a proxy.
    • BConfigure a proxy policy that blocks all traffic on port 443
    • CConfigure a proxy policy that allows only fully qualified domain names needed to communicate to a portal
    • DCreate a firewall rule to only allow traffic from the subnet to the internet via port 443.
    • ECreate a firewall rule to only allow traffic from the subnet to the internet to fully qualified names that are not identified as malicious by the firewall vendor
    • FConfigure a proxy policy that blocks only lists of known-bad fully qualified domain names

    Show answer

    Answer: AC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CAS-005 practice, question 181. 393 questions available.