CAS-005 practice questions 251–260

1. Question 251 · 393 in bank

   Which of the following is a security concern for DNP3?

   • AFree-form messages require support.
   • BAvailable function codes are not standardized.
   • CAuthentication is not allocated.
   • DIt is an open source protocol.

   Show answer

   Answer: C

   Next question

2. Question 252 · 393 in bank

   A security administrator needs to develop a remediation plan to address a large number of vulnerability scan results. Which of the following should the administrator use to determine the vulnerabilities that should be addressed first?

   • ACPE
   • BCCE
   • CCVSS
   • DCVE

   Show answer

   Answer: C

   Next question

3. Question 253 · 393 in bank

   An organization is researching the automation capabilities for systems within an OT network. A security analyst wants to assist with creating secure coding practices and would like to learn about the programming languages used on the PLCs. Which of the following programming languages is the most relevant for PLCs?

   • ALadder logic
   • BRust
   • CC
   • DPython
   • EJava

   Show answer

   Answer: A

   Next question

4. Question 254 · 393 in bank

   An organization’s senior security architect would like to develop cyberdefensive strategies based on standardized adversary techniques, tactics, and procedures commonly observed. Which of the following would best support this objective?

   • AOSINT analysis
   • BThe Diamond Model of Intrusion Analysis
   • CMITRE ATT&CK
   • DDeepfake generation
   • EClosed-source intelligence reporting

   Show answer

   Answer: C

   Next question

5. Question 255 · 393 in bank

   A company is looking for a solution to hide data stored in databases. The solution must meet the following requirements: • Be efficient at protecting the production environment • Not require any change to the application • Act at the presentation layer Which of the following techniques should be used?

   • AMasking
   • BSteganography
   • CAlgorithmic
   • DRandom substitution

   Show answer

   Answer: A

   Next question

6. Question 256 · 393 in bank

   A software developer is working on a piece of code required by a new software package. The code should use a protocol to verify the validity of a remote identity. Which of the following should the developer implement in the code?

   • ARSA
   • BOCSP
   • CHSTS
   • DCRL

   Show answer

   Answer: B

   Next question

7. Question 257 · 393 in bank

   An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment’s notice. Which of the following should the organization consider first to address this requirement?

   • AImplement a change management plan to ensure systems are using the appropriate versions.
   • BHire additional on-call staff to be deployed if an event occurs.
   • CDesign an appropriate warm site for business continuity.
   • DIdentify critical business processes and determine associated software and hardware requirements.

   Show answer

   Answer: D

   Next question

8. Question 258 · 393 in bank

   A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears:

   

   Which of the following best describes the analyst’s findings and a potential mitigation technique?

   • AThe findings indicate unsecure references. All potential user input needs to be properly sanitized.
   • BThe findings indicate unsecure protocols. All cookies should be marked as HttpOnly.
   • CThe findings indicate information disclosure. The displayed error message should be modified.
   • DThe findings indicate a SQL injection. The database needs to be upgraded.

   Show answer

   Answer: C

   Next question

9. Question 259 · 393 in bank

   Which of the following is record-level encryption commonly used to do?

   • AProtect database fields.
   • BProtect individual files.
   • CEncrypt individual packets.
   • DEncrypt the master boot record.

   Show answer

   Answer: A

   Next question

10. Question 260 · 393 in bank

    An auditor is reviewing the logs from a web application to determine the source of an incident. The web application architecture includes an internet-accessible application load balancer, a number of web servers in a private subnet, application servers, and one database server in a tiered configuration. The application load balancer cannot store the logs. The following are sample log snippets:

    

    Which of the following should the auditor recommend to ensure future incidents can be traced back to the sources?

    • AEnable the X-Forwarded-For header at the load balancer.
    • BInstall a software-based HIDS on the application servers.
    • CInstall a certificate signed by a trusted CA.
    • DUse stored procedures on the database server.
    • EStore the value of the $_SERVER['REMOTE_ADDR'] received by the web servers.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CAS-005 practice, question 251. 393 questions available.