CAS-005 practice questions 261–270

1. Question 261 · 393 in bank

   An organization that performs real-time financial processing is implementing a new backup solution. Given the following business requirements: • The backup solution must reduce the risk for potential backup compromise • The backup solution must be resilient to a ransomware attack • The time to restore from backups is less important than the backup data integrity • Multiple copies of production data must be maintained. Which of the following backup strategies best meets these requirements?

   • ACreating a secondary, immutable database and adding live data on a continuous basis
   • BUtilizing two connected storage arrays and ensuring the arrays constantly sync
   • CEnabling remote journaling on the databases to ensure real-time transactions are mirrored
   • DSetting up anti-tampering on the databases to ensure data cannot be changed unintentionally

   Show answer

   Answer: A

   Next question

2. Question 262 · 393 in bank

   A system of globally distributed certificate servers connected to HSMs provide certificate security services for a publicly available PKI. These services include OCSP, certificate revocation list issuance, and certificate signing/issuance. The HSMs are all physical devices. All other servers are virtualized. Each global site has a network load balancer, and the sites are configured to load balance between sites. Users report occasional but persistent log-on failures to different PKI-enabled websites. There is no apparent pattern to the failures. Some OCSP responses must be signed by the HSM. Each HSM is connected to a physical server containing multiple VMs for the local site with CAT 6e network cable. The backplane connecting the VMs is fiber based. Which of the following would best reduce the OCSP response time in order to rule out the connection between the certificate server and HSM as a cause of the user-reported issues?

   • AVirtualize the HSMs and convert the virtualized servers to physical systems.
   • BReplace the copper-based network infrastructure with fiber.
   • CShorten the time the duration certificates are valid to 72 hours and implement ACME.
   • DReduce the number of global sites while increasing the number of HSMs.

   Show answer

   Answer: B

   Next question

3. Question 263 · 393 in bank

   Select 2

   An administrator brings the company's fleet of mobile devices into its PKI in order to align device WLAN NAC configurations with existing workstations and laptops. Thousands of devices need to be reconfigured in a cost-effective, time-efficient, and secure manner. Which of the following actions best achieve this goal? (Choose two.)

   • AUsing the existing MDM solution to integrate with directory services for authentication and enrollment
   • BDeploying netAuth extended key usage certificate templates
   • CDeploying serverAuth extended key usage certificate templates
   • DDeploying clientAuth extended key usage certificate templates
   • EConfiguring SCEP on the CA with an OTP for bulk device enrollment
   • FSubmitting a CSR to the CAto obtain a single certificate that can be used across all devices

   Show answer

   Answer: AE

   Next question

4. Question 264 · 393 in bank

   The ISAC for the retail industry recently released a report regarding social engineering tactics in which small groups create distractions for employees while other malicious individuals install advanced card skimmers on the payment systems. The Chief Information Security Officer (CISO) thinks that security awareness training, technical control implementations, and governance already in place is adequate to protect from this threat. The board would like to test these controls. Which of the following should the CISO recommend?

   • ADark web monitoring
   • BAdversary emulation engagement
   • CSupply chain risk consultation
   • DTabletop exercises

   Show answer

   Answer: B

   Next question

5. Question 265 · 393 in bank

   A company finds logs with modified time stamps when compared to other systems. The security team decides to improve logging and auditing for incident response. Which of the following should the team do to best accomplish this goal?

   • AIntegrate a file-monitoring tool with the SIEM.
   • BChange the log solution and integrate it with the existing SIEM.
   • CImplement a central logging server, allowing only log ingestion.
   • DRotate and back up logs every 24 hours, encrypting the backups.

   Show answer

   Answer: C

   Next question

6. Question 266 · 393 in bank

   A company recently experienced a ransomware attack. Although the company performs systems and data backup on a schedule that aligns with its RPO requirements, the backup administrator could not recover critical systems and data from its offline backups to meet the RPO. Eventually, the systems and data were restored with information that was six months outside of RPO requirements. Which of the following actions should the company take to reduce the risk of a similar attack?

   • AEncrypt and label the backup tapes with the appropriate retention schedule before they are sent to the off-site location.
   • BImplement a business continuity process that includes reverting manual business processes.
   • CPerform regular disaster recovery testing of IT and non-IT systems and process.
   • DCarry out a tabletop exercise to update and verify the RACI matrix with IT and critical business functions.

   Show answer

   Answer: C

   Next question

7. Question 267 · 393 in bank

   An organization hires a security consultant to establish a SOC that includes a threat-modeling function. During initial activities, the consultant works with system engineers to identify antipatterns within the environment. Which of the following is most critical for the engineers to disclose to the consultant during this phase?

   • AResults from the most recent infrastructure access review
   • BA listing of unpatchable IoT devices in use in the data center
   • CNetwork and data flow diagrams covering the production environment
   • DResults from the most recent software composition analysis
   • EA current inventory of cloud resources and SaaS products in use

   Show answer

   Answer: C

   Next question

8. Question 268 · 393 in bank

   In a recent audit, several critical legacy systems, which are externally exposed so that a specific vendor can manage them remotely, were identified. These systems must remain available to the vendor for the next six months. A security team segmented the network so these systems can only communicate with internal resources. Which of the following actions would be most appropriate to restore the vendor's access to manage these systems?

   • ADisable all connections to the systems, and implement a backup solution to capture the needed data to send to the vendor on a weekly basis.
   • BCreate a VPN connection and set up firewall rules so only specific connections are allowed to those systems.
   • CDisable external connections to those systems for the next six months.
   • DIsolate the critical systems so they can only be remotely managed from the internet.

   Show answer

   Answer: B

   Next question

9. Question 269 · 393 in bank

   While investigating an email server that crashed, an analyst reviews the following log files:

   

   Which of the following is most likely the root cause?

   • AThe administrator's account credentials were intercepted and reused.
   • BThe backup process did not complete and caused cascading failure.
   • CA hardware failure in the storage array caused the mailboxes to be inaccessible.
   • DA user with low privileges was able to escalate and erase all mailboxes.

   Show answer

   Answer: D

   Next question

10. Question 270 · 393 in bank

    An incident response analyst finds the following content inside of a log file that was collected from a compromised server:

    

    Which of the following is the best action to prevent future compromise?

    • ABlocking the processing of external files by forwarding them to another server for processing
    • BImplementing an allow list for all text boxes throughout the web application
    • CFiltering inserted characters for all user inputs and allowing only ASCII characters
    • DImproving file-parsing capabilities to stop external entities from executing commands

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CAS-005 practice, question 261. 393 questions available.