CAS-005 practice questions 331–340

1. Question 331 · 393 in bank

   An organization is deploying a new data lake that will centralize records from several applications. During the design phase, the security architect identifies the following requirements: • The sensitivity levels of the data is different. • The data must be accessed through stateless API calls after authentication. • Different users will have access to different data sets. Which of the following should the architect implement to best meet these requirements?

   • ADirectory services
   • B802.1X with EAP-TLS
   • COpenID Connect
   • DCASB

   Show answer

   Answer: C

   Next question

2. Question 332 · 393 in bank

   Select 2

   A penetration tester is drafting a report of findings and recommendations. Multiple EOL biomedical devices were compromised using a combination of known-exploit payloads for CVEs and VLAN hopping. The tester acknowledges that the systems cannot be changed or replaced in the hospital due to regulatory, safety, and cost reasons. Which of the following are the most effective controls for this scenario? (Choose two.)

   • ADeploying an IDS with active response for threat activities from a network tap
   • BImplementing QoS that limits the throughput of the link speeds from some VLANs
   • CLimiting trunking protocols to specific uplink ports of access switches
   • DAdding a proxy and requiring medical staff to authenticate every connection
   • EInserting an in-line IPS between network segments of the affected hosts
   • FPerforming security awareness training for these devices users

   Show answer

   Answer: CE

   Next question

3. Question 333 · 393 in bank

   A security engineer needs to secure the OT environment based on the following requirements: • Isolate the OT network segment. • Restrict internet access. • Apply security updates to workstations. • Provide remote access to third-party vendors. Which of the following design strategies should the engineer implement to best meet these requirements?

   • ADeploy a jump box on the third-party network to access the ОТ environment and provide updates using a physical delivery method on the workstations.
   • BImplement a bastion host in the ОТ network with security tools in place to monitor access and use a dedicated update server for the workstations.
   • CEnable outbound internet access on the ОТ firewall to any destination IP address and use the centralized update server for the workstations.
   • DCreate a staging environment on the ОТ network for the third-party vendor to access and enable automatic updates on the workstations.

   Show answer

   Answer: B

   Next question

4. Question 334 · 393 in bank

   Which of the following best explains an AI model denial-of-service attack?

   • AUsers posting large, computationally intensive data sets
   • BUntrustworthy and unverified model output
   • CAn adversary attacking the API of an AI service
   • DUsing the model output to understand its parameters or architecture

   Show answer

   Answer: A

   Next question

5. Question 335 · 393 in bank

   A security architect is designing Zero Trust enforcement policies for all end users. The majority of users work remotely and travel frequently for work. Which of the following controls should the security architect do first?

   • ASwitch user MFA from software-based tokens to hardware time-based OTPs.
   • BImplement TLS decryption and inspect inbound and outbound network traffic.
   • CEnforce daily posture compliance checks against the endpoint security controls.
   • DDeploy context-aware reauthentication with UBA baseline deviations.

   Show answer

   Answer: C

   Next question

6. Question 336 · 393 in bank

   Multiple users are continuously being prompted to use MFA to log in to their systems. The security team plans to implement policy changes that could address this type of issue for users without reducing the security of user accounts. Which of the following rule changes is the most secure?

   • ACreating a conditional access rule that does not require MFA upon login when the activity originates from the corporate network
   • BCreating a conditional access rule that does not require MFA when logging in with any user accounts, regardless of where the login occurs
   • CCreating a conditional access rule that requires MFA only when logging in to the company email provider
   • DCreating a conditional access rule that requires MFA upon all logins, but taking away some password complexity requirements

   Show answer

   Answer: A

   Next question

7. Question 337 · 393 in bank

   A security analyst is performing threat modeling for a new AI chatbot. The AI chatbot will be rolled out to help customers develop configuration information within the company's SaaS offering. Which of the following issues would require involvement from the company's internal legal team?

   • AAn internal user finds a way to use prompt injection to disregard guardrails.
   • BA DoS vulnerability exists that could impact all customers who use the chatbot.
   • CA bug bounty of an exploitable model inversion vulnerability is submitted.
   • DUser consent is not being collected before training models on customer data.
   • EAn access control issue is allowing the model to be poisoned with incorrect information.

   Show answer

   Answer: D

   Next question

8. Question 338 · 393 in bank

   A network security architect is working on capturing network traffic to support the following objectives in the pictured network: • Capture relevant traffic to share with a threat intelligence vendor. • Collect only traffic that could indicate a potential network intrusion. • Minimize the budget and resource requirements of the collected traffic.

   

   Which of the following is the best way for the network security architect to capture network traffic?

   • APlacing a network tap on the ISP router
   • BConfiguring a span port on the core switch
   • CDeploying a transparent proxy on the firewall
   • DConnecting a network hub to the IDS device

   Show answer

   Answer: B

   Next question

9. Question 339 · 393 in bank

   A security analyst is attempting to determine which user accessed an internal web server. The analyst obtains the following address assignment logs from the VPN and logs from the domain when authenticating for the VPN from the SIEM:

   

   Which of the following actions should the analyst take?

   • AConfirm that the workstation and hostnames are the same in both logs.
   • BUse the assigned VPN addresses for failed logins to identify the user.
   • CEnsure that all log sources are configured to the same time zone.
   • DReduce the delay in VPN logs being sent to the SIEM.

   Show answer

   Answer: C

   Next question

10. Question 340 · 393 in bank

    Select 2

    A company in a regulated industry experiences a data breach after an employee clicks on an email phishing link and enters credentials, leading to the exposure of sensitive information. Which of the following should the company do to prevent future attacks? (Choose two.)

    • ADeploy a NAC.
    • BImplement deep packet inspection.
    • CEstablish password complexity requirements.
    • DImplement a WAF.
    • EEnforce multifactor authentication.
    • FCreate a security awareness training program.

    Show answer

    Answer: EF

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CAS-005 practice, question 331. 393 questions available.