Grab latest CompTIA CAS-003 Dumps as PDF Updated on 2022
Newly Released CAS-003 Dumps for CASP Recertification Certified
CompTIA Advanced Security Practitioner (CASP) CAS-003 Exam
CompTIA Advanced Security Practitioner (CASP) CAS-003 Exam validates the candidate ability in risk management, enterprise security operations, architecture, research, collaboration, and integration of enterprise security. This CAS-003 Exam also tests the candidate have any ideas and techniques of Enterprise Security domain and have a knowledge of how to implement cryptographic techniques like Blockchain-Cryptocurrency and Mobile device encryption.
NEW QUESTION 290
As part of an organization's compliance program. administrators must complete a hardening checklist and note any potential improvements. The process of noting potential improvements in the checklist is MOST likely driven by:
- A. the organization's software development life cycle
- B. the collection of data as part of the continuous monitoring program
- C. changes in operating systems or industry trends
- D. adherence to policies associated with incident response
Answer: B
Explanation:
The objective of a continuous monitoring program is to determine if the complete set of planned, required, and deployed security controls within an information system or inherited by the system continue to be effective over time in light of the inevitable changes that occur.
NEW QUESTION 291
A security manager for a service provider has approved two vendors for connections to the service provider backbone. One vendor will be providing authentication services for its payment card service, and the other vendor will be providing maintenance to the service provider infrastructure sites. Which of the following business agreements is MOST relevant to the vendors and service provider's relationship?
- A. Memorandum of Agreement
- B. Non-Disclosure Agreement
- C. Interconnection Security Agreement
- D. Operating Level Agreement
Answer: C
Explanation:
The Interconnection Security Agreement (ISA) is a document that identifies the requirements for connecting systems and networks and details what security controls are to be used to protect the systems and sensitive data.
Incorrect Answers:
A: A memorandum of agreement (MOA) is a document composed between parties to cooperate on an agreed upon project or meet an agreed objective.
C: A nondisclosure agreement (NDA) is designed to protect confidential information.
D: An operating level agreement (OLA) defines the responsibilities of each partner's internal support group.
References:
Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley & Sons, Indianapolis, 2012, pp. 237, 238
NEW QUESTION 292
Asecurity administrator was informed that a server unexpectedly rebooted. The administrator received an export of syslog entries for analysis:
Which of the following does the log sample indicate? (Choose two.)
- A. Encrypted payroll data was successfully decrypted by the attacker
- B. Syslog entries were lost due to the host being rebooted
- C. Jsmith successfully used a privilege escalation attack
- D. A root user performed an injection attack via kernel module
- E. Buffer overflow in memory paging caused a kernel panic
- F. Payroll data was exfiltrated to an attacker-controlled host
Answer: C,E
NEW QUESTION 293
The helpdesk department desires to roll out a remote support application for internal use on all company computers. This tool should allow remote desktop sharing, system log gathering, chat, hardware logging, inventory management, and remote registry access. The risk management team has been asked to review vendor responses to the RFQ. Which of the following questions is the MOST important?
- A. What snapshot or "undo" features are present in the application?
- B. What encryption standards are used in tracking database?
- C. What encryption standards are used in remote desktop and file transfer functionality?
- D. What are the protections against MITM?
- E. What accountability is built into the remote support application?
Answer: E
NEW QUESTION 294
A security manager recently categorized an information system. During the categorization effort, the manager determined the loss of integrity of a specific information type would impact business significantly. Based on this, the security manager recommends the implementation of several solutions. Which of the following, when combined, would BEST mitigate this risk? (Choose two.)
- A. Validation
- B. Signing
- C. Boot attestation
- D. Access control
- E. Whitelisting
Answer: A,D
NEW QUESTION 295
A security engineer is designing a system in which offshore, outsourced staff can push code from the development environment to the production environment securely. The security engineer is concerned with data loss, while the business does not want to slow down its development process. Which of the following solutions BEST balances security requirements with business need?
- A. Install a client-side VPN on the staff laptops and limit access to the development network
- B. Use online collaboration tools to initiate workstation-sharing sessions with local staff who have access to the development network
- C. Create an IPSec VPN tunnel from the development network to the office of the outsourced staff
- D. Set up a VDI environment that prevents copying and pasting to the local workstations of outsourced staff members
Answer: B
NEW QUESTION 296
A government agency considers confidentiality to be of utmost importance and availability issues to be of least importance. Knowing this, which of the following correctly orders various vulnerabilities in the order of MOST important to LEAST important?
- A. SQL injection, Resource exhaustion, Privilege escalation
- B. Privilege escalation, Application DoS, Buffer overflow
- C. CSRF, Fault injection, Memory leaks
- D. Insecure direct object references, CSRF, Smurf
Answer: D
Explanation:
Explanation
Insecure direct object references are used to access data. CSRF attacks the functions of a web site which could access data. A Smurf attack is used to take down a system.
A direct object reference is likely to occur when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key without any validation mechanism which will allow attackers to manipulate these references to access unauthorized data.
Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious Web site, email, blog, instant message, or program causes a user's Web browser to perform an unwanted action on a trusted site for which the user is currently authenticated. The impact of a successful cross-site request forgery attack is limited to the capabilities exposed by the vulnerable application. For example, this attack could result in a transfer of funds, changing a password, or purchasing an item in the user's context. In effect, CSRF attacks are used by an attacker to make a target system perform a function (funds Transfer, form submission etc.) via the target's browser without knowledge of the target user, at least until the unauthorized function has been committed.
A smurf attack is a type of network security breach in which a network connected to the Internet is swamped with replies to ICMP echo (PING) requests. A smurf attacker sends PING requests to an Internet broadcast address. These are special addresses that broadcast all received messages to the hosts connected to the subnet.
Each broadcast address can support up to 255 hosts, so a single PING request can be multiplied 255 times. The return address of the request itself is spoofed to be the address of the attacker's victim. All the hosts receiving the PING request reply to this victim's address instead of the real sender's address. A single attacker sending hundreds or thousands of these PING messages per second can fill the victim's T-1 (or even T-3) line with ping replies, bring the entire Internet service to its knees.
Smurfing falls under the general category of Denial of Service attacks -- security attacks that don't try to steal information, but instead attempt to disable a computer or network.
NEW QUESTION 297
A regional business is expecting a severe winter storm next week. The IT staff has been reviewing corporate policies on how to handle various situations and found some are missing or incomplete. After reporting this gap in documentation to the information security manager, a document is immediately drafted to move various personnel to other locations to avoid downtime in operations. This is an example of:
- A. a business continuity plan
- B. a disaster recovery plan
- C. an incident response plan
- D. a risk avoidance plan
Answer: B
NEW QUESTION 298
A corporation with a BYOO policy is very concerned about issues that may arise from data ownership. The corporation is investigating a new MOM solution and has gathered the following requirements as part of the requirements-gathering phase
* Each device must be issued a secure token of trust from the corporate PKl
* Al corporate applications and local data must be able to be deleted from a central console.
* Access to corporate data must be restricted on international travel
* Devices must be on the latest OS version within three weeks of an OS release Which of the following should be features in the new MDM solution to meet these requirements? (Select TWO)
- A. Over-the-air update restriction
- B. Biometric requirement to unlock device
- C. Enforced full-device encryption
- D. Application-based containerization
- E. Application allow listing
- F. Geofencing
Answer: C,F
NEW QUESTION 299
A security administrator wants to implement two-factor authentication for network switches and routers. The solution should integrate with the company's RADIUS server, which is used for authentication to the network infrastructure devices. The security administrator implements the following:
* An HOTP service is installed on the RADIUS server.
* The RADIUS server is configured to require the HOTP service for authentication.
The configuration is successfully tested using a software supplicant and enforced across all network devices. Network administrators report they are unable to log onto the network devices because they are not being prompted for the second factor.
Which of the following should be implemented to BEST resolve the issue?
- A. Install a TOTP service on the RADIUS server in addition to the HOTP service. Use the HOTP on older devices that do not support two-factor authentication. Network administrators will use a web portal to log onto these devices.
- B. Configure the RADIUS server to accept the second factor appended to the password. Network administrators will enter a password followed by their token in the password field.
- C. Reconfigure network devices to prompt for username, password, and a token. Network administrators will enter their username and password, and then they will enter the token.
- D. Replace the password requirement with the second factor. Network administrators will enter their username and then enter the token in place of their password in the password field.
Answer: B
NEW QUESTION 300
A critical system audit shows that the payroll system is not meeting security policy due to missing OS security patches. Upon further review, it appears that the system is not being patched at all. The vendor states that the system is only supported on the current OS patch level. Which of the following compensating controls should be used to mitigate the vulnerability of missing OS patches on this system?
- A. Perform reconciliation of all payroll transactions on a daily basis
- B. Monitor the system's security log for unauthorized access to the payroll application
- C. Implement an application layer firewall to protect the payroll system interface
- D. Isolate the system on a secure network to limit its contact with other systems
Answer: D
Explanation:
Explanation
The payroll system is not meeting security policy due to missing OS security patches. We cannot apply the patches to the system because the vendor states that the system isonly supported on the current OS patch level.
Therefore, we need another way of securing the system.
We can improve the security of the system and the other systems on the network by isolating the payroll system on a secure network to limit its contact with other systems. This will reduce the likelihood of a malicious user accessing the payroll system and limit any damage to other systems if the payroll system is attacked.
NEW QUESTION 301
An organization is in the process of integrating its operational technology and information technology areas.
As part of the integration, some of the cultural aspects it would like to see include more efficient use of resources during change windows, better protection of critical infrastructure, and the ability to respond to incidents. The following observations have been identified:
* The ICS supplier has specified that any software installed will result in lack of support.
* There is no documented trust boundary defined between the SCADA and corporate networks.
* Operational technology staff have to manage the SCADA equipment via the engineering workstation.
* There is a lack of understanding of what is within the SCADA network.
Which of the following capabilities would BEST improve the security position?
- A. SIEM, VPN, and firewall
- B. IDS, NAC, and log monitoring
- C. VNC, router, and HIPS
- D. Proxy, VPN, and WAF
Answer: C
NEW QUESTION 302
A human resources manager at a software development company has been tasked with recruiting personnel for a new cyber defense division in the company. This division will require personnel to have high technology skills and industry certifications. Which of the following is the BEST method for this manager to gain insight into this industry to execute the task?
- A. Interview employees and managers to discover the industry hot topics and trends
- B. Interview candidates, attend training, and hire a staffing company that specializes in technology jobs
- C. Attend conferences, webinars, and training to remain current with the industry and job requirements
- D. Attend meetings with staff, internal training, and become certified in software management
Answer: C
Explanation:
Conferences represent an important method of exchanging information between researchers who are usually experts in their respective fields. Together with webinars and training to remain current on the subject the manager will be able to gain valuable insight into the cyber defense industry and be able to recruit personnel.
Incorrect Answers:
A: Merely interviewing candidates and hiring a staffing company will not provide the human resources manager with the necessary insight into a new cyber defense division for the company.
B: Interviewing the employees and managers to pick up on hot, new trends is not the best possible way to gain the appropriate insight.
C: It is not guaranteed that the existing staff would be on top of new developments that would make them in tune with the new division that is being envisaged by the company. It would be best to gain insight from more knowledgeable sources such as conferences, etc.
References:
Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley & Sons, Indianapolis, 2012, p. 293
NEW QUESTION 303
The Chief Information Officer (CIO) has been asked to develop a security dashboard with the relevant metrics. The board of directors will use the dashboard to monitor and track the overall security posture of the organization. The CIO produces a basic report containing both KPI and KRI data in two separate sections for the board to review.
Which of the following BEST meets the needs of the board?
- A. KRI:- EDR coverage across the fleet- % of suppliers with approved security control framework- Backlog of unresolved security investigations- Threat landscape ratingKPI:- Time to resolve open security items- Compliance with regulations- Time to patch critical issues on a monthly basis- Severity of threats and vulnerabilities reported by sensors
- B. KRI:- EDR coverage across the fleet- Backlog of unresolved security investigations- Time to patch critical issues on a monthly basis- Threat landscape ratingKPI:- Time to resolve open security items- Compliance with regulations- % of suppliers with approved security control frameworks- Severity of threats and vulnerabilities reported by sensors
- C. KPI:- Compliance with regulations- % of suppliers with approved security control frameworks- Severity of threats and vulnerabilities reported by sensors- Threat landscape ratingKRI:- Time to resolve open security items- Backlog of unresolved security investigations- EDR coverage across the fleet- Time to patch critical issues on a monthly basis
- D. KRI:- Compliance with regulations- Backlog of unresolved security investigations- Severity of threats and vulnerabilities reported by sensors- Time to patch critical issues on a monthly basisKPI:- Time to resolve open security items- % of suppliers with approved security control frameworks- EDR coverage across the fleet- Threat landscape rating
Answer: D
NEW QUESTION 304
Developers are working on anew feature to add to a social media platform. Thew new feature involves users uploading pictures of what they are currently doing. The data privacy officer (DPO) is concerned about various types of abuse that might occur due to this new feature. The DPO state the new feature cannot be released without addressing the physical safety concerns of the platform's users. Which of the following controls would BEST address the DPO's concerns?
- A. Not displaying to the public who uploaded the photo
- B. Increasing blocking options available to the uploader
- C. Adding a one-hour delay of all uploaded photos
- D. Forcing TLS for all connections on the platform
- E. Removing all metadata in the uploaded photo file
Answer: C
NEW QUESTION 305
Since the implementation of IPv6 on the company network, the security administrator has been unable to identify the users associated with certain devices utilizing IPv6 addresses, even when the devices are centrally managed.
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
ether f8:1e:af:ab:10:a3
inet6 fw80::fa1e:dfff:fee6:9d8%en1 prefixlen 64 scopeid 0x5
inet 192.168.1.14 netmask 0xffffff00 broadcast 192.168.1.255
inet6 2001:200:5:922:1035:dfff:fee6:9dfe prefixlen 64 autoconf
inet6 2001:200:5:922:10ab:5e21:aa9a:6393 prefixlen 64 autoconf temporary nd6 options=1<PERFORMNUD> media: autoselect status: active Given this output, which of the following protocols is in use by the company and what can the system administrator do to positively map users with IPv6 addresses in the future? (Select TWO).
- A. The administrator must disable the IPv6 privacy extensions
- B. The administrator must disable the mobile IPv6 router flag
- C. The router IPv6 advertisement has been disabled
- D. The administrator must disable DHCPv6 option code 1
- E. The network implements 6to4 tunneling
- F. The administrator must disable IPv6 tunneling
- G. The routers implement NDP
- H. The devices use EUI-64 format
Answer: A,G
Explanation:
Explanation
IPv6 makes use of the Neighbor Discovery Protocol (NDP). Thus if your routers implement NDP you will be able to map users with IPv6 addresses. However to be able to positively map users with IPv6 addresses you will need to disable IPv6 privacy extensions.
NEW QUESTION 306
......
CompTIA CAS-003 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
| Topic 9 |
|
| Topic 10 |
|
| Topic 11 |
|
CAS-003 Exam Audience and Requirements
This test is specifically designed for IT practitioners working in the cybersecurity industry and interested in gaining technical knowledge and skills, like conceptualizing, engineering, and integrating a secure solution in the organizations' environment. They should possess real-life experience in the field of at least ten years in an administration role, from which five years or more should be related to security tasks.
Latest CAS-003 Exam Dumps CompTIA Exam from Training: https://www.practicedump.com/CAS-003_actualtests.html
Updated Verified CAS-003 dumps Q&As - 100% Pass: https://drive.google.com/open?id=1DBoCCA2YokJ0d-manEZZoTttLrDYwhNV