Free CompTIA CAS-004 Study Guides Exam Questions and Answer
CAS-004 Exam Dumps, CAS-004 Practice Test Questions
CompTIA CASP+ certification exam consists of 90 multiple-choice and performance-based questions. CAS-004 exam is designed to test the knowledge and skills of IT professionals in real-world scenarios. This means that the exam questions are based on actual situations that IT professionals might encounter in their day-to-day work. CAS-004 exam is designed to be challenging, but also fair and relevant to the skills and knowledge required for the job.
NEW QUESTION # 327
A security solution uses a sandbox environment to execute zero-day software and collect indicators of compromise. Which of the following should the organization do to BEST take advantage of this solution?
- A. Include the signature in the vulnerability scanning tool.
- B. Deliver an updated threat signature throughout the EDR system
- C. Develop an Nmap plug-in to detect the indicator of compromise.
- D. Update the organization's group policy.
Answer: B
Explanation:
Delivering an updated threat signature throughout the endpoint detection and response (EDR) system is the best way to take advantage of the security solution that uses a sandbox environment to execute zero-day software and collect indicators of compromise. An EDR system is a solution that monitors and analyzes the activities and behaviors of endpoints, such as computers, mobile devices, or servers, and detects and responds to potential threats. An EDR system can use threat signatures, which are patterns or characteristics of known malicious software or attacks, to identify and block malicious activities on endpoints. By delivering an updated threat signature based on the indicators of compromise collected from the sandbox environment, the organization can enhance its EDR system's ability to detect and prevent zero-day attacks that exploit unknown vulnerabilities. Verified References:
https://www.cisco.com/c/en/us/products/security/what-is-endpoint-detection-response.html
https://www.crowdstrike.com/epp-101/what-is-a-sandbox/
NEW QUESTION # 328
A developer wants to maintain integrity to each module of a program and ensure controls are in place to detect unauthorized code modification. Which of the following would be BEST for the developer to perform? (Choose two.)
- A. Encrypt with 3DES.
- B. Utilize code signing by a trusted third party.
- C. Compress the program with a password.
- D. Make the DACL read-only.
- E. Implement certificate-based authentication.
- F. Verify MD5 hashes.
Answer: B,F
NEW QUESTION # 329
A company has identified a number of vulnerable, end-of-support systems with limited defensive capabilities.
Which of the following would be the first step in reducing the attack surface in this environment?
- A. Utilizing hardening recommendations
- B. Installing and updating antivirus
- C. Installing all available patches
- D. Deploying IPS/IDS throughout the environment
Answer: A
Explanation:
The first step in reducing the attack surface of vulnerable, end-of-support systems is to apply hardening recommendations. Hardening involves applying security configurations, such as disabling unnecessary services, enforcing strong authentication, and tightening access controls to mitigate vulnerabilities on systems that can no longer receive patches or support. While patching and deploying security tools like IPS/IDS and antivirus are important, hardening addresses the fundamental weakness of these legacy systems by reducing their exposure to threats. CASP+ recommends hardening as a crucial measure in environments where patching or upgrading may not be feasible, particularly for unsupported systems.
References:
CASP+ CAS-004 Exam Objectives: Domain 2.0 - Enterprise Security Operations (System Hardening) CompTIA CASP+ Study Guide: System Hardening for End-of-Life Systems
NEW QUESTION # 330
A recent batch of bug bounty findings indicates a systematic issue related to directory traversal. A security engineer needs to prevent flawed code from being deployed into production. Which of the following is the best mitigation strategy for the engineer?
- A. Developing a secure library for filesystem access and blocking builds that do not use the library
- B. Using a software composition analysis tool to look for directory traversal issues in the application
- C. Implementing static code analysis testing into the CI/CD pipeline and blocking based on findings
- D. Leveraging a dynamic application security testing tool to uncover issues related to directory traversal
- E. Setting up secure development training with a focus on filesystem access issues
Answer: C
NEW QUESTION # 331
A Chief Information Officer (CIO) wants to implement a cloud solution that will satisfy the following requirements:
Support all phases of the SDLC.
Use tailored website portal software.
Allow the company to build and use its own gateway software.
Utilize its own data management platform.
Continue using agent-based security tools.
Which of the following cloud-computing models should the CIO implement?
- A. SaaS
- B. IaaS
- C. PaaS
- D. MaaS
Answer: B
NEW QUESTION # 332
A security administrator has been tasked with hardening a domain controller against lateral movement attacks.
Below is an output of running services:
Which of the following configuration changes must be made to complete this task?
- A. Stop the Active Directory Web Services service and set the startup type to disabled.
- B. Stop the Print Spooler service and set the startup type to disabled.
- C. Stop the DNS Server service and set the startup type to disabled.
- D. Stop Credential Manager service and leave the startup type to disabled.
Answer: B
Explanation:
Stopping the Print Spooler service and setting the startup type to disabled is the best configuration change to harden a domain controller against lateral movement attacks. The Print Spooler service has been known to be vulnerable to remote code execution exploits that can allow attackers to gain access to domain controllers and other sensitive machines. Disabling this service can reduce the attack surface and prevent exploitation attempts.
NEW QUESTION # 333
An architectural firm is working with its security team to ensure that any draft images that are leaked to the public can be traced back to a specific external party. Which of the following would BEST accomplish this goal?
- A. Have the external parties sign non-disclosure agreements before sending any images.
- B. Properly configure a secure file transfer system to ensure file integrity.
- C. Only share images with external parties that have worked with the firm previously.
- D. Utilize watermarks in the images that are specific to each external party.
Answer: D
Explanation:
Explanation
Utilizing watermarks in the images that are specific to each external party would best accomplish the goal of tracing back any leaked draft images. Watermarks are visible or invisible marks that can be embedded in digital images to indicate ownership, authenticity, or origin. Watermarks can also be used to identify the recipient of the image and deter unauthorized copying or distribution. If a draft image is leaked to the public, the watermark can reveal which external party was responsible for the breach.
NEW QUESTION # 334
An organization is considering a BYOD standard to support remote working. The first iteration of the solution will utilize only approved collaboration applications and the ability to move corporate data between those applications. The security team has concerns about the following:
Unstructured data being exfiltrated after an employee leaves the organization
Data being exfiltrated as a result of compromised credentials
Sensitive information in emails being exfiltrated
Which of the following solutions should the security team implement to mitigate the risk of data loss?
- A. Certificates, DLP, and geofencing
- B. Conditional access, DoH, and full disk encryption
- C. Mobile device management, remote wipe, and data loss detection
- D. Mobile application management, MFA, and DRM
Answer: C
NEW QUESTION # 335
A security technician is trying to connect a remote site to the central office over a site-to-site VPN. The technician has verified the source and destination IP addresses are correct, but the technician is unable to get the remote site to connect. The following error message keeps repeating:
"An error has occurred during Phase 1 handshake. Deleting keys and retrying..." Which of the following is most likely the reason the connection is failing?
- A. The IKE hashing algorithm uses different key lengths on each VPN device.
- B. The remote VPN is attempting to connect with a protocol other than SSL/TLS.
- C. The Diffie-Hellman group on both sides matches but is a legacy group.
- D. The IPSec settings allow more than one cipher suite on both devices.
Answer: A
Explanation:
* The IKE (Internet Key Exchange) Phase 1 handshake error indicates a failure in negotiating a secure connection.
* Option A: The IKE hashing algorithm mismatch, including key lengths, often causes such failures. Both VPN devices must agree on compatible algorithms and key lengths for the handshake to succeed.
* Option B: Multiple cipher suites do not inherently cause errors; they provide flexibility during negotiation.
* Option C: While using a legacy Diffie-Hellman group is less secure, it does not typically cause the handshake to fail unless explicitly rejected.
* Option D: Site-to-site VPNs do not use SSL/TLS; they rely on IPSec protocols, making this irrelevant.
References:
* CompTIA CASP+ Exam Objective 2.2: Implement network security solutions, including VPN configurations.
* CASP+ Study Guide, 5th Edition, Chapter 7, VPN Technologies and Troubleshooting.
NEW QUESTION # 336
A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented in order to meet contractual requirements, the company must achieve the following thresholds
* 99 99% uptime
* Load time in 3 seconds
* Response time = <1 0 seconds
Starting with the computing environment, which of the following should a security engineer recommend to BEST meet the requirements? (Select THREE)
- A. Employing bare-metal loading of applications
- B. Utilizing redundant power for all developer workstations
- C. Implementing RAID on the backup servers
- D. Implementing server clusters
- E. Lowering storage input/output
- F. Installing a firewall at corporate headquarters
- G. Deploying a content delivery network
- H. Ensuring technological diversity on critical servers
Answer: D,E,G
Explanation:
To meet the contractual requirements of the web service provider, a security engineer should recommend the following actions:
* Deploying a content delivery network (CDN): A CDN is a distributed system of servers that delivers
* web content to users based on their geographic location, the origin of the content, and the performance of the network. A CDN can help improve the uptime, load time, and response time of web services by caching content closer to the users, reducing latency and bandwidth consumption. A CDN can also help mitigate distributed denial-of-service (DDoS)attacks by absorbing or filtering malicious traffic before it reaches the origin servers, reducing the impact on the web service availability12.
* Implementing server clusters: A server cluster is a group of servers that work together to provide high availability, scalability, and load balancing for web services. A server cluster can help improve the uptime, load time, and response time of web services by distributing the workload across multiple servers, reducing the risk of single points of failure and performance bottlenecks. A server cluster can also help recover from failures by automatically switching to another server in case of a malfunction34.
* Lowering storage input/output (I/O): Storage I/O is the amount of data that can be read from or written to a storage device in a given time. Storage I/O can affect the performance of web services by limiting the speed of data transfer between the servers and the storage devices. Lowering storage I/O can help improve the load time and response time of web services by reducing the latency and congestion of data access. Lowering storage I/O can be achieved by using faster storage devices, such as solid-state drives (SSDs), optimizing the storage layout and configuration, such as using RAID or striping, and caching frequently accessed data in memory5 .
Installing a firewall at corporate headquarters is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. A firewall is a device or software that filters and blocks unwanted network traffic based on predefined rules. A firewall can help improve the security of web services by preventing unauthorized access and attacks, but it may also introduce additional latency and complexity to the network.
Employing bare-metal loading of applications is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. Bare-metal loading is a technique that allows applications to run directly on hardware without an operating system or a hypervisor. Bare-metal loading can help improve the performance and efficiency of applications by eliminating the overhead and interference of other software layers, but it may also increase the difficulty and cost of deployment and maintenance.
Implementing RAID on the backup servers is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. RAID (redundant array of independent disks) is a technique that combines multiple disks into a logical unit that provides improved performance, reliability, or both. RAID can help improve the availability and security of backup data by protecting it from disk failures or corruption, but it may also introduce additional complexity and overhead to the backup process.
Utilizing redundant power for all developer workstations is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services. Redundant power is a technique that provides multiple sources of power for an IT system in case one fails. Redundant power can help improve the availability and reliability of developer workstations by preventing them from losing power due to outages or surges, but it may also increase the cost and energy consumption of the system.
Ensuring technological diversity on critical servers is not a recommended action to meet the contractual requirements, as it does not directly affect the uptime, load time, or response time of web services.
Technological diversity is a technique that uses different types of hardware, software, or platforms in an IT environment. Technological diversity can help improve resilience by reducing single points of failure and increasing compatibility, but it may also introduce additional complexity and inconsistency to the environment. References: What Is CDN? How Does CDN Work? | Imperva, What Is Server Clustering? | IBM, What Is Server Clustering? | IBM, Server Clustering: What It Is & How It Works | Liquid Web, Storage I/O Performance - an overview | ScienceDirect Topics, [How to Improve Storage I/O Performance | StarWind Blog], [What Is Firewall Security? | Cisco], [What is Bare Metal? | IBM], [What is RAID? | Dell Technologies US], [What Is Redundant Power Supply? | Dell Technologies US], [Technological Diversity - an overview | ScienceDirect Topics]
NEW QUESTION # 337
A server in a manufacturing environment is running an end-of-life operating system. The vulnerability management team is recommending that the server be upgraded to a supported operating system, but the ICS software running on the server is not compatible with modem operating systems. Which of the following compensating controls should be implemented to BEST protect the server?
- A. HIPS
- B. Host-based firewall
- C. Application allow list
- D. Antivirus
Answer: B
Explanation:
host-based firewall A software application running on a single host and designed to protect only that host.
NEW QUESTION # 338
A Chief information Security Officer (CISO) is developing corrective-action plans based on the following from a vulnerability scan of internal hosts:
Which of the following MOST appropriate corrective action to document for this finding?
- A. The product owner should perform a business impact assessment regarding the ability to implement a WAF.
- B. The application developer should use a static code analysis tool to ensure any application code is not vulnerable to buffer overflows.
- C. The system administrator should evaluate dependencies and perform upgrade as necessary.
- D. The security operations center should develop a custom IDS rule to prevent attacks buffer overflows against this server.
Answer: A
NEW QUESTION # 339
A recent security audit identified multiple endpoints have the following vulnerabilities:
- Various unsecured open ports
- Active accounts for terminated personnel
- Endpoint protection software with legacy versions
- Overly permissive access rules
Which of the following would BEST mitigate these risks? (Choose three).
- A. Unneeded services disabled
- B. Enabling BIOS password
- C. Patching
- D. Address space layout randomization
- E. Removal of unused accounts
- F. Secure boot
- G. Logging
- H. Local drive encryption
Answer: A,C,E
NEW QUESTION # 340
A new requirement for legislators has forced a government security team to develop a validation process to verify the integrity of a downloaded file and the sender of the file Which of the following is the BEST way for the security team to comply with this requirement?
- A. Message authentication code
- B. Message digest
- C. Digital signature
- D. Message hash
Answer: C
Explanation:
A digital signature is a cryptographic technique that allows the sender of a file to sign it with their private key and the receiver to verify it with the sender's public key. This ensures the integrity and authenticity of the file, as well as the non-repudiation of the sender. A message hash or a message digest is a one-way function that produces a fixed-length output from an input, but it does not provide any information about the sender. A message authentication code (MAC) is a symmetric-key technique that allows both the sender and the receiver to generate and verify a code using a shared secret key, but it does not provide non-repudiation. Reference: [CompTIA Advanced Security Practitioner (CASP+) Certification Exam Objectives], Domain 2: Enterprise Security Architecture, Objective 2.1: Apply cryptographic techniques
NEW QUESTION # 341
A security manager is creating a standard configuration across all endpoints that handle sensitive data. Which of the following techniques should be included in the standard configuration to ensure the endpoints are hardened?
- A. Resource monitoring
- B. Event logging
- C. Patch management
- D. Drive encryption
Answer: D
Explanation:
Drive encryption protects sensitive data at rest by ensuring unauthorized access cannot expose the data if the physical endpoint is compromised.
Patch management is a necessary security control but does not specifically address endpoint hardening for sensitive data.
Event logging aids in monitoring and incident detection but does not directly harden endpoints.
Resource monitoring manages system performance and availability but is unrelated to data security.
NEW QUESTION # 342
A cybersecurity engineer analyst a system for vulnerabilities. The tool created an OVAL. Results document as output. Which of the following would enable the engineer to interpret the results in a human readable form? (Select TWO.)
- A. OOXML editor
- B. Text editor
- C. XML style sheet
- D. Debugging utility
- E. Event Viewer
- F. SCAP tool
Answer: B,F
NEW QUESTION # 343
A client is adding scope to a project. Which of the following processes should be used when requesting updates or corrections to the client's systems?
- A. The implementation engineer requests direct approval from the systems engineer and the Chief Information Security Officer.
- B. The security engineer asks the project manager to review the updates for the client's system.
- C. The change control board must review and approve a submission.
- D. The information system security officer provides the systems engineer with the system updates.
Answer: C
Explanation:
The change control board (CCB) is a committee that consists of subject matter experts and managers who decide whether to implement proposed changes to a project. The change control board is part of the change management plan, which defines the roles and processes for managing change within a team or organization.
The change control board must review and approve a submission for any change request that affects the scope, schedule, budget, quality, or risks of the project. The change control board evaluates the impact and benefits of the change request and decides whether to accept, reject, or defer it.
A: The implementation engineer requesting direct approval from the systems engineer and the Chief Information Security Officer is not a correct process for requesting updates or corrections to the client's systems, because it bypasses the change control board and the project manager. This could lead to unauthorized changes that could compromise the project's objectives and deliverables.
C: The information system security officer providing the systems engineer with the system updates is not a correct process for requesting updates or corrections to the client's systems, because it does not involve the change control board or the project manager. This could lead to unauthorized changes that could introduce security vulnerabilities or conflicts with other system components.
D: The security engineer asking the project manager to review the updates for the client's system is not a correct process for requesting updates or corrections to the client's systems, because it does not involve the change control board. The project manager is responsible for facilitating the change management process, but not for approving or rejecting change requests.
https://www.projectmanager.com/blog/change-control-board-roles-responsibilities-processes
NEW QUESTION # 344
A pharmaceutical company recently experienced a security breach within its customer-facing web portal. The attackers performed a SQL injection attack and exported tables from the company's managed database, exposing customer information.
The company hosts the application with a CSP utilizing the IaaS model. Which of the following parties is ultimately responsible for the breach?
- A. The cloud software provider
- B. The web portal software vendor
- C. The database software vendor
- D. The pharmaceutical company
Answer: D
Explanation:
IaaS = Infrastructure as a Service.
So the CSP provided the hardware. What the pharmaceutical company puts on that hardware is their business.
The fact it was breached via SQL injection, i.e. software coding, means it's the web application was the point of ingress. Therefore, it's the onus of the Pharma company.
NEW QUESTION # 345
Which of the following allows computation and analysis of data within a ciphertext without knowledge of the plaintext?
- A. Lattice-based cryptography
- B. Quantum computing
- C. Asymmetric cryptography
- D. Homomorphic encryption
Answer: D
Explanation:
Reference: https://searchsecurity.techtarget.com/definition/cryptanalysis Homomorphic encryption is a type of encryption that allows computation and analysis of data within a ciphertext without knowledge of the plaintext. This means that encrypted data can be processed without being decrypted first, which enhances the security and privacy of the data. Homomorphic encryption can enable applications such as secure cloud computing, machine learning, and data analytics.References:
https://www.ibm.com/security/homomorphic-encryptionhttps://www.synopsys.com/blogs/software-security/hom
NEW QUESTION # 346
A security team is concerned with attacks that are taking advantage of return-oriented programming against the company's public facing applications. Which of the following should the company implement on the public-facing servers?
- A. NX
- B. WAF
- C. ASLR
- D. HSM
Answer: C
Explanation:
Address space layout randomization (ASLR) - This technique was the first kind of defense mechanisms proposed to defend against ROP.
NEW QUESTION # 347
......
CompTIA Advanced Security Practitioner (CASP+) certification is designed for experienced IT professionals who want to demonstrate their advanced cybersecurity skills and knowledge. CompTIA Advanced Security Practitioner (CASP+) Exam certification validates the skills required to conceptualize, design, and engineer secure solutions across complex enterprise environments. The CompTIA CASP+ certification is recognized globally and is highly regarded in the cybersecurity industry as it focuses on practical, hands-on skills that can be applied in real-world scenarios.
Latest CAS-004 Actual Free Exam Questions Updated 620 Questions: https://www.prep4away.com/CompTIA-certification/braindumps.CAS-004.ete.file.html
Attested CAS-004 Dumps PDF Resource [2025]: https://drive.google.com/open?id=1PuGNOXqN8OxYDTlIez_I5EAME6eN3oCP