[Dec 21, 2025] CompTIA CAS-005 Real Exam Questions and Answers FREE
Pass CompTIA CAS-005 Exam Info and Free Practice Test
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 45
A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware static of a domain controller The forensic team cryptographically validated that com the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LOAP Which of the following is me best way to reduce the risk oi reoccurrence?
- A. Rolling the cryptographic keys used for hardware security modules
- B. Measuring and attesting to the entire boot chum
- C. Using code signing to verify the source of OS updates
- D. Enforcing allow lists for authorized network pons and protocols
Answer: D
Explanation:
The scenario describes a sophisticated attack where the threat actor used steganography within LDAP to exfiltrate data. Given that the hardware and OS firmware were validated and found uncompromised, the attack vector likely exploited a network communication channel. To mitigate such risks, enforcing allow lists for authorized network ports and protocols is the most effective strategy.
Here's why this option is optimal:
Port and Protocol Restrictions: By creating an allow list, the organization can restrict communications to only those ports and protocols that are necessary for legitimate business operations. This reduces the attack surface by preventing unauthorized or unusual traffic.
Network Segmentation: Enforcing such rules helps in segmenting the network and ensuring that only approved communications occur, which is critical in preventing data exfiltration methods like steganography.
Preventing Unauthorized Access: Allow lists ensure that only predefined, trusted connections are allowed, blocking potential paths that attackers could use to infiltrate or exfiltrate data.
Other options, while beneficial in different contexts, are not directly addressing the network communication threat:
B . Measuring and attesting to the entire boot chain: While this improves system integrity, it doesn't directly mitigate the risk of data exfiltration through network channels.
C . Rolling the cryptographic keys used for hardware security modules: This is useful for securing data and communications but doesn't directly address the specific method of exfiltration described.
D . Using code signing to verify the source of OS updates: Ensures updates are from legitimate sources, but it doesn't mitigate the risk of network-based data exfiltration.
Reference:
CompTIA SecurityX Study Guide
NIST Special Publication 800-41, "Guidelines on Firewalls and Firewall Policy" CIS Controls Version 8, Control 9: Limitation and Control of Network Ports, Protocols, and Services
NEW QUESTION # 46
A security engineer must resolve a vulnerability in a deprecated version of Python for a custom-developed flight simulation application that is monitored and controlled remotely. The source code is proprietary and built with Python functions running on the Ubuntu operating system. Version control is not enabled for the application in development or production. However, the application must remain online in the production environment using built-in features. Which of the following solutions best reduces the attack surface of these issues and meets the outlined requirements?
- A. Code-signing within the CI/CD pipeline ensures that only verified and signed code is deployed, mitigating the risk of supply chain attacks. Updating Python with aptitude and updating modules with pip ensures vulnerabilities are patched. Deploying the solution to production after testing maintains application availability while securing the development lifecycle.
Branch protection (B) applies only to version-controlled environments, which is not the case here.
NFS network share (C) does not address the deprecated Python vulnerability.
Version designation (D) does not eliminate security risks from outdated dependencies. - B. Configure version designation within the Python interpreter. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- C. Use an NFS network share. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- D. Enable branch protection in the GitHub repository. Update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
- E. Configure code-signing within the CI/CD pipeline, update Python with aptitude, and update modules with pip in a test environment. Deploy the solution to production.
Answer: A
NEW QUESTION # 47
A global manufacturing company has an internal application mat is critical to making products This application cannot be updated and must Be available in the production area A security architect is implementing security for the application. Which of the following best describes the action the architect should take-?
- A. Create a separate network for users who need access to the application
- B. Create an acceptable use policy for the use of the application
- C. Deploy Intrusion detection capabilities using a network tap
- D. Disallow wireless access to the application.
Answer: A
Explanation:
Creating a separate network for users who need access to the application is the best action to secure an internal application that is critical to the production area and cannot be updated.
Why Separate Network?
* Network Segmentation: Isolates the critical application from the rest of the network, reducing the risk of compromise and limiting the potential impact of any security incidents.
* Controlled Access: Ensures that only authorized users have access to the application, enhancing security and reducing the attack surface.
* Minimized Risk: Segmentation helps in protecting the application from vulnerabilities that could be exploited from other parts of the network.
Other options, while beneficial, do not provide the same level of security for a critical application:
* A. Disallow wireless access: Useful but does not provide comprehensive protection.
* B. Deploy intrusion detection capabilities using a network tap: Enhances monitoring but does not provide the same level of isolation and control.
* C. Create an acceptable use policy: Important for governance but does not provide technical security controls.
References:
* CompTIA SecurityX Study Guide
* NIST Special Publication 800-125, "Guide to Security for Full Virtualization Technologies"
* "Network Segmentation Best Practices," Cisco Documentation
NEW QUESTION # 48
A security engineer discovers that some legacy systems are still in use or were not properly decommissioned.
After further investigation, the engineer identifies that an unknown and potentially malicious server is also sending emails on behalf of the company. The security engineer extracts the following data for review:
Which of the following actions should the security engineer take next? (Select two).
- A. Change the DMARC policy to none and monitor email flow to establish a new baseline.
- B. Change the DMARC policy to reject and remove references to the server.
- C. Remove the unnecessary servers from the SPF record.
- D. Rotate the DKIM selector to use another key.
- E. Update the MX record to contain only the primary email server.
- F. Change the SPF record to enforce the hard fail parameter.
Answer: C,F
Explanation:
The presence of an unauthorized server (29mail.mycrosoft.info) sending emails on behalf of the company indicates a potential spoofing or phishing attempt. To mitigate this:
* Remove the unnecessary servers from the SPF record (Option C): The Sender Policy Framework (SPF) specifies which mail servers are authorized to send emails on behalf of a domain. Removing unauthorized or unnecessary servers from the SPF record helps prevent spoofed emails from passing SPF checks.
* Change the SPF record to enforce the hard fail parameter (Option D): Setting the SPF policy to a hard fail (-all) ensures that emails from unauthorized servers are rejected, enhancing email security.
Implementing these changes strengthens the domain's email authentication mechanisms, reducing the risk of successful phishing or spoofing attacks.
Reference: CompTIA SecurityX CAS-005 Exam Objectives, Domain 3.2: "Given a scenario, analyze requirements to enhance the security of endpoints and servers."
NEW QUESTION # 49
A global organization is reviewing potential vendors to outsource a critical payroll function. Each vendor's plan includes using local resources in multiple regions to ensure compliance with all regulations. The organization's Chief Information Security Officer is conducting a risk assessment on the potential outsourcing vendors' subprocessors. Which of the following best explains the need for this risk assessment?
- A. Specific regulatory requirements must be met in each jurisdiction.
- B. Due care must be exercised during all procurement activities.
- C. The responsibility of protecting PII remains with the organization.
- D. Risk mitigations must be more comprehensive than the existing payroll provider.
Answer: C
NEW QUESTION # 50
During a security assessment using an CDR solution, a security engineer generates the following report about the assets in me system:
After five days, the EDR console reports an infection on the host 0WIN23 by a remote access Trojan Which of the following is the most probable cause of the infection?
- A. 0W1N29 spreads the malware through other hosts in the network
- B. OW1N23 uses a legacy version of Windows that is not supported by the EDR
- C. The EDR has an unknown vulnerability that was exploited by the attacker.
- D. LN002 was not supported by the EDR solution and propagates the RAT
Answer: B
Explanation:
OWIN23 is running Windows 7, which is a legacy operating system. Many EDR solutions no longer provide full support for outdated operating systems like Windows 7, which has reached its end of life and is no longer receiving security updates from Microsoft. This makes such systems more vulnerable to infections and attacks, including remote access Trojans (RATs).
A . OWIN23 uses a legacy version of Windows that is not supported by the EDR: This is the most probable cause because the lack of support means that the EDR solution may not fully protect or monitor this system, making it an easy target for infections.
B . LN002 was not supported by the EDR solution and propagates the RAT: While LN002 is unmanaged, it is less likely to propagate the RAT to OWIN23 directly without an established vector.
C . The EDR has an unknown vulnerability that was exploited by the attacker: This is possible but less likely than the lack of support for an outdated OS.
D . OWIN29 spreads the malware through other hosts in the network: While this could happen, the status indicates OWIN29 is in a bypass mode, which might limit its interactions but does not directly explain the infection on OWIN23.
Reference:
CompTIA Security+ Study Guide
NIST SP 800-53, "Security and Privacy Controls forInformation Systems and Organizations" Microsoft's Windows 7 End of Support documentation
NEW QUESTION # 51
A company's internal network is experiencing a security breach, and the threat actor is still active. Due to business requirements, users in this environment are allowed to utilize multiple machines at the same time. Given the following log snippet:
Which of the following accounts should a security analyst disable to best contain the incident without impacting valid users?
- A. user-d
- B. user-b
- C. user-c
- D. user-a
Answer: C
Explanation:
User user-c is showing anomalous behavior across multiple machines, attempting to run administrative tools such as cmd.exe and appwiz.CPL, which are commonly used by attackers for system modification. The activity pattern suggests a lateral movement attempt, potentially indicating a compromised account.
user-a (A) and user-b (B) attempted to run applications but only on one machine, suggesting less likelihood of compromise.
user-d (D) was blocked running cmd.com, but user-c's pattern is more consistent with an attack technique.
NEW QUESTION # 52
A company plans to implement a research facility with intellectual property data that should be protected. The following is the security diagram proposed by the security architect:
Which of the following security architect models is illustrated by the diagram?
- A. Identity and access management model
- B. Perimeter protection security model
- C. Zero Trust security model
- D. Agent based security model
Answer: C
Explanation:
The security diagram proposed by the security architect depicts a Zero Trust security model. Zero Trust is a security framework that assumes all entities, both inside and outside the network, cannot be trusted and must be verified before gaining access to resources.
Key Characteristics of Zero Trust in the Diagram:
Role-based Access Control: Ensures that users have access only to the resources necessary for their role.
Mandatory Access Control: Additional layer of security requiring authentication for access to sensitive areas.
Network Access Control: Ensures that devices meet security standards before accessing the network.
Multi-factor Authentication (MFA): Enhances security by requiring multiple forms of verification.
This model aligns with the Zero Trust principles of never trusting and always verifying access requests, regardless of their origin.
NEW QUESTION # 53
A company plans to implement a research facility with Intellectual property data that should be protected The following is the security diagram proposed by the security architect
Which of the following security architect models is illustrated by the diagram?
- A. Identity and access management model
- B. Perimeter protection security model
- C. Zero Trust security model
- D. Agent based security model
Answer: C
Explanation:
The security diagram proposed by the security architect depicts a Zero Trust security model. Zero Trust is asecurity framework that assumes all entities, both inside and outside the network, cannot be trusted and must be verified before gaining access to resources.
Key Characteristics of Zero Trust in the Diagram:
Role-based Access Control: Ensures that users have access only to the resources necessary for their role.
Mandatory Access Control: Additional layer of security requiring authentication for access to sensitive areas.
Network Access Control: Ensures that devices meet security standards before accessing the network.
Multi-factor Authentication (MFA): Enhances security by requiring multiple forms of verification.
This model aligns with the Zero Trust principles of never trusting and always verifying access requests, regardless of their origin.
References:
CompTIA SecurityX Study Guide
NIST Special Publication 800-207, "Zero Trust Architecture"
"Implementing a Zero Trust Architecture," Forrester Research
NEW QUESTION # 54
A security officer received several complaints from users about excessive MPA push notifications at night The security team investigates and suspects malicious activities regarding user account authentication Which of the following is the best way for the security officer to restrict MI~A notifications''
- A. Enabling OTP via email
- B. Provisioning FID02 devices
- C. Configuring prompt-driven MFA
- D. Deploying a text message based on MFA
Answer: C
NEW QUESTION # 55
During a security assessment using an CDR solution, a security engineer generates the following report about the assets in me system:
After five days, the EDR console reports an infection on the host 0WIN23 by a remote access Trojan.
Which of the following is the most probable cause of the infection?
- A. 0W1N29 spreads the malware through other hosts in the network
- B. OW1N23 uses a legacy version of Windows that is not supported by the EDR
- C. The EDR has an unknown vulnerability that was exploited by the attacker.
- D. LN002 was not supported by the EDR solution and propagates the RAT
Answer: B
Explanation:
OWIN23 is running Windows 7, which is a legacy operating system. Many EDR solutions no longer provide full support for outdated operating systems like Windows 7, which has reached its end of life and is no longer receiving security updates from Microsoft. This makes such systems more vulnerable to infections and attacks, including remote access Trojans (RATs).
OWIN23 uses a legacy version of Windows that is not supported by the EDR: This is the most probable cause because the lack of support means that the EDR solution may not fully protect or monitor this system, making it an easy target for infections.
NEW QUESTION # 56
A security analyst is reviewing the following authentication logs:
Which of the following should the analyst do first?
- A. Disable User8's account
- B. Disable User1's account
- C. Disable User12's account
- D. Disable User2's account
Answer: B
Explanation:
Based on the provided authentication logs, we observe that User1's account experienced multiple failed login attempts within a very short time span (at 8:01:23 AM on 12/15). This pattern indicates a potential brute-force attack or an attempt to gain unauthorized access. Here's a breakdown of why disabling User1's account is the appropriate first step:
* Failed Login Attempts: The logs show that User1 had four consecutive failed login attempts:
* VM01 at 8:01:23 AM
* VM08 at 8:01:23 AM
* VM01 at 8:01:23 AM
* VM08 at 8:01:23 AM
* Security Protocols and Best Practices: According to CompTIA Security+ guidelines, multiple failed login attempts within a short timeframe should trigger an immediate response to prevent further potential unauthorized access attempts. This typically involves temporarily disabling the account to stop ongoing brute-force attacks.
* Account Lockout Policy: Implementing an account lockout policy is a standard practice to thwart brute- force attacks. Disabling User1's account will align with these best practices and prevent further failed attempts, which might lead to successful unauthorized access if not addressed.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* CompTIA Security+ Certification Exam Objectives
* NIST Special Publication 800-63B: Digital Identity Guidelines
By addressing User1's account first, we effectively mitigate the immediate threat of a brute-force attack, ensuring that further investigation can be conducted without the risk of unauthorized access continuing during the investigation period.
NEW QUESTION # 57
A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed
Which of thefollowing is the best action for the security analyst to take?
- A. Block vendor com for repeated attempts to send suspicious messages
- B. Quarantine all messages with sales-mail.com in the email header
- C. Reroute all messages with unusual security warning notices to the IT administrator
- D. Block messages from hr-saas.com because it is not a recognized domain.
Answer: A
Explanation:
In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here's the analysis of the options provided:
A). Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking.
B). Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages.
C). Quarantine all messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails.
D). Block vendor com for repeated attempts to send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.
References:
CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity.
NIST Special Publication 800-45 Version 2, "Guidelines on Electronic Mail Security": Provides guidelines on email security, including the management of suspicious email domains.
"Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft" by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent offenders.
By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.
NEW QUESTION # 58
An organization found a significant vulnerability associated with a commonly used package in a variety of operating systems. The organization develops a registry of software dependencies to facilitate incident response activities. As part of the registry, the organization creates hashes of packages that have been formally vetted. Which of the following attack vectors does this registry address?
- A. Side-channel analysis
- B. On-path attack
- C. Pass-the-hash attack
- D. Supply chain attack
- E. Cipher substitution attack
Answer: D
Explanation:
Comprehensive and Detailed Step by Step Explanation:
Understanding the Scenario: The question describes a proactive security measure where an organization maintains a registry of software dependencies and their corresponding hashes. This registry is used to verify the integrity of software packages.
Analyzing the Answer Choices:
A: Supply chain attack: This type of attack involves compromising the software supply chain by injecting malicious code into legitimate software packages.
NEW QUESTION # 59
A company is having issues with its vulnerability management program New devices/lPs are added and dropped regularly, making the vulnerability report inconsistent Which of the following actions should the company lake to most likely improve the vulnerability management process'
- A. Extend the DHCP lease lime to allow the devices to remain with the same address for a longer period.
- B. Request a weekly report with all new assets deployed and decommissioned
- C. Perform regular discovery scanning throughout the 11 landscape using the vulnerability management tool
- D. Implement a shadow IT detection process to avoid rogue devices on the network
Answer: C
Explanation:
To improve the vulnerability management process in an environment where new devices/IPs are added and dropped regularly, the company should perform regular discovery scanning throughout the IT landscape using the vulnerability management tool. Here's why:
Accurate Asset Inventory: Regular discovery scans help maintain an up-to-date inventory of all assets, ensuring that the vulnerability management process includes all relevant devices and IPs.
Consistency in Reporting: By continuously discovering and scanning new and existing assets, the company can generate consistent and comprehensive vulnerability reports that reflect the current state of the network.
Proactive Management: Regular scans enable the organization to proactively identify and address vulnerabilities on new and existing assets, reducing the window of exposure to potential threats.
NEW QUESTION # 60
A company runs a DAST scan on a web application. The tool outputs the following recommendations:
- Use Cookie prefixes.
- Content Security Policy
- SameSite=strict is not set.
Which of the following vulnerabilities has the tool identified?
- A. TOCTOU
- B. CSRF
- C. RCE
- D. XSS
Answer: B
NEW QUESTION # 61
A systems engineer is configuring a system baseline for servers that will provide email services. As part of the architecture design, the engineer needs to improve performance of the systems by using an access vector cache, facilitating mandatory access control and protecting against:
* Unauthorized reading and modification of data and programs
* Bypassing application security mechanisms
* Privilege escalation
* interference with other processes
Which of the following is the most appropriate for the engineer to deploy?
- A. NIPS
- B. SELinux
- C. Self-encrypting disks
- D. Privileged access management
Answer: B
Explanation:
The most appropriate solution for the systems engineer to deploy is SELinux (Security-Enhanced Linux). Here's why:
Mandatory Access Control (MAC): SELinux enforces MAC policies, ensuring that only authorized users and processes can access specific resources. This helps in preventing unauthorized reading and modification of data and programs.
Access Vector Cache: SELinux utilizes an access vector cache (AVC) to improve performance. The AVC caches access decisions, reducing the need for repetitive policy lookups and thus improving system efficiency.
Security Mechanisms: SELinux provides a robust framework to enforce security policies and prevent bypassing of application security mechanisms. It controls access based on defined policies, ensuring that security measures are consistently applied.
Privilege Escalation and Process Interference: SELinux limits the ability of processes to escalate privileges and interfere with each other by enforcing strict access controls. This containment helps in isolating processes and minimizing the risk of privilege escalation attacks.
Reference:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
NSA's Guide to the Secure Configuration of Red Hat Enterprise Linux 5 (SELinux) NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 62
After a vendor identified a recent vulnerability, a severity score was assigned to the vulnerability. A notification was also publicly distributed. Which of the following would most likely include information regarding the vulnerability and the recommended remediation steps?
- A. CCE
- B. CVE
- C. CVSS
- D. CPE
Answer: B
Explanation:
CVE (Common Vulnerabilities and Exposures)provides unique identifiers for publicly known cybersecurity vulnerabilities and exposures. Each CVE entry includes a description and, often, remediation information.
CVSS refers to scoring severity, CCE focuses on configuration issues, and CPE deals with naming standardized platforms and systems.
Reference:CompTIA SecurityX CAS-005, Domain 2.0: Utilize publicly available vulnerability sources like CVE for risk mitigation.
NEW QUESTION # 63
A security review revealed that not all of the client proxy traffic is being captured. Which of the following architectural changes best enables the capture of traffic for analysis?
- A. Setting up a reverse proxy for client logging at the gateway
- B. Adding an additional proxy server to each segmented VLAN
- C. Configuring a span port on the perimeter firewall to ingest logs
- D. Enabling client device logging and system event auditing
Answer: C
Explanation:
Configuring a span port on the perimeter firewall to ingest logs is the best architectural change to ensure that all client proxy traffic is captured for analysis. Here's why:
Comprehensive Traffic Capture: A span port (or mirror port) on the perimeter firewall can capture all inbound and outbound traffic, including traffic that might bypass the proxy. This ensures that all network traffic is available for analysis.
Centralized Logging: By capturing logs at the perimeter firewall, the organization can centralize logging and analysis, making it easier to detect and investigate anomalies.
Minimal Disruption: Implementing a span port is a non-intrusive method that does not require significant changes to the network architecture, thus minimizing disruption to existing services.
NEW QUESTION # 64
An organization is required to
* Respond to internal and external inquiries in a timely manner
* Provide transparency.
* Comply with regulatory requirements
The organization has not experienced any reportable breaches but wants to be prepared if a breach occurs in the future. Which of the following is the best way for the organization to prepare?
- A. Developing communication templates that have been vetted by internal and external counsel
- B. Conducting lessons-learned activities and integrating observations into the crisis management plan
- C. Outsourcing the handling of necessary regulatory filing to an external consultant
- D. Integrating automated response mechanisms into the data subject access request process
Answer: A
Explanation:
Preparing communication templates that have been vetted by both internal and external counsel ensures that the organization can respond quickly and effectively to internal and external inquiries, comply with regulatory requirements, and provide transparency in the event of a breach.
Why Communication Templates?
* Timely Response: Pre-prepared templates ensure that responses are ready to be deployed quickly, reducing response time.
* Regulatory Compliance: Templates vetted by counsel ensure that all communications meet legal and regulatory requirements.
* Consistent Messaging: Ensures that all responses are consistent, clear, and accurate, maintaining the organization's credibility.
* Crisis Management: Pre-prepared templates are a critical component of a broader crisis management plan, ensuring that all stakeholders are informed appropriately.
Other options, while useful, do not provide the same level of preparedness and compliance:
* A. Outsourcing to an external consultant: This may delay response times and lose internal control over the communication.
* B. Integrating automated response mechanisms: Useful for efficiency but not for ensuring compliant and vetted responses.
* D. Conducting lessons-learned activities: Important for improving processes but does not provide immediate preparedness for communication.
References:
* CompTIA SecurityX Study Guide
* NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide"
* ISO/IEC 27002:2013, "Information technology - Security techniques - Code of practice for information security controls"
NEW QUESTION # 65
A company recently experienced an incident in which an advanced threat actor was able to shim malicious code against the hardware static of a domain controller The forensic team cryptographically validated that com the underlying firmware of the box and the operating system had not been compromised. However, the attacker was able to exfiltrate information from the server using a steganographic technique within LOAP Which of the following is me best way to reduce the risk oi reoccurrence?
- A. Rolling the cryptographic keys used for hardware security modules
- B. Measuring and attesting to the entire boot chum
- C. Using code signing to verify the source of OS updates
- D. Enforcing allow lists for authorized network pons and protocols
Answer: D
Explanation:
The scenario describes a sophisticated attack where the threat actor used steganography within LDAP to exfiltrate data. Given that the hardware and OS firmware were validated and found uncompromised, the attack vector likely exploited a network communication channel. To mitigate such risks, enforcing allow lists for authorized network ports and protocols is the most effective strategy.
Here's why this option is optimal:
Port and Protocol Restrictions: By creating an allow list, the organization can restrict communications to only those ports and protocols that are necessary for legitimate business operations. This reduces the attack surface by preventing unauthorized or unusual traffic.
Network Segmentation: Enforcing such rules helps in segmenting the network and ensuring that only approved communications occur, which is critical in preventing data exfiltration methods like steganography.
Preventing Unauthorized Access: Allow lists ensure that only predefined, trusted connections are allowed, blocking potential paths that attackers could use to infiltrate or exfiltrate data.
Other options, while beneficial in different contexts, are not directly addressing the network communication threat:
B: Measuring and attesting to the entire boot chain: While this improves system integrity, it doesn't directly mitigate the risk of data exfiltration through network channels.
C:Rolling the cryptographic keys used for hardware security modules: This is useful for securing data and communications but doesn't directly address the specific method of exfiltration described.
D:Using code signing to verify the source of OS updates: Ensures updates are from legitimate sources, but it doesn't mitigate the risk of network-based data exfiltration.
NEW QUESTION # 66
A security architect is mitigating a vulnerability that previously led to a web application data breach. An analysis into the root cause of the issue finds the following:
An administrator's account was hijacked and used on several Autonomous System Numbers within 30 minutes.
All administrators use named accounts that require multifactor authentication.
Single sign-on is used for all company applications.Which of the following should the security architect do to mitigate the issue?
- A. Enforce biometric authentication requirements for the administrator's named accounts.
- B. Enable context-based authentication when network locations change on administrator login attempts.
- C. Configure token theft detection on the single sign-on system with automatic account lockouts.
- D. Decentralize administrator accounts and force unique passwords for each application.
Answer: B
Explanation:
Comprehensive and Detailed
The hijacked administrator account was used across multiple ASNs (indicating different network locations) in a short time, despite MFA and SSO. This suggests a stolen session or token misuse. Let's analyze:
A . Token theft detection with lockouts:Useful for detecting stolen SSO tokens, but it's reactive and may not prevent initial misuse across networks.
B . Context-based authentication:This adds real-time checks (e.g., geolocation, IP changes) to verify login attempts. Given the rapid ASN changes, this proactively mitigates the issue by challenging suspicious logins, aligning with CAS-005's focus on adaptive security.
C . Decentralize accounts:This removes SSO, increasing complexity and weakening MFA enforcement, which isn't practical or secure.
NEW QUESTION # 67
......
Latest CAS-005 Exam Dumps CompTIA Exam: https://www.testvalid.com/CAS-005-exam-collection.html
New 2025 Latest Questions CAS-005 Dumps - Use Updated CompTIA Exam: https://drive.google.com/open?id=1AmBIMSMU1UICpRbc9WJ9vdp1TDKP2CNM