CAS-003 Actual Questions Answers PDF 100% Cover Real Exam Questions
CAS-003 Exam questions and answers
NEW QUESTION 11
Joe, a hacker, has discovered he can specifically craft a webpage that when viewed in a browser crashes the browser and then allows him to gain remote code execution in the context of the victim's privilege level. The browser crashes due to an exception error when a heap memory that is unused is accessed. Which of the following BEST describes the application issue?
- A. SQL injection
- B. Use after free
- C. Race condition
- D. Input validation
- E. Click-jacking
- F. Integer overflow
Answer: B
Explanation:
Explanation
Use-After-Free vulnerabilities are a type of memory corruption flaw that can be leveraged by hackers to execute arbitrary code.
Use After Free specifically refers to the attempt to access memory after it has been freed, which can cause a program to crash or, in the case of a Use-After-Free flaw, can potentially result in the execution of arbitrary code or even enable full remote code execution capabilities.
According to the Use After Free definition on the Common Weakness Enumeration (CWE) website, a Use After Free scenario can occur when "the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process."
NEW QUESTION 12
Given the following output from a local PC:
Which of the following ACLs on a stateful host-based firewall would allow the PC to serve an intranet website?
- A. Allow 172.30.0.28:80 -> 172.30.0.28:443
- B. Allow 172.30.0.28:80 -> ANY
- C. Allow 172.30.0.28:80 -> 172.30.0.28:53
- D. Allow 172.30.0.28:80 -> 172.30.0.0/16
Answer: D
NEW QUESTION 13
A security administrator wants to prevent sensitive data residing on corporate laptops and desktops from leaking outside of the corporate network. The company has already implemented full-disk encryption and has disabled all peripheral devices on its desktops and laptops. Which of the following additional controls MUST be implemented to minimize the risk of data leakage? (Select TWO).
- A. A DLP gateway should be installed at the company border.
- B. Strong authentication should be implemented via external biometric devices.
- C. Full-drive file hashing should be implemented with hashes stored on separate storage.
- D. Split-tunnel VPN should be enforced when transferring sensitive data.
- E. A full-system backup should be implemented to a third-party provider with strong encryption for data in transit.
- F. Full-tunnel VPN should be required for all network communication.
Answer: A,F
Explanation:
Explanation
Web mail, Instant Messaging and personal networking sites are some of the most common means by which corporate data is leaked.
Data loss prevention (DLP) is a strategy for making sure that end users do not send sensitive or critical information outside the corporate network. The term is also used to describe software products that help a network administrator control what data end users can transfer.
DLP software products use business rules to classify and protect confidential and critical information so that unauthorized end users cannot accidentally or maliciously share data whose disclosure could put the organization at risk. For example, if an employee tried to forward a business email outside the corporate domain or upload a corporate file to a consumer cloud storage service like Dropbox, the employee would be denied permission.
Full-tunnel VPN should be required for all network communication. This will ensure that all data transmitted over the network is encrypted which would prevent a malicious user accessing the data by using packet sniffing.
NEW QUESTION 14
An engineer is evaluating the control profile to assign to a system containing PII, financial, and proprietary data.
Based on the dataclassification table above, which of the following BEST describes the overall classification?
- A. Low availability, low confidentiality
- B. High integrity, low availability
- C. High confidentiality, high availability
- D. High confidentiality, medium availability
Answer: D
NEW QUESTION 15
The Chief Information Security Officer (CISO) at a company knows that many users store business documents on public cloud-based storage, and realizes this is a risk to the company. In response, the CISO implements a mandatory training course in which all employees are instructed on the proper use of cloud-based storage. Which of the following risk strategies did the CISO implement?
- A. Accept
- B. Avoid
- C. Mitigate
- D. Transfer
Answer: C
Explanation:
Mitigation means that a control is used to reduce the risk. In this case, the control is training.
Incorrect Answers:
A: To avoid could mean not performing an activity that might bear risk.
B: To accept the risk means that the benefits of moving forward outweigh the risk.
D: To transfer the risk means that the risk is deflected to a third party.
References:
Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley & Sons, Indianapolis, 2012, pp. 88, 218
https://en.wikipedia.org/wiki/Risk_management
NEW QUESTION 16
Joe, a penetration tester, is assessing the security of an application binary provided to him by his client. Which of the following methods would be the MOST effective in reaching this objective?
- A. Manually review the binary in a text editor
- B. Employ a fuzzing utility
- C. Use a static code analyzer
- D. Run the binary in an application sandbox
Answer: C
NEW QUESTION 17
A company wants to implement a cloud-based security solution that will sinkhole malicious DNS requests.
The security administrator has implemented technical controls to direct DNS requests to the cloud servers but wants to extend the solution to all managed and unmanaged endpoints that may have user-defined DNS manual settings Which of the following should the security administrator implement to ensure the solution will protect all connected devices?
A) Implement firewall ACLs as follows
B) Implement NAT as follows:
C) Implement DHCP options as follows:
D) Implement policy routing as follows:
- A. Option D
- B. Option B
- C. Option A
- D. Option C
Answer: A
NEW QUESTION 18
Confidential information related to Application A.
Application B and Project X appears to have been leaked to a competitor. After consulting with the legal team, the IR team is advised to take immediate action to preserve evidence for possible litigation and criminal charges.
While reviewing the rights and group ownership of the data involved in the breach, the IR team inspects the following distribution group access lists:
Which of the following actions should the IR team take FIRST?
- A. Implement a proxy server on the network to inspect all outbound SMTP traffic for the DevOps group
- B. Install DLP software on all developer laptops to prevent data from leaving the network.
- C. Place the mailbox for jsmith on legal hold
- D. Remove all members from the distribution groups immediately
Answer: D
NEW QUESTION 19
The Chief Information Security Officer (CISO) of an established security department, identifies a customer who has been using a fraudulent credit card. The CISO calls the local authorities, and when they arrive on- site, the authorities ask a security engineer to create a point-in-time copy of the running database in their presence. This is an example of:
- A. creating a forensic image
- B. analyzing the order of volatility
- C. deploying fraud monitoring
- D. following a chain of custody
Answer: A
Explanation:
One of the most important steps in computer forensic evidence procedures is to capture exact duplicates of the evidence, also known as forensic images. This is accomplished by making a bit- for-bit copy of a piece of media as an image file with high accuracy. In addition, dumping a system's memory may reveal actionable evidence that would otherwise be lost when the system is powered down.
NEW QUESTION 20
A security engineer is investigating a compromise that occurred between two internal computers. The engineer has determined during the investigation that one computer infected another. While reviewing the IDS logs, the engineer can view the outbound callback traffic, but sees no traffic between the two computers. Which of the following would BEST address the IDS visibility gap?
- A. Install network taps at the edge of the network.
- B. Send syslog from the IDS into the SIEM.
- C. SPAN traffic form the network core into the IDS.
- D. Install HIDS on each computer.
Answer: C
NEW QUESTION 21
A company is implementing a new secure identity application, given the following requirements
* The cryptographic secrets used in the application must never be exposed to users or the OS
* The application must work on mobile devices.
* The application must work with the company's badge reader system
Which of the following mobile device specifications are required for this design? (Select TWO).
- A. UEFI
- B. NFC
- C. Secure element
Biometrics - D. SEAndroid
- E. HSM
Answer: A,E
NEW QUESTION 22
Given the following code snippet:
Which of the following failure modes would the code exhibit?
- A. Secure
- B. Halt
- C. Exception
- D. Open
Answer: C
NEW QUESTION 23
An administrator has enabled salting for users' passwords on a UNIX box. A penetration tester must attempt to retrieve password hashes. Which of the following files must the penetration tester use to eventually obtain passwords on the system? (Select TWO).
- A. /bin/bash
- B. /sbin/logon
- C. /etc/shadow
- D. /etc/password
- E. /etc/passwd
- F. /etc/security
Answer: C,E
Explanation:
In cryptography, a salt is random data that is used as an additional input to a one-way function that hashes a password or passphrase. In this question, enabling salting for users' passwords means to store the passwords in an encrypted format.
Traditional Unix systems keep user account information, including one-way encrypted passwords, in a text file called ``/etc/passwd''. As this file is used by many tools (such as ``ls'') to display file ownerships, etc. by matching user id #'s with the user's names, the file needs to be world- readable. Consequentially, this can be somewhat of a security risk. Another method of storing account information is with the shadow password format. As with the traditional method, this method stores account information in the /etc/passwd file in a compatible format. However, the password is stored as a single "x" character (ie. not actually stored in this file). A second file, called ``/etc/shadow'', contains encrypted password as well as other information such as account or password expiration values, etc.
NEW QUESTION 24
A security architect has been assigned to a new digital transformation program. The objectives are to provide better capabilities to customers and reduce costs. The program has highlighted the following requirements:
1. Long-lived sessions are required, as users do not log in very often.
2. The solution has multiple SPs, which include mobile and web applications.
3. A centralized IdP is utilized for all customer digital channels.
4. The applications provide different functionality types such as forums and customer portals.
5. The user experience needs to be the same across both mobile and web-based applications.
Which of the following would BEST improve security while meeting these requirements?
- A. Username and password authentication to SP, securely store Java web tokens, and implement SMS OTPs.
- B. Social login to IdP, securely store the session cookies, and implement one-time passwords sent to the mobile device
- C. Create-based authentication to IdP, securely store access tokens, and implement secure push notifications.
- D. Username and password authentication to IdP, securely store refresh tokens, and implement context- aware authentication.
Answer: B
NEW QUESTION 25
A security policy states that all applications on the network must have a password length of eight characters. There are three legacy applications on the network that cannot meet this policy. One system will be upgraded in six months, and two are not expected to be upgraded or removed from the network. Which of the following processes should be followed?
- A. Establish a risk matrix
- B. Provide a business justification to avoid the risk
- C. Provide a business justification for a risk exception
- D. Inherit the risk for six months
Answer: C
Explanation:
The Exception Request must include:
A description of the non-compliance.
The anticipated length of non-compliance (2-year maximum). The proposed assessment of risk associated with non-compliance. The proposed plan for managing the risk associated with non- compliance. The proposed metrics for evaluating the success of risk management (if risk is significant). The proposed review date to evaluate progress toward compliance. An endorsement of the request by the appropriate Information Trustee (VP or Dean).
NEW QUESTION 26
A security engineer at a company is designing a system to mitigate recent setbacks caused competitors that are beating the company to market with the new products. Several of the products incorporate propriety enhancements developed by the engineer's company. The network already includes a SEIM and a NIPS and requires 2FA for all user access. Which of the following system should the engineer consider NEXT to mitigate the associated risks?
- A. DLP
- B. UTM
- C. Data flow enforcement
- D. Mail gateway
Answer: A
NEW QUESTION 27
A software development company lost customers recently because of a large number of software issues. These issues were related to integrity and availability defects, including buffer overflows, pointer deferences, and others. Which of the following should the company implement to improve code quality? (Select two).
- A. Code obfuscation
- B. Code comments and documentation
- C. Continuous integration
- D. Static analysis tools
- E. Application containerization
- F. Development environment access controls
Answer: A,D
NEW QUESTION 28
......
TestValid CAS-003 Exam Practice Test Questions : https://www.testvalid.com/CAS-003-exam-collection.html