[Q91-Q112] Exam Passing Guarantee Jun 16, 2022 CAS-003 Exam with Accurate Quastions!

NEW QUESTION 91
A company recently migrated to a SaaS-based email solution. The solution is configured as follows.
* Passwords are synced to the cloud to allow for SSO
* Cloud-based antivirus is enabled
* Cloud-based anti-spam is enabled
* Subscription-based blacklist is enabled
Although the above controls are enabled, the company’s security administrator is unable to detect an account compromise caused by phishing attacks in a timely fashion because email logs are not immediately available to review. Which of the following would allow the company to gam additional visibility and reduce additional costs? (Select TWO)

Migrate the email antivirus and anti-spam on-premises

Implement a third-party CASB solution.

Disable the current SSO model and enable federation

Feed the attacker IPs from the company IDS into the email blacklist

Install a virtual SIEM within the email cloud provider

Add email servers to NOC monitoring

NEW QUESTION 92
Drag and drop the cloud deployment model to the associated use-case scenario. Options may be used only once or not at all.

NEW QUESTION 93
A managed service provider is designing a log aggregation service for customers who no longer want to manage an internal SIEM infrastructure. The provider expects that customers will send all types of logs to them, and that log files could contain very sensitive entries. Customers have indicated they want on-premises and cloud-based infrastructure logs to be stored in this new service. An engineer, who is designing the new service, is deciding how to segment customers.
Which of the following is the BEST statement for the engineer to take into consideration?

Single-tenancy is often more expensive and has less efficient resource utilization. Multi-tenancy may increase the risk of cross-customer exposure in the event of service vulnerabilities.

The managed service provider should outsource security of the platform to an existing cloud company. This will allow the new log service to be launched faster and with well-tested security controls.

Due to the likelihood of large log volumes, the service provider should use a multi-tenancy model for the data storage tier, enable data deduplication for storage cost efficiencies, and encrypt data at rest.

The most secure design approach would be to give customers on-premises appliances, install agents on endpoints, and then remotely manage the service via a VPN.

NEW QUESTION 94
A security administrator is performing VDI traffic data collection on a virtual server which migrates from one host to another. While reviewing the data collected by the protocol analyzer, the security administrator notices that sensitive data is present in the packet capture. Which of the following should the security administrator recommend to ensure the confidentiality of sensitive information during live VM migration, while minimizing latency issues?

A separate physical interface placed on a private VLAN should be configured for live host operations.

Database record encryption should be used when storing sensitive information on virtual servers.

Full disk encryption should be enabled across the enterprise to ensure the confidentiality of sensitive data.

Sensitive data should be stored on a backend SAN which uses an isolated fiber channel network.

NEW QUESTION 95
A security analyst is classifying data based on input from data owners and other stakeholders. The analyst has identified three data types:
1. Financially sensitive data
2. Project data
3. Sensitive project data
The analyst proposes that the data be protected in two major groups, with further access control separating the financially sensitive data from the sensitive project data. The normal project data will be stored in a separate, less secure location. Some stakeholders are concerned about the recommended approach and insist that commingling data from different sensitive projects would leave them vulnerable to industrial espionage.
Which of the following is the BEST course of action for the analyst to recommend?

Conduct a quantitative evaluation of the risks associated with commingling the data and reject or accept the concerns raised by the stakeholders.

Meet with the affected stakeholders and determine which security controls would be sufficient to address the newly raised risks.

Use qualitative methods to determine aggregate risk scores for each project and use the derived scores to more finely segregate the data.

Increase the number of available data storage devices to provide enough capacity for physical separation of non-sensitive project data.

NEW QUESTION 96
A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the
following command:
dd if=/dev/ram of=/tmp/mem/dmp
The analyst then reviews the associated output:
^34^#AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/bin/bash^21^03#45
However, the analyst is unable to find any evidence of the running shell.
Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?

The NX bit is enabled

The system uses ASLR

The shell is obfuscated

The code uses dynamic libraries

NEW QUESTION 97
A bank is initiating the process of acquiring another smaller bank. Before negotiations happen between the organizations, which of the follwing business documents would be used as the FIRST step in the process?

MOU

OLA

BPA

NDA

NEW QUESTION 98
A company has hired an external security consultant to conduct a thorough review of all aspects of corporate security. The company is particularly concerned about unauthorized access to its physical offices resulting in network compromises. Which of the following should the consultant recommend be performed to evaluate potential risks?

The consultant should attempt to gain access to physical offices through social engineering and then attempt data exfiltration

The consultant should be granted access to all physical access control systems to review logs and evaluate the likelihood of the threat

The company should conduct internal audits of access logs and employee social media feeds to identify potential insider threats

The company should install a temporary CCTV system to detect unauthorized access to physical offices

NEW QUESTION 99
As a security administrator, you are asked to harden a server running Red Hat Enterprise Server 5.5 64-bit.
This server is being used as a DNS and time server. It is not used as a database, web server, or print server. There are no wireless connections to the server, and it does not need to print.
The command window will be provided along with root access. You are connected via a secure shell with root access.
You may query help for a list of commands.
Instructions:
You need to disable and turn off unrelated services and processes.
It is possible to simulate a crash of your server session. The simulation can be reset, but the server cannot be rebooted. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

In Order to deactivate web services, database services and print service, we can do following things
1) deactivate its services
/etc/init.d/apache2 stop
/etc/init.d/mysqld stop
2) close ports for these services
Web Server
iptables -I INPUT -p tcp -m tcp –dport 443 -j REJECTservice iptables save
Print Server
iptables -I INPUT -p tcp -m tcp –dport 631 -j REJECTservice iptables save
Database Server
iptables -I INPUT -p tcp -m tcp –dport <<port umber>> -j REJECTservice iptables save
3) Kill the process any running for the same
ps -aef|grep mysql
kill -9 <<process id>>

In Order to deactivate web services, database services and print service, we can do following things
1) deactivate its services
/etc/init.d/apache2 stop
2) close ports for these services
Web Server
iptables -I INPUT -p tcp -m tcp –dport 631 -j REJECTservice iptables save
Database Server
iptables -I INPUT -p tcp -m tcp –dport <<port umber>> -j REJECTservice iptables save
3) Kill the process any running for the same
kill -9 <<process id>>

NEW QUESTION 100
Drag and drop the cloud deployment model to the associated use-case scenario. Options may be used only once or not at all.

NEW QUESTION 101
An information security officer is responsible for one secure network and one office network.
Recent intelligence suggests there is an opportunity for attackers to gain access to the secure network due to similar login credentials across networks. To determine the users who should change their information, the information security officer uses a tool to scan a file with hashed values on both networks and receives the following data:

Which of the following tools was used to gather this information from the hashed values in the file?

Vulnerability scanner

Fuzzer

MD5 generator

Password cracker

Protocol analyzer

NEW QUESTION 102
An assessor identifies automated methods for identifying security control compliance through validating sensors at the endpoint and at Tier 2. Which of the following practices satisfy continuous monitoring of authorized information systems?

Independent verification and validation

Security test and evaluation

Risk assessment

Ongoing authorization

NEW QUESTION 103
An engineer is evaluating the control profile to assign to a system containing PII, financial, and proprietary data.

Based on the data classification table above, which of the following BEST describes the overall classification?

High confidentiality, high availability

High confidentiality, medium availability

Low availability, low confidentiality

High integrity, low availability

NEW QUESTION 104
An assessor identifies automated methods for identifying security control compliance through validating sensors at the endpoint and at Tier 2. Which of the following practices satisfy continuous monitoring of authorized information systems?

Independent verification and validation

Security test and evaluation

Risk assessment

Ongoing authorization

NEW QUESTION 105
An organization uses IP address block 203.0.113.0/24 on its internal network. At the border router, the network administrator sets up rules to deny packets with a source address in this subnet from entering the network, and to deny packets with a destination address in this subnet from leaving the network. Which of the following is the administrator attempting to prevent?

BGP route hijacking attacks

Bogon IP network traffic

IP spoofing attacks

Man-in-the-middle attacks

Amplified DDoS attacks

NEW QUESTION 106
A company that has been breached multiple times is looking to protect cardholder data. The previous undetected attacks all mimicked normal administrative-type behavior. The company must deploy a host solution to meet the following requirements:
– Detect administrative actions
– Block unwanted MD5 hashes
– Provide alerts
– Stop exfiltration of cardholder data
Which of the following solutions would BEST meet these requirements? (Choose two.)

AV

EDR

HIDS

DLP

HIPS

EFS

NEW QUESTION 107
An engineer wants to assess the OS security configurations on a company’s servers. The engineer has downloaded some files to orchestrate configuration checks When the engineer opens a file in a text editor, the following excerpt appears:

Which of the following capabilities would a configuration compliance checker need to support to interpret this file?

Nessus

Swagger file

SCAP

Netcat

WSDL

NEW QUESTION 108
A researcher is working to identify what appears to be a new variant of an existing piece of malware commonly used in ransomware attacks While it is not identical to the malware previously evaluated. it has a number of similarities including language, payload. and algorithms. Which of the following would help the researcher safely compare the code base of the two variants?

Virtualized sandbox

Vulnerability scanner

Software-defined network

HTTP interceptor

NEW QUESTION 109
A web services company is planning a one-time high-profile event to be hosted on the corporate website. An outage, due to an attack, would be publicly embarrassing, so Joe, the Chief Executive Officer (CEO), has requested that his security engineers put temporary preventive controls in place. Which of the following would MOST appropriately address Joe’s concerns?

Ensure web services hosting the event use TCP cookies and deny_hosts.

Configure an intrusion prevention system that blocks IPs after detecting too many incomplete sessions.

Contract and configure scrubbing services with third-party DDoS mitigation providers.

Purchase additional bandwidth from the company’s Internet service provider.

NEW QUESTION 110
A financial services company wants to migrate its email services from on-premises servers to a cloud-based email solution. The Chief information Security Officer (CISO) must brief board of directors on the potential security concerns related to this migration. The board is concerned about the following.
* Transactions being required by unauthorized individual
* Complete discretion regarding client names, account numbers, and investment information.
* Malicious attacker using email to distribute malware and ransom ware.
* Exfiltration of sensitivity company information.
The cloud-based email solution will provide an6-malware, reputation-based scanning, signature-based scanning, and sandboxing. Which of the following is the BEST option to resolve the board’s concerns for this email migration?

Data loss prevention

Endpoint detection response

SSL VPN

Application whitelisting

NEW QUESTION 111
A Chief Information Security Officer (CISO) is reviewing the results of a gap analysis with an outside cybersecurity consultant. The gap analysis reviewed all procedural and technical controls and found the following:
* High-impact controls implemented: 6 out of 10
* Medium-impact controls implemented: 409 out of 472
* Low-impact controls implemented: 97 out of 1000
The report includes a cost-benefit analysis for each control gap. The analysis yielded the following information:
* Average high-impact control implementation cost: $15,000; Probable ALE for each high-impact control gap: $95,000
* Average medium-impact control implementation cost: $6,250; Probable ALE for each medium-impact control gap: $11,000
Due to the technical construction and configuration of the corporate enterprise, slightly more than 50% of the medium-impact controls will take two years to fully implement. Which of the following conclusions could the CISO draw from the analysis?

Too much emphasis has been placed on eliminating low-risk vulnerabilities in the past

The enterprise security team has focused exclusively on mitigating high-level risks

Because of the significant ALE for each high-risk vulnerability, efforts should be focused on those controls

The cybersecurity team has balanced residual risk for both high and medium controls

NEW QUESTION 112
A factory-floor system uses critical legacy, and unsupported application software to enable factory operations A latent vulnerability was recently exposed, which permitted attackers to send a specific string of characters followed by arbitrary code for execution Patches are unavailable, as the manufacturer is no longer m business Which of the following would be the BEST approach the company should take to mitigate the risk of this vulnerability and other latent vulnerability exploits” (Select TWO)

Configure a host-based firewall on the application server and restrict access to necessary ports and services

Create a factory-floor enclave segregated from direct LANWAN reachability

implement a proxy that will sanitize input provided to the application

install server-side X 509 certificates and enable TLS 1.0 or later for client access

Install network and host-based IDS feeding logs to SIEM and alerts to SOC operators

Create a hunt team focused on the factory-floor operations