[Aug-2022] CompTIA CAS-003 Test Engine PDF - All Free Dumps from ExamsLabs
Get New CAS-003 Certification – Valid Exam Dumps Questions
The benefit in Obtaining the CAS-003 Exam Certification
- The big advantage of CompTIA certifications is especially for those candidates who are new to the IT field and they want to increase their own personal confidence. After getting a certification they gain proof that will give them more credibility and determination to advance their career.
- There are many companies and organizations have made CompTIA certifications compulsory for certain positions and several job advertisements list the certification as primary requirements. Certified professionals earn more than non-certified IT professionals in the same job roles.
- Many colleges and universities are giving college credit for students who get CompTIA certifications.
- There are many Companies like Microsoft, Cisco, Novell, HP etc. in their own certification tracks are require a CompTIA certification like Network+.
NEW QUESTION 177
A software development team has spent the last 18 months developing a new web-based front-end that will allow clients to check the status of their orders as they proceed through manufacturing. The marketing team schedules a launch party to present the new application to the client base in two weeks. Before the launch, the security team discovers numerous flaws that may introduce dangerous vulnerabilities, allowing direct access to a database used by manufacturing. The development team did not plan to remediate these vulnerabilities during development.
Which of the following SDLC best practices should the development team have followed?
- A. Verifying system design documentation
- B. Completing user acceptance testing
- C. Implementing regression testing
- D. Using a SRTM
Answer: D
NEW QUESTION 178
A Chief Security Officer (CSO) is reviewing the organization's incident response report from a recent incident. The details of the event indicate:
* A user received a phishing email that appeared to be a report from the organization's CRM tool.
* The user attempted to access the CRM tool via a fraudulent web page but was unable to access the tool.
* The user, unaware of the compromised account, did not report the incident and continued to use the CRM tool with the original credentials.
* Several weeks later, the user reported anomalous activity within the CRM tool.
* Following an investigation, it was determined the account was compromised and an attacker in another country has gained access to the CRM tool.
* Following identification of corrupted data and successful recovery from the incident, a lessons learned
* activity was to be led by the CSO.
Which of the following would MOST likely have allowed the user to more quickly identify the unauthorized use of credentials by the attacker?
- A. WAYF-based authentication
- B. Security awareness training
- C. Time-of-use controls
- D. Log correlation
- E. Time-of-check controls
- F. Last login verification
Answer: B
NEW QUESTION 179
DRAG DROP
IT staff within a company often conduct remote desktop sharing sessions with vendors to troubleshoot vendor product-related issues. Drag and drop the following security controls to match the associated security concern. Options may be used once or not at all.
Answer:
Explanation:
Explanation:
Vendor may accidentally or maliciously make changes to the IT system - Allow view-only access.
With view-only access, the third party can view the desktop but cannot interact with it. In other words, they cannot control the keyboard or mouse to make any changes.
Desktop sharing traffic may be intercepted by network attackers - Use SSL for remote sessions.
SSL (Secure Sockets Layer) encrypts data in transit between computers. If an attacker intercepted the traffic, the data would be encrypted and therefore unreadable to the attacker.
No guarantees that shoulder surfing attacks are not occurring at the vendor - Identified control gap.
Shoulder surfing is where someone else gains information by looking at your computer screen. This should be identified as a risk. A control gap occurs when there are either insufficient or no actions taken to avoid or mitigate a significant risk.
Vendor may inadvertently see confidential material from the company such as email and IMs - Limit desktop session to certain windows.
The easiest way to prevent a third party from viewing your emails and IMs is to close the email and IM application windows for the duration of the desktop sharing session.
NEW QUESTION 180
Compliance with company policy requires a quarterly review of firewall rules. A new administrator is asked to conduct this review on the internal firewall sitting between several internal networks. The intent of this firewall is to make traffic more restrictive. Given the following information answer the questions below:
User Subnet: 192.168.1.0/24 Server Subnet: 192.168.2.0/24 Finance Subnet:192.168.3.0/24 Instructions: To perform the necessary tasks, please modify the DST port, Protocol, Action, and/or Rule Order columns. Firewall ACLs are read from the top down Task 1) An administrator added a rule to allow their machine terminal server access to the server subnet. This rule is not working. Identify the rule and correct this issue.
Task 2) All web servers have been changed to communicate solely over SSL. Modify the appropriate rule to allow communications.
Task 3) An administrator added a rule to block access to the SQL server from anywhere on the network. This rule is not working. Identify and correct this issue.
Task 4) Other than allowing all hosts to do network time and SSL, modify a rule to ensure that no other traffic is allowed.
Answer:
Explanation:
Check the solution below.
Check the answer below
Task 1) An administrator added a rule to allow their machine terminal server access to the server subnet. This rule is not working. Identify the rule and correct this issue.
The rule shown in the image below is the rule in question. It is not working because the action is set to Deny.
This needs to be set to Permit.
Task 2) All web servers have been changed to communicate solely over SSL. Modify the appropriate rule to allow communications.
The web servers rule is shown in the image below. Port 80 (HTTP) needs to be changed to port 443 for HTTPS (HTTP over SSL).
Task 3) An administrator added a rule to block access to the SQL server from anywhere on the network. This rule is not working. Identify and correct this issue.
The SQL Server rule is shown in the image below. It is not working because the protocol is wrong. It should be TCP, not UDP.
Task 4) Other than allowing all hosts to do network time and SSL, modify a rule to ensure that no other traffic is allowed.
The network time rule is shown in the image below.
However, this rule is not being used because the 'any' rule shown below allows all traffic and the rule is placed above the network time rule. To block all other traffic, the 'any' rule needs to be set to Deny, not Permit and the rule needs to be placed below all the other rules (it needs to be placed at the bottom of the list to the rule is enumerated last).
NEW QUESTION 181
An administrator wishes to replace a legacy clinical software product as it has become a security risk. The legacy product generates $10,000 in revenue a month. The new software product has an initial cost of
$180,000 and a yearly maintenance of $2,000 after the first year. However, it will generate $15,000 in revenue per month and be more secure. How many years until there is a return on investment for this new package?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
Explanation
Return on investment = Net profit / Investment
where:
Profit for the first year is $60 000, second year = $ 120 000 ; third year = $ 180 000 ; and fourth year = $
240 000
investment in first year = $ 180 000, by year 2 = $ 182 000; by year 3 = $ 184 000 ; and by year 4 = $ 186 000 Thus you will only get a return on the investment in 4 years' time.
References:
http://www.financeformulas.net/Return_on_Inve
NEW QUESTION 182
A security consultant is attempting to discover if the company is utilizing databases on client machines to store the customer data. The consultant reviews the following information:
Which of the following commands would have provided this output?
- A. arp -s
- B. sqlmap -w
- C. netstat -a
- D. ifconfig -arp
Answer: C
NEW QUESTION 183
A security administrator must configure the database server shown below to comply with the four requirements listed. Drag and drop the appropriate ACL that should be configured on the database server to its corresponding requirement. Answer options may be used once or not at all.
Answer:
Explanation:
Explanation
NEW QUESTION 184
A multi-national company has a highly mobile workforce and minimal IT infrastructure. The company utilizes a BYOD and social media policy to integrate presence technology into global collaboration tools by individuals and teams. As a result of the dispersed employees and frequent international travel, the company is concerned about the safety of employees and their families when moving in and out of certain countries. Which of the following could the company view as a downside of using presence technology?
- A. Physical security
- B. Insider threat
- C. Network reconnaissance
- D. Industrial espionage
Answer: A
Explanation:
If all company users worked in the same office with one corporate network and using company supplied laptops, then it is easy to implement all sorts of physical security controls. Examples of physical security include intrusion detection systems, fire protection systems, surveillance cameras or simply a lock on the office door.
However, in this question we have dispersed employees using their own devices and frequently traveling internationally. This makes it extremely difficult to implement any kind of physical security.
Physical security is the protection of personnel, hardware, programs, networks, and data from physical circumstances and events that could cause serious losses or damage to an enterprise, agency, or institution. This includes protection from fire, natural disasters, burglary, theft, vandalism, and terrorism.
Incorrect Answers:
A: An insider threat is a malicious hacker (also called a cracker or a black hat) who is an employee or officer of a business, institution, or agency. Dispersed employees using presence technology does not increase the risk of insider threat when compared to employees working together in an office.
B: The risk of network reconnaissance is reduced by having dispersed employees using presence technology. The risk of network reconnaissance would be higher with employees working together in a single location such as an office.
D: Industrial espionage is a threat to any business whose livelihood depends on information. However, this threat is not increased by having dispersed employees using presence technology. The risk would be the same with dispersed employees using presence technology or employees working together in a single location such as an office.
References:
http://searchsecurity.techtarget.com/definition/physical-security
NEW QUESTION 185
The security engineer receives an incident ticket from the helpdesk stating that DNS lookup requests are no longer working from the office. The network team has ensured that Layer 2 and Layer 3 connectivity are working. Which of the following tools would a security engineer use to make sure the DNS server is listening on port 53?
- A. NSLOOKUP
- B. NESSUS
- C. PING
- D. NMAP
Answer: D
Explanation:
Explanation
NMAP works as a port scanner and is used to check if the DNS server is listening on port 53.
NEW QUESTION 186
News outlets are beginning to report on a number of retail establishments that are experiencing payment card data breaches. The data exfiltration is enabled by malware on a compromised computer. After the initial exploit, network mapping and fingerprinting is conducted to prepare for further exploitation. Which of the following is the MOST effective solution to protect against unrecognized malware infections?
- A. Implement an application whitelist at all levels of the organization.
- B. Update router configuration to pass all network traffic through a new proxy server with advanced malware detection.
- C. Deploy a network based heuristic IDS, configure all layer 3 switches to feed data to the IDS for more effective monitoring.
- D. Remove local admin permissions from all users and change anti-virus to a cloud aware, push technology.
Answer: A
Explanation:
Explanation
In essence a whitelist screening will ensure that only acceptable applications are passed / or granted access.
NEW QUESTION 187
An enterprise is trying to secure a specific web-based application by forcing the use of multifactor authentication. Currently, the enterprise cannot change the application's sign-in page to include an extra field. However, the web-based application supports SAML.
Which of the following would BEST secure the application?
- A. Deploying Shibboleth to all web-based applications in the enterprise
- B. Forcing higher-complexity passwords and frequent changes
- C. Using an SSO application that supports mutlifactor authentication
- D. Enabling the web application to support LDAP integration
Answer: A
Explanation:
Shibboleth is a federated identity method based on SAML that is often employed by universities or public service organizations. In a Shibboleth implementation, a user attempts to retrieve resources from a Shibbolethenabled website, which then sends SAML authentication information over URL queries. The user is then redirected to an identity provider with which they can authenticate using this SAML information. The identity provider then responds to the service provider (the Shibboleth-enabled website) with the proper authentication information. The site validates this response and grants the user access to certain resources based on their SAML information.
NEW QUESTION 188
A security administrator was doing a packet capture and noticed a system communicating with an unauthorized address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network.
Which of the following is the BEST course of action?
- A. Locate and remove the unauthorized 6to4 relay from the network
- B. Remove the system from the network and disable IPv6 at the router
- C. Disable the switch port and block the 2001::/32 traffic at the firewall
- D. Investigate the network traffic and block UDP port 3544 at the firewall
Answer: D
Explanation:
Explanation
The 2001::/32 prefix is used for Teredo tunneling.
Teredo is a transition technology that gives full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 Internet but have no native connection to an IPv6 network. Unlike similar protocols, it can perform its function even from behind network address translation (NAT) devices such as home routers.
Teredo provides IPv6 (Internet Protocol version 6) connectivity by encapsulating IPv6 datagram packets within IPv4 User Datagram Protocol (UDP) packets. Teredo routes these datagrams on the IPv4 Internet and through NAT devices. Teredo nodes elsewhere on the IPv6 network (called Teredo relays) receive the packets, decapsulate them, and pass them on. The Teredo server listens on UDP port 3544.
Teredo clients are assigned an IPv6 address that starts with the Teredo prefix (2001::/32).
In this question, the BEST course of action would be to block UDP port 3544 at the firewall. This will block the unauthorized communication. You can then investigate the traffic within the network.
NEW QUESTION 189
An engineer needs to provide access to company resources for several offshore contractors. The contractors require:
* Access to a number of applications, including internal websites
* Access to database data and the ability to manipulate it
* The ability to log into Linux and Windows servers remotely
Which of the following remote access technologies are the BEST choices to provide all of this access securely? (Choose two.)
- A. VPN
- B. VTC
- C. VRRP
- D. VDI
- E. Telnet
- F. VLAN
Answer: A,D
NEW QUESTION 190
Drag and drop the cloud deployment model to the associated use-case scenario. Options may be used only once or not at all.
Answer:
Explanation:
NEW QUESTION 191
An organization has recently deployed an EDR solution across its laptops, desktops, and server
infrastructure. The organization's server infrastructure is deployed in an IaaS environment. A database
within the non-production environment has been misconfigured with a routable IP and is communicating
with a command and control server.
Which of the following procedures should the security responder apply to the situation? (Choose two.)
- A. Disclose the breach to customers.
- B. Perform a risk assessment.
- C. Perform an IOC sweep to determine the impact.
- D. Initiate a legal hold.
- E. Determine the data handling standard.
- F. Contain the server.
Answer: C,D
NEW QUESTION 192
An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the penetration tester to MOST efficiently use any obtained administrative credentials on the client organization's other systems, without impacting the integrity of any of the systems?
- A. Use the existing access to change the password
- B. Use the pass the hash technique
- C. Use social engineering to obtain the actual password
- D. Use rainbow tables to crack the passwords
Answer: B
Explanation:
With passing the hash you can grab NTLM credentials and you can manipulate the Windows logon sessions maintained by the LSA component. This will allow you to operate as an administrative user and not impact the integrity of any of the systems when running your tests.
NEW QUESTION 193
......
CompTIA CASP+ CAS-003 Practice Test Questions, CompTIA CASP+ CAS-003 Exam Practice Test Questions
The CompTIA CAS-003 exam determines if the applicants are advanced in their competency regarding risk management, enterprise security, collaboration, and research. It also checks their capabilities in integrating enterprise security. Passing this test enables you to obtain the CompTIA Advanced Security Practitioner certification, also known as CASP+. Getting it is an indication of bearing advanced skills in risk analysis, security control, technologies for virtualization and Cloud, and cryptographic techniques.
Preparation Process
There are numerous resources that the candidates can use to prepare for the CompTIA CAS-003 certification exam. The official materials include an instructor-led training course, self-paced E-learning resources, and hands-on virtual labs. The individuals can purchase a comprehensive bundle for this test comprising of the CompTIA CertMaster Labs for CASP+ Exam as well as the official CompTIA CASP+ Self-Paced Study Guide (eBook). The applicants can find the links to these tools on the exam webpage.
100% Passing Guarantee - Brilliant CAS-003 Exam Questions PDF: https://www.examslabs.com/CompTIA/CASP-Recertification/best-CAS-003-exam-dumps.html