CAS-004: CompTIA Advanced Security Practitioner (CASP+) CAS-004

Question #: 201
Topic #: 1
A security analyst sees that a hacker has discovered some keys and they are being made available on a public website. The security analyst is then able to successfully decrypt that data using the keys from the website. Which of the following should the security analyst recommend to protect the affected data?

A. Key rotation
B. Key escrow
C. Zeroization
D. Cryptographic obfuscation

Hint Answer: A

Question #: 202
Topic #: 1
Which of the following is MOST commonly found in a network SLA contract?

A. Price for extra services
B. Performance metrics
C. Service provider responsibility only
D. Limitation of liability
E. Confidentiality and non-disclosure

Hint Answer: B

Question #: 203
Topic #: 1
A security operations center analyst is investigating anomalous activity between a database server and an unknown external IP address and gathered the following data:

• dbadmin last logged in at 7:30 a.m. and logged out at 8:05 a.m.
• A persistent TCP/6667 connection to the external address was established at 7:55 a.m. The connection is still active.
• Other than bytes transferred to keep the connection alive, only a few kilobytes of data transfer every hour since the start of the connection.
• A sample outbound request payload from PCAP showed the ASCII content: “JOIN #community”.

Which of the following is the MOST likely root cause?

A. A SQL injection was used to exfiltrate data from the database server.
B. The system has been hijacked for cryptocurrency mining.
C. A botnet Trojan is installed on the database server.
D. The dbadmin user is consulting the community for help via Internet Relay Chat.

Hint Answer: D

Question #: 204
Topic #: 1
Which of the following describes the system responsible for storing private encryption/decryption files with a third party to ensure these files are stored safely?

A. Key escrow
B. TPM
C. Trust models
D. Code signing

Hint Answer: A

Question #: 205
Topic #: 1
A security administrator has been tasked with hardening a domain controller against lateral movement attacks. Below is an output of running services:

Which of the following configuration changes must be made to complete this task?

A. Stop the Print Spooler service and set the startup type to disabled.
B. Stop the DNS Server service and set the startup type to disabled.
C. Stop the Active Directory Web Services service and set the startup type to disabled.
D. Stop Credential Manager service and leave the startup type to disabled.

Hint Answer: A

Question #: 206
Topic #: 1
In comparison to other types of alternative processing sites that may be invoked as a part of disaster recovery, cold sites are different because they:

A. have basic utility coverage, including power and water.
B. provide workstations and read-only domain controllers.
C. are generally the least costly to sustain.
D. are the quickest way to restore business.
E. are geographically separated from the company’s primary facilities.

Hint Answer: C

Question #: 207
Topic #: 1
A security architect works for a manufacturing organization that has many different branch offices. The architect is looking for a way to reduce traffic and ensure the branch offices receive the latest copy of revoked certificates issued by the CA at the organization’s headquarters location. The solution must also have the lowest power requirement on the CA.

Which of the following is the BEST solution?

A. Deploy an RA on each branch office.
B. Use Delta CRLs at the branches.
C. Configure clients to use OCSP.
D. Send the new CRLs by using scheduled jobs.

Hint Answer: C

Question #: 208
Topic #: 1
An enterprise is undergoing an audit to review change management activities when promoting code to production. The audit reveals the following:

• Some developers can directly publish code to the production environment.
• Static code reviews are performed adequately.
• Vulnerability scanning occurs on a regularly scheduled basis per policy.

Which of the following should be noted as a recommendation within the audit report?

A. Implement short maintenance windows.
B. Perform periodic account reviews.
C. Implement job rotation.
D. Improve separation of duties.

Hint Answer: D

Question #: 209
Topic #: 1
A security researcher has been given an executable that was captured by a honeypot. Which of the following should the security researcher implement to test the executable?

A. OSINT
B. SAST
C. DAST
D. OWASP

Hint Answer: C

Question #: 210
Topic #: 1
An executive has decided to move a company’s customer-facing application to the cloud after experiencing a lengthy power outage at a locally managed service provider’s data center. The executive would like a solution that can be implemented as soon as possible. Which of the following will BEST prevent similar issues when the service is running in the cloud? (Choose two.)

A. Placing the application instances in different availability zones
B. Restoring the snapshot and starting the new application instance from a different zone
C. Enabling autoscaling based on application instance usage
D. Having several application instances running in different VPCs
E. Using the combination of block storage and multiple CDNs in each application instance
F. Setting up application instances in multiple regions

Hint Answer: AF

Question #: 211
Topic #: 1
A hospitality company experienced a data breach that included customer PII. The hacker used social engineering to convince an employee to grant a third-party application access to some company documents within a cloud file storage service Which of the following is the BEST solution to help prevent this type of attack in the future?

A. NGFW for web traffic inspection and activity monitoring
B. CSPM for application configuration control
C. Targeted employee training and awareness exercises
D. CASB for OAuth application permission control

Hint Answer: C

Question #: 212
Topic #: 1
A product manager at a new company needs to ensure the development team produces high-quality code on time. The manager has decided to implement an agile development approach instead of waterfall. Which of the following are reasons to choose an agile development approach? (Choose two.)

A. The product manager gives the developers more autonomy to write quality code prior to deployment.
B. An agile approach incorporates greater application security in the development process than a waterfall approach does.
C. The scope of work is expected to evolve during the lifetime of project development.
D. The product manager prefers to have code iteratively tested throughout development.
E. The product manager would like to produce code in linear phases.
F. Budgeting and creating a timeline for the entire project is often more straightforward using an agile approach rather than waterfall.

Hint Answer: CD

Question #: 213
Topic #: 1
An auditor needs to scan documents at rest for sensitive text. These documents contain both text and images. Which of the following software functionalities must be enabled in the DLP solution for the auditor to be able to fully read these documents? (Choose two.)

A. Document interpolation
B. Regular expression pattern matching
C. Optical character recognition functionality
D. Baseline image matching
E. Advanced rasterization
F. Watermarking

Hint Answer: BC

Question #: 214
Topic #: 1
A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears:

Which of the following BEST describes the analyst’s findings and a potential mitigation technique?

A. The findings indicate unsecure references. All potential user input needs to be properly sanitized.
B. The findings indicate unsecure protocols All cookies should be marked as HttpOnly.
C. The findings indicate information disclosure. The displayed error message should be modified.
D. The findings indicate a SQL injection. The database needs to be upgraded.

Hint Answer: C

Question #: 215
Topic #: 1
A local university that has a global footprint is undertaking a complete overhaul of its website and associated systems Some of the requirements are:

• Handle an increase in customer demand of resources
• Provide quick and easy access to information
• Provide high-quality streaming media
• Create a user-friendly interface

Which of the following actions should be taken FIRST?

A. Deploy high-availability web servers.
B. Enhance network access controls.
C. Implement a content delivery network.
D. Migrate to a virtualized environment.

Hint Answer: C

Question #: 216
Topic #: 1
In order to save money, a company has moved its data to the cloud with a low-cost provider. The company did not perform a security review prior to the move; however, the company requires all of its data to be stored within the country where the headquarters is located. A new employee on the security team has been asked to evaluate the current provider against the most important requirements. The current cloud provider that the company is using offers:

• Only multitenant cloud hosting
• Minimal physical security
• Few access controls
• No access to the data center

The following information has been uncovered:

• The company is located in a known floodplain. which flooded last year.
• Government regulations require data to be stored within the country.

Which of the following should be addressed FIRST?

A. Update the disaster recovery plan to account for natural disasters.
B. Establish a new memorandum of understanding with the cloud provider.
C. Establish a new service-level agreement with the cloud provider.
D. Provision services according to the appropriate legal requirements.

Hint Answer: C

Question #: 217
Topic #: 1
A security administrator needs to implement an X.509 solution for multiple sites within the human resources department. This solution would need to secure all subdomains associated with the domain name of the main human resources web server. Which of the following would need to be implemented to properly secure the sites and provide easier private key management?

A. Certificate revocation list
B. Digital signature
C. Wildcard certificate
D. Registration authority
E. Certificate pinning

Hint Answer: C

Question #: 218
Topic #: 1
An organization’s threat team is creating a model based on a number of incidents in which systems in an air-gapped location are compromised. Physical access to the location and logical access to the systems are limited to administrators and select, approved, on-site company employees. Which of the following is the BEST strategy to reduce the risks of data exposure?

A. NDAs
B. Mandatory access control
C. NIPS
D. Security awareness training

Hint Answer: B

Question #: 219
Topic #: 1
An organization is establishing a new software assurance program to vet applications before they are introduced into the production environment. Unfortunately, many of the applications are provided only as compiled binaries. Which of the following should the organization use to analyze these applications? (Choose two.)

A. Regression testing
B. SAST
C. Third-party dependency management
D. IDE SAST
E. Fuzz testing
F. IAST

Hint Answer: EF

Question #: 220
Topic #: 1
Which of the following agreements includes no penalties and can be signed by two entities that are working together toward the same goal?

A. MOU
B. NDA
C. SLA
D. ISA

Hint Answer: A

Question #: 221
Topic #: 1
Which of the following BEST describes a common use case for homomorphic encryption?

A. Processing data on a server after decrypting in order to prevent unauthorized access in transit
B. Maintaining the confidentiality of data both at rest and in transit to and from a CSP for processing
C. Transmitting confidential data to a CSP for processing on a large number of resources without revealing information
D. Storing proprietary data across multiple nodes in a private cloud to prevent access by unauthenticated users

Hint Answer: C

Question #: 222
Topic #: 1
A security analyst runs a vulnerability scan on a network administrator’s workstation. The network administrator has direct administrative access to the company’s SSO web portal. The vulnerability scan uncovers critical vulnerabilities with equally high CVSS scores for the user’s browser, OS, email client, and an offline password manager. Which of the following should the security analyst patch FIRST?

A. Email client
B. Password manager
C. Browser
D. OS

Hint Answer: D

Question #: 223
Topic #: 1
An organization is moving its intellectual property data from on premises to a CSP and wants to secure the data from theft. Which of the following can be used to mitigate this risk?

A. An additional layer of encryption
B. A third-party, data integrity monitoring solution
C. A complete backup that is created before moving the data
D. Additional application firewall rules specific to the migration

Hint Answer: A

Question #: 224
Topic #: 1
A software developer is working on a piece of code required by a new software package. The code should use a protocol to verify the validity of a remote identity. Which of the following should the developer implement in the code?

A. RSA
B. OCSP
C. HSTS
D. CRL

Hint Answer: B

Question #: 225
Topic #: 1
Users are reporting intermittent access issues with a new cloud application that was recently added to the network. Upon investigation, the security administrator notices the human resources department is able to run required queries with the new application, but the marketing department is unable to pull any needed reports on various resources using the new application. Which of the following MOST likely needs to be done to avoid this in the future?

A. Modify the ACLs.
B. Review the Active Directory.
C. Update the marketing department’s browser.
D. Reconfigure the WAF.

Hint Answer: A

Question #: 226
Topic #: 1
A server in a manufacturing environment is running an end-of-life operating system. The vulnerability management team is recommending that the server be upgraded to a supported operating system, but the ICS software running on the server is not compatible with modem operating systems. Which of the following compensating controls should be implemented to BEST protect the server?

A. Application allow list
B. Antivirus
C. HIPS
D. Host-based firewall

Hint Answer: A

Question #: 227
Topic #: 1
A firewall administrator needs to ensure all traffic across the company network is inspected. The administrator gathers data and finds the following information regarding the typical traffic in the network:

Which of the following is the BEST solution to ensure the administrator can complete the assigned task?

A. A full-tunnel VPN
B. Web content filtering
C. An endpoint DLP solution
D. SSL/TLS decryption

Hint Answer: D

Question #: 228
Topic #: 1
A city government’s IT director was notified by the city council that the following cybersecurity requirements must be met to be awarded a large federal grant:

• Logs for all critical devices must be retained for 365 days to enable monitoring and threat hunting.
• All privileged user access must be tightly controlled and tracked to mitigate compromised accounts.
• Ransomware threats and zero-day vulnerabilities must be quickly identified.

Which of the following technologies would BEST satisfy these requirements? (Choose three.)

A. Endpoint protection
B. Log aggregator
C. Zero trust network access
D. PAM
E. Cloud sandbox
F. SIEM
G. NGFW

Hint Answer: BDF

Question #: 229
Topic #: 1
Company A acquired Company B. During an initial assessment, the companies discover they are using the same SSO system. To help users with the transition. Company A is requiring the following:

• Before the merger is complete, users from both companies should use a single set of usernames and passwords.
• Users in the same departments should have the same set of rights and privileges, but they should have different sets of rights and privileges if they have different IPs.
• Users from Company B should be able to access Company A’s available resources.

Which of the following are the BEST solutions? (Choose two.)

A. Installing new Group Policy Object policies
B. Establishing one-way trust from Company B to Company A
C. Enabling SAML
D. Implementing attribute-based access control
E. Installing Company A’s Kerberos systems in Company B’s network
F. Updating login scripts

Hint Answer: CD

Question #: 230
Topic #: 1
Prior to a risk assessment inspection, the Chief Information Officer tasked the systems administrator with analyzing and reporting any configuration issues on the information systems, and then verifying existing security settings. Which of the following would be BEST to use?

A. SCAP
B. CVSS
C. XCCDF
D. CMDB

Hint Answer: A

Question #: 231
Topic #: 1
An organization is looking to establish more robust security measures by implementing PKI. Which of the following should the security analyst implement when considering mutual authentication?

A. Perfect forward secrecy on both endpoints
B. Shared secret for both endpoints
C. Public keys on both endpoints
D. A common public key on each endpoint
E. A common private key on each endpoint

Hint Answer: C

Question #: 232
Topic #: 1
An organization’s senior security architect would like to develop cyberdefensive strategies based on standardized adversary techniques, tactics, and procedures commonly observed. Which of the following would BEST support this objective?

A. OSINT analysis
B. The Diamond Model of Intrusion Analysis
C. MITRE ATT&CK
D. Deepfake generation
E. Closed-source intelligence reporting

Hint Answer: C

Question #: 233
Topic #: 1
A developer wants to maintain integrity to each module of a program and ensure controls are in place to detect unauthorized code modification. Which of the following would be BEST for the developer to perform? (Choose two.)

A. Utilize code signing by a trusted third party.
B. Implement certificate-based authentication.
C. Verify MD5 hashes.
D. Compress the program with a password.
E. Encrypt with 3DES.
F. Make the DACL read-only.

Hint Answer: AC

Question #: 234
Topic #: 1
A security solution uses a sandbox environment to execute zero-day software and collect indicators of compromise. Which of the following should the organization do to BEST take advantage of this solution?

A. Develop an Nmap plug-in to detect the indicator of compromise.
B. Update the organization’s group policy.
C. Include the signature in the vulnerability scanning tool.
D. Deliver an updated threat signature throughout the EDR system.

Hint Answer: D

Question #: 235
Topic #: 1
A company wants to implement a new website that will be accessible via browsers with no mobile applications available. The new website will allow customers to submit sensitive medical information securely and receive online medical advice. The company already has multiple other websites where it provides various public health data and information. The new website must implement the following:

• The highest form of web identity validation
• Encryption of all web transactions
• The strongest encryption in-transit
• Logical separation based on data sensitivity

Other things that should be considered include:

• The company operates multiple other websites that use encryption.
• The company wants to minimize total expenditure.
• The company wants to minimize complexity.

Which of the following should the company implement on its new website? (Choose two.)

A. Wildcard certificate
B. EV certificate
C. Mutual authentication
D. Certificate pinning
E. SSO
F. HSTS

Hint Answer: B

Question #: 236
Topic #: 1
Which of the following is used to assess compliance with internal and external requirements?

A. RACI matrix
B. Audit report
C. After-action report
D. Business continuity plan

Hint Answer: B

Question #: 237
Topic #: 1
A network administrator for a completely air-gapped and closed system has noticed that anomalous external files have been uploaded to one of the critical servers. The administrator has reviewed logs in the SIEM that were collected from security appliances, network infrastructure devices, and endpoints. Which of the following processes, if executed, would be MOST likely to expose an attacker?

A. Reviewing video from IP cameras within the facility
B. Reconfiguring the SIEM connectors to collect data from the perimeter network hosts
C. Implementing integrity checks on endpoint computing devices
D. Looking for privileged credential reuse on the network

Hint Answer: A

Question #: 238
Topic #: 1
A network administrator for a completely air-gapped and closed system has noticed that anomalous external files have been uploaded to one of the critical servers. The administrator has reviewed logs in the SIEM that were collected from security appliances, network infrastructure devices, and endpoints. Which of the following processes, if executed, would be MOST likely to expose an attacker?

A. Reviewing video from IP cameras within the facility
B. Reconfiguring the SIEM connectors to collect data from the perimeter network hosts
C. Implementing integrity checks on endpoint computing devices
D. Looking for privileged credential reuse on the network

Hint Answer: A

Question #: 239
Topic #: 1
A security engineer is implementing a server-side TLS configuration that provides forward secrecy and authenticated encryption with associated data. Which of the following algorithms, when combined into a cipher suite, will meet these requirements? (Choose three.)

A. EDE
B. CBC
C. GCM
D. AES
E. RSA
F. RC4
G. ECDSA
H. DH

Hint Answer: CDG

Question #: 240
Topic #: 1
A security architect is advising the application team to implement the following controls in the application before it is released:

• Least privilege
• Blocklist input validation for the following characters: \<>;, =”#+

Based on the requirements, which of the following attacks is the security architect trying to prevent?

A. XML injection
B. LDAP injection
C. CSRF
D. XSS

Hint Answer: B

Question #: 241
Topic #: 1
A company wants to use a process to embed a sign of ownership covertly inside a proprietary document without adding any identifying attributes. Which of the following would be BEST to use as part of the process to support copyright protections of the document?

A. Steganography
B. E-signature
C. Watermarking
D. Cryptography

Hint Answer: A

Question #: 242
Topic #: 1
An organization is assessing the security posture of a new SaaS CRM system that handles sensitive PII and identity information, such as passport numbers. The SaaS CRM system does not meet the organization’s current security standards. Post remediation work, the assessment recorded the following:

1. There will be a $20.000 per day revenue loss for each day the system is delayed going into production.
2. The inherent risk was high.
3. The residual risk is now low.
4. The solution rollout to the contact center will be a staged deployment.

Which of the following risk-handling techniques will BEST meet the organization’s requirements post remediation?

A. Apply for a security exemption, as the risk is too high to accept.
B. Transfer the risk to the SaaS CRM vendor, as the organization is using a cloud service.
C. Accept the risk, as compensating controls have been implemented to manage the risk.
D. Avoid the risk by accepting the shared responsibility model with the SaaS CRM provider.

Hint Answer: C

Question #: 243
Topic #: 1
A security analyst is using data provided from a recent penetration test to calculate CVSS scores to prioritize remediation. Which of the following metric groups would the analyst need to determine to get the overall scores? (Choose three.)

A. Temporal
B. Availability
C. Integrity
D. Confidentiality
E. Base
F. Environmental
G. Impact
H. Attack vector

Hint Answer: AEF

Question #: 244
Topic #: 1
During a recent security incident investigation, a security analyst mistakenly turned off the infected machine prior to consulting with a forensic analyst. Upon rebooting the machine, a malicious script that was running as a background process was no longer present. As a result, potentially useful evidence was lost. Which of the following should the security analyst have followed?

A. Order of volatility
B. Chain of custody
C. Verification
D. Secure storage

Hint Answer: A

Question #: 245
Topic #: 1
A global organization’s Chief Information Security Officer (CISO) has been asked to analyze the risks involved in a plan to move the organization’s current MPLS-based WAN network to use commodity internet and SD-WAN hardware. The SD-WAN provider is currently highly regarded but is a regional provider. Which of the following is MOST likely identified as a potential risk by the CISO?

A. The SD-WAN provider would not be able to handle the organization’s bandwidth requirements.
B. The operating costs of the MPLS network are too high for the organization.
C. The SD-WAN provider may not be able to support the required troubleshooting and maintenance.
D. Internal IT staff will not be able to properly support remote offices after the migration.

Hint Answer: C

Question #: 246
Topic #: 1
A company has received threat intelligence about bad routes being advertised. The company has also been receiving reports of degraded internet activity. When looking at the routing table on the edge router, a security engineer discovers the following:

Which of the following can the company implement to prevent receiving bad routes from peers, while still allowing dynamic updates?

A. OSPF prefix list
B. BGP prefix list
C. EIGRP prefix list
D. DNS

Hint Answer: B

Question #: 247
Topic #: 1
A company has moved its sensitive workloads to the cloud and needs to ensure high availability and resiliency of its web-based application. The cloud architecture team was given the following requirements:

• The application must run at 70% capacity at all times
• The application must sustain DoS and DDoS attacks.
• Services must recover automatically.

Which of the following should the cloud architecture team implement? (Choose three.)

A. Read-only replicas
B. BCP
C. Autoscaling
D. WAF
E. CDN
F. Encryption
G. Continuous snapshots
H. Containerization

Hint Answer: CDE

Question #: 248
Topic #: 1
A security architect is implementing a web application that uses a database back end. Prior to production, the architect is concerned about the possibility of XSS attacks and wants to identify security controls that could be put in place to prevent these attacks. Which of the following sources could the architect consult to address this security concern?

A. SDLC
B. OVAL
C. IEEE
D. OWASP

Hint Answer: D

Question #: 249
Topic #: 1
A security architect is working with a new customer to find a vulnerability assessment solution that meets the following requirements:

• Fast scanning
• The least false positives possible
• Signature-based
• A low impact on servers when performing a scan

In addition, the customer has several screened subnets, VLANs, and branch offices. Which of the following will BEST meet the customer’s needs?

A. Authenticated scanning
B. Passive scanning
C. Unauthenticated scanning
D. Agent-based scanning

Hint Answer: C

Question #: 250
Topic #: 1
Real-time, safety-critical systems MOST often use serial busses that:

A. have non-deterministic behavior and are not deployed with encryption.
B. have non-deterministic behavior and are deployed with encryption.
C. have deterministic behavior and are deployed with encryption.
D. have deterministic behavior and are not deployed with encryption.

Hint Answer: D