Updated Sep-2026 100% Cover Real CAS-005 Exam Questions - 100% Pass Guarantee
Use Real CompTIA Dumps - 100% Free CAS-005 Exam Dumps
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 149
Third parties notified a company's security team about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries. Which of the following solutions best addresses the reported vulnerabilities?
- A. Integrating a SASI tool as part of the pipeline
- B. Implementing a continuous security assessment program
- C. Creating a bug bounty program
- D. Using laC to include the newest dependencies
Answer: A
Explanation:
The best solution to address reported vulnerabilities in third-party libraries is integrating a Static Application Security Testing (SAST) tool as part of the development pipeline. Here's why:
Early Detection: SAST tools analyze source code for vulnerabilities before the code is compiled. This allows developers to identify and fix security issues early in the development process.
Continuous Security: By integrating SAST tools into the CI/CD pipeline, the organization ensures continuous security assessment of the codebase, including third-party libraries, with each code commit and build.
Comprehensive Analysis: SAST tools provide a detailed analysis of the code, identifying potential vulnerabilities in both proprietary code and third-party dependencies, ensuring that known issues in libraries are addressed promptly.
Reference:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
OWASP Static Analysis Security Testing (SAST) Cheat Sheet
NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 150
A global organization is reviewing potential vendors to outsource a critical payroll function. Each vendor's plan includes using local resources in multiple regions to ensure compliance with all regulations. The organization's Chief Information Security Officer is conducting a risk assessment on the potential outsourcing vendors' subprocessors. Which of the following best explains the need for this risk assessment?
- A. The responsibility of protecting PII remains with the organization.
- B. Specific regulatory requirements must be met in each jurisdiction.
- C. Risk mitigations must be more comprehensive than the existing payroll provider.
- D. Due care must be exercised during all procurement activities.
Answer: A
Explanation:
Comprehensive and Detailed
Per SecurityX CAS-005 GRC principles, outsourcing a function does not transfer accountability for protecting personally identifiable information (PII). While subprocessors handle data, the originating organization remains responsible under most data protection laws and frameworks (e.g., GDPR, CCPA).
Due care in procurement (option B) is important, but it is a supporting concept, not the primary driver in this context.
Jurisdictional compliance (option D) is a requirement, but the underlying reason for risk assessment is that accountability for PII protection remains with the organization.
NEW QUESTION # 151
During an incident response activity, the response team collected some artifacts from a compromised server, but the following information is missing:
* Source of the malicious files
* Initial attack vector
* Lateral movement activities
The next step in the playbook is to reconstruct a timeline. Which of the following best supports this effort?
- A. Performing primary memory analysis
- B. Executing decompilation of binary files
- C. Analyzing all network routes and connections
- D. Collecting operational system logs and storage disk data
Answer: D
NEW QUESTION # 152
Which of the following key management practices ensures that an encryption key is maintained within the organization?
- A. Encrypting using encryption and key storage systems provided by the cloud provider
- B. Encrypting using a key escrow process for storage of the encryption key
- C. Encrypting using server-side encryption capabilities provided by the cloud provider
- D. Encrypting using a key stored in an on-premises hardware security module
Answer: D
Explanation:
Comprehensive and Detailed Step by Step
Understanding the Scenario: The question is about ensuring that an organization retains control over its encryption keys. It focuses on different key storage and management methods.
Analyzing the Answer Choices:
A . Encrypting using a key stored in an on-premises hardware security module (HSM): This is the best option for maintaining complete control over encryption keys. An HSM is a dedicated, tamper-resistant hardware device specifically designed for secure key storage and cryptographic operations. Storing keys on-premises within an HSM ensures the organization has exclusive access.
Reference:
B . Encrypting using server-side encryption capabilities provided by the cloud provider: With server-side encryption, the cloud provider typically manages the encryption keys. This means the organization is relinquishing some control over the keys.
C . Encrypting using encryption and key storage systems provided by the cloud provider: Similar to option B, using cloud-provider-managed key storage systems means the organization doesn't have full, exclusive control over the keys.
D . Encrypting using a key escrow process for storage of the encryption key: Key escrow involves entrusting a third party with a copy of the encryption key. This introduces a potential security risk, as the organization no longer has sole control over the key. Also, the key is not maintained within the organization.
Why A is the Correct answer:
Control: On-premises HSMs provide the highest level of control over encryption keys. The organization has physical and logical control over the HSM and the keys stored within it.
Security: HSMs are designed to be tamper-resistant and protect keys from unauthorized access, even if the surrounding systems are compromised.
Compliance: In some industries, regulatory requirements may mandate that organizations maintain direct control over their encryption keys. On-premises HSMs can help meet these requirements.
CASP+ Relevance: HSMs, key management, and data encryption are fundamental topics in CASP+. The exam emphasizes understanding the security implications of different key management approaches.
Elaboration on Key Management Principles:
Key Lifecycle Management: Proper key management involves managing the entire lifecycle of a key, from generation and storage to rotation and destruction.
Separation of Duties: It's generally a good practice to separate the roles of key management and data encryption to enhance security.
Access Control: Strict access controls should be in place to limit who can access and use encryption keys.
In conclusion, using an on-premises HSM for key storage is the best way to ensure that an organization maintains control over its encryption keys. It provides the highest level of security and control, aligning with best practices in cryptography and key management as emphasized in the CASP+ exam objectives.
NEW QUESTION # 153
An organization currently has IDS, firewall, and DLP systems in place. The systems administrator needs to integrate the tools in the environment to reduce response time. Which of the following should the administrator use?
- A. CWPP
- B. SOAR
- C. CMDB
- D. XCCDF
Answer: B
Explanation:
Integrating IDS, firewall, and DLP to reduce response time requires orchestration and automation. Let's evaluate:
A). SOAR(Security Orchestration, Automation, and Response):SOAR integrates security tools, automates workflows, and speeds up incident response. It's the best fit for this scenario, as CAS-005 highlights SOAR for operational efficiency.
B). CWPP (CloudWorkload Protection Platform):Focused on securing cloud workloads, not integrating on- premises tools.
C). XCCDF (Extensible Configuration Checklist Description Format):A standard for compliance checklists, not a tool for integration or response.
Reference:CompTIA SecurityX (CAS-005) objectives, Domain 2: Security Operations, focusing on SOAR for tool integration.
NEW QUESTION # 154
During the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.
INSTRUCTIONS
Review each of the events and select the appropriate analysis and remediation options for each IoC.
Answer:
Explanation:
Analysis and Remediation Options for Each IoC:
IoC 1:
Evidence:
Source: Apache_httpd
Type: DNSQ
Dest: @10.1.1.1:53,@10.1.2.5
Data: update.s.domain, CNAME 3a129sk219r9slmfkzzz000.s.domain, 108.158.253.253 Analysis:
Analysis: The service is attempting to resolve a malicious domain.
Reason: The DNS queries and the nature of the CNAME resolution indicate that the service is trying to resolve potentially harmful domains, which is a common tactic used by malware to connect to command-and- control servers.
Remediation:
Remediation: Implement a blocklist for known malicious ports.
Reason: Blocking known malicious domains at the DNS level prevents the resolution of harmful domains, thereby protecting the network from potential connections to malicious servers.
IoC 2:
Evidence:
Src: 10.0.5.5
Dst: 10.1.2.1, 10.1.2.2, 10.1.2.3, 10.1.2.4, 10.1.2.5
Proto: IP_ICMP
Data: ECHO
Action: Drop
Analysis:
Analysis: Someone is footprinting a network subnet.
Reason: The repeated ICMP ECHO requests to different addresses within a subnet indicate that someone is scanning the network to discover active hosts, a common reconnaissance technique used by attackers.
Remediation:
Remediation: Block ping requests across the WAN interface.
Reason: Blocking ICMP ECHO requests on the WAN interface can prevent attackers from using ping sweeps to gather information about the network topology and active devices.
IoC 3:
Evidence:
Proxylog:
GET /announce?info_hash=%01dff%27f%21%10%c5%wp%4e%1d%6f%63%3c%49%6d&peer_id%3dxJFS Uploaded=0&downloaded=0&left=3767869&compact=1&ip=10.5.1.26&event=started User-Agent: RAZA 2.1.0.0 Host: localhost Connection: Keep-Alive HTTP200 OK Analysis:
Analysis: An employee is using P2P services to download files.
Reason: The HTTP GET request with parameters related to a BitTorrent client indicates that the employee is using peer-to-peer (P2P) services, which can lead to unauthorized data transfer and potential security risks.
Remediation:
Remediation: Enforce endpoint controls on third-party software installations.
Reason: By enforcing strict endpoint controls, you can prevent the installation and use of unauthorized software, such as P2P clients, thereby mitigating the risk of data leaks and other security threats associated with such applications.
References:
CompTIA Security+ Study Guide: This guide offers detailed explanations on identifying and mitigating various types of Indicators of Compromise (IoCs) and the corresponding analysis and remediation strategies.
CompTIA Security+ Exam Objectives: These objectives cover key concepts in network security monitoring and incident response, providing guidelines on how to handle different types of security events.
Security Operations Center (SOC) Best Practices: This resource outlines effective strategies for analyzing and responding to anomalous events within a SOC, including the use of blocklists, endpoint controls, and network configuration changes.
By accurately analyzing the nature of each IoC and applying the appropriate remediation measures, the organization can effectively mitigate potential security threats and maintain a robust security posture.
NEW QUESTION # 155
An IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.
Complete the configuration files to meet the following requirements:
* The EAP method must use mutual certificate-based authentication (With issued client certificates).
* The IKEv2 Cipher suite must be configured to the MOST secure
authenticated mode of operation,
* The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimumlength requirement of eight characters, INSTRUCTIONS Click on the AAA server and VPN concentrator to complete the configuration.
Fill in the appropriate fields and make selections from the drop-down menus.
VPN Concentrator:
AAA Server:
Answer:
Explanation:
See the answer below in Explanation
Explanation:
VPN Concentrator:
AAA Server:
NEW QUESTION # 156
A company undergoing digital transformation is reviewing the resiliency of a CSP and is concerned about meeting SLA requirements in the event of a CSP incident. Which of the following would be best to proceed with the transformation?
- A. An active-active solution within the same tenant
- B. A multicloud provider solution
- C. An on-premises solution as a backup
- D. A load balancer with a round-robin configuration
Answer: B
NEW QUESTION # 157
An organization mat performs real-time financial processing is implementing a new backup solution Given the following business requirements?
* The backup solution must reduce the risk for potential backup compromise
* The backup solution must be resilient to a ransomware attack.
* The time to restore from backups is less important than the backup data integrity
* Multiple copies of production data must be maintained
Which of the following backup strategies best meets these requirement?
- A. Creating a secondary, immutable storage array and updating it with live data on a continuous basis
- B. Utilizing two connected storage arrays and ensuring the arrays constantly sync
- C. Setting up antitempering on the databases to ensure data cannot be changed unintentionally
- D. Enabling remote journaling on the databases to ensure real-time transactions are mirrored
Answer: A
Explanation:
* A. Creating a secondary, immutable storage array and updating it with live data on a continuous basis:
An immutable storage array ensures that data, once written, cannot be altered or deleted. This greatly reduces the risk of backup compromise and provides resilience against ransomware attacks, as the ransomware cannot modify or delete the backup data. Maintaining multiple copies of production data with an immutable storage solution ensures data integrity and compliance with the requirement for multiple copies.
Other options:
* B. Utilizing two connected storage arrays and ensuring the arrays constantly sync: While this ensures data redundancy, it does not provide protection against ransomware attacks, as both arrays could be compromised simultaneously.
* C. Enabling remote journaling on the databases: This ensures real-time transaction mirroring but does not address the requirement for reducing the risk of backup compromise or resilience to ransomware.
* D. Setting up anti-tampering on the databases: While this helps ensure data integrity, it does not provide a comprehensive backup solution that meets all the specified requirements.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-209, "Security Guidelines for Storage Infrastructure"
* "Immutable Backup Architecture" by Veeam
NEW QUESTION # 158
An organization is developing an AI-enabled digital worker to help employees complete common tasks, such as template development, editing, research, and scheduling. As part of the AI workload, the organization wants to implement guardrails within the platform. Which of the following should the company do to secure the AI environment?
- A. Enhance the training model's effectiveness.
- B. Require end-user acknowledgement of organizational policies.
- C. Grant the system the ability to self-govern
- D. Limit the platform's abilities to only non-sensitive functions
Answer: D
Explanation:
Limiting the platform's abilities to only non-sensitive functions helps to mitigate risks associated with AI operations. By ensuring that the AI-enabled digital worker is only allowed to perform tasks that do not involve sensitive or critical data, the organization reduces the potential impact of any security breaches or misuse.
Enhancing the training model's effectiveness (Option B) is important but does not directly address security guardrails. Granting the system the ability to self-govern (Option C) could increase risk as it may act beyond the organization's control. Requiring end-user acknowledgement of organizational policies (Option D) is a good practice but does not implement technical guardrails to secure the AI environment.
NEW QUESTION # 159
An organization is required to
* Respond to internal and external inquiries in a timely manner
* Provide transparency.
* Comply with regulatory requirements
The organization has not experienced any reportable breaches but wants to be prepared if a breach occurs in the future. Which of the following is the best way for the organization to prepare?
- A. Developing communication templates that have been vetted by internal and external counsel
- B. Conducting lessons-learned activities and integrating observations into the crisis management plan
- C. Integrating automated response mechanisms into the data subject access request process
- D. Outsourcing the handling of necessary regulatory filing to an external consultant
Answer: A
Explanation:
Preparing communication templates that have been vetted by both internal and external counsel ensures that the organization can respond quickly and effectively to internal and external inquiries, comply with regulatory requirements, and provide transparency in the event of a breach.
Why Communication Templates?
Timely Response: Pre-prepared templates ensure that responses are ready to be deployed quickly, reducing response time.
Regulatory Compliance: Templates vetted by counsel ensure that all communications meet legal and regulatory requirements.
Consistent Messaging: Ensures that all responses are consistent, clear, and accurate, maintaining the organization's credibility.
Crisis Management: Pre-prepared templates are a critical component of a broader crisis management plan, ensuring that all stakeholders are informed appropriately.
Other options, while useful, do not provide the same level of preparedness and compliance:
A . Outsourcing to an external consultant: This may delay response times and lose internal control over the communication.
B . Integrating automated response mechanisms: Useful for efficiency but not for ensuring compliant and vetted responses.
D . Conducting lessons-learned activities: Important for improving processes but does not provide immediate preparedness for communication.
Reference:
CompTIA SecurityX Study Guide
NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide" ISO/IEC 27002:2013, "Information technology - Security techniques - Code of practice for information security controls"
NEW QUESTION # 160
A security analyst wants to use lessons learned from a poor incident response to reduce dwell lime in the future The analyst is using the following data points
Which of the following would the analyst most likely recommend?
- A. Adjusting the SIEM to alert on attempts to visit phishing sites
- B. Enabling alerting on all suspicious administrator behavior
- C. Allowing TRACE method traffic to enable better log correlation
- D. utilizing allow lists on the WAF for all users using GFT methods
Answer: B
Explanation:
In the context of improving incident response and reducing dwell time, the security analyst needs to focus on proactive measures that can quickly detect and alert on potential security breaches. Here's a detailed analysis of the options provided:
A). Adjusting the SIEM to alert on attempts to visit phishing sites: While this is a useful measure to prevent phishing attacks, it primarily addresses external threats and doesn't directly impact dwell time reduction, which focuses on the time a threat remains undetected within a network.
B). Allowing TRACE method traffic to enable better log correlation: The TRACE method in HTTP is used for debugging purposes, but enabling it can introduce security vulnerabilities. It's not typically recommended for enhancing security monitoring or incident response.
C). Enabling alerting on all suspicious administrator behavior: This option directly targets the potential misuse of administrator accounts, which are often high-value targets for attackers. By monitoring and alerting on suspicious activities from admin accounts, the organization can quickly identify and respond to potential breaches, thereby reducing dwell time significantly. Suspicious behavior could include unusual login times, access to sensitive data not usually accessed by the admin, or any deviation from normal behavior patterns.
This proactive monitoring is crucial for quick detection and response, aligning well with best practices in incident response.
D). Utilizing allow lists on the WAF for all users using GET methods: This measure is aimed at restricting access based on allowed lists, which can be effective in preventing unauthorized access but doesn't specifically address the need for quick detection and response to internal threats.
References:
CompTIA SecurityX Study Guide: Emphasizes the importance of monitoring and alerting on admin activities as part of a robust incident response plan.
NIST Special Publication 800-61 Revision 2, " Computer Security Incident Handling Guide " : Highlights best practices for incident response, including the importance of detecting and responding to suspicious activities quickly.
" Incident Response & Computer Forensics " by Jason T. Luttgens, Matthew Pepe, and Kevin Mandia:
Discusses techniques for reducing dwell time through effective monitoring and alerting mechanisms, particularly focusing on privileged account activities.
By focusing on enabling alerting for suspicious administrator behavior, the security analyst addresses a critical area that can help reduce the time a threat goes undetected, thereby improving the overall security posture of the organization.
Top of Form
Bottom of Form
NEW QUESTION # 161
After a vendor identified a recent vulnerability, a severity score was assigned to the vulnerability.
A notification was also publicly distributed. Which of the following would most likely include information regarding the vulnerability and the recommended remediation steps?
- A. CPE
- B. CVE
- C. CVSS
- D. CCE
Answer: B
NEW QUESTION # 162
Users must accept the terms presented in a captive petal when connecting to a guest network. Recently, users have reported that they are unable to access the Internet after joining the network A network engineer observes the following:
* Users should be redirected to the captive portal.
* The Motive portal runs Tl. S 1 2
* Newer browser versions encounter security errors that cannot be bypassed
* Certain websites cause unexpected re directs
Which of the following mow likely explains this behavior?
- A. An attacker is redirecting supplicants to an evil twin WLAN.
- B. Allowed traffic rules are causing the NIPS to drop legitimate traffic
- C. The TLS ciphers supported by the captive portal ate deprecated
- D. Employment of the HSTS setting is proliferating rapidly.
Answer: C
Explanation:
The most likely explanation for the issues encountered with the captive portal is that the TLS ciphers supported by the captive portal are deprecated. Here's why:
TLS Cipher Suites: Modern browsers are continuously updated to support the latest security standards and often drop support for deprecated and insecure cipher suites. If the captive portal uses outdated TLS ciphers, newer browsers may refuse to connect, causing security errors.
HSTS and Browser Security: Browsers with HTTP Strict Transport Security (HSTS) enabled will not allow connections to sites with weak security configurations. Deprecated TLS ciphers would cause these browsers to block the connection.
Reference:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
NIST Special Publication 800-52: Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations OWASP Transport Layer Protection Cheat Sheet By updating the TLS ciphers to modern, supported ones, the security engineer can ensure compatibility with newer browser versions and resolve the connectivity issues reported by users.
NEW QUESTION # 163
A company'sSIEMis designed to associate the company'sasset inventorywith user events. Given the following report:
Which of thefollowing should asecurity engineer investigate firstas part of alog audit?
- A. Potential activity indicating an attackermoving laterally in the network
- B. Unauthorized usage attempts of the administrator account
- C. Anendpointthat is not submitting any logs
- D. Amisconfigured syslog servercreating false negatives
Answer: B
Explanation:
Understanding the Security Event:
Administrator accounts are highly privilegedand require strict monitoring.
Server 4 shows failed login attempts for the administrator account.This could indicate abrute-force attack or unauthorized access attempt.
The fact thatnone of the admin login attempts were successfulsuggestssomeone was trying to guess the credentials.
Why Option D isCorrect:
Failed logins for administrator accounts are a critical security concern.
If an attacker gains access, they couldescalate privileges and compromise the network.
Investigatingunauthorized admin login attemptsshould be thetop priorityin a log audit.
Why Other Options Are Incorrect:
A (Endpoint not submitting logs):While this is concerning, it does not indicate anactive attack.
B (Lateral movement):There's no evidence of a compromised account moving between servers yet.
C (Misconfigured syslog server):False negatives are a possibility, but thefailed admin loginsare real.
Reference:
CompTIA SecurityX CAS-005 Official Study Guide:SIEM & Incident Analysis MITRE ATT&CK (T1078.002):Valid Accounts - Administrator Compromise
NEW QUESTION # 164
A security administrator wants to detect a potential forged sender claim in the envelope of an email. Which of the following should the security administrator implement? (Choose two).
- A. TLS
- B. MX record
- C. DNSSEC
- D. S/MIME
- E. SPF
- F. DMARC
Answer: E,F
Explanation:
SPF (Sender Policy Framework): Validates the envelope sender (MAIL FROM) by checking that the sending IP is authorized in the domain's SPF record, detecting forged return-path addresses.
DMARC (Domain-based Message Authentication, Reporting & Conformance): Builds on SPF (and DKIM) to enforce alignment between the authenticated envelope sender and the "From:" header, providing policy enforcement and reporting on any failures.
NEW QUESTION # 165
A company detects suspicious activity associated with external connections Security detection tools are unable tocategorize this activity. Which of the following is the best solution to help the company overcome this challenge?
- A. Monitor the dark web
- B. implement UEBA
- C. Map network traffic to known loCs.
- D. Implement an Interactive honeypot
Answer: B
Explanation:
User and Entity Behavior Analytics (UEBA) is the best solution to help the company overcome challenges associated with suspicious activity that cannot be categorized by traditional detection tools. UEBA uses advanced analytics to establish baselines of normal behavior for users and entities within the network. It then identifies deviations from these baselines, which may indicate malicious activity. This approach is particularly effective for detecting unknown threats and sophisticated attacks that do not match known indicators of compromise (IoCs).
Reference: CompTIA SecurityX Study Guide, Chapter on Advanced Threat Detection and Mitigation, Section on User and Entity Behavior Analytics (UEBA).
NEW QUESTION # 166
A Chief Information Security Officer requests an action plan to remediate vulnerabilities. A security analyst reviews the output from a recent vulnerability scan and notices hundreds of unique vulnerabilities. The output includes the CVSS score, IP address, hostname, and the list of vulnerabilities. The analyst determines more information is needed in order to decide which vulnerabilities should be fixed immediately. Which of the following is the best source for this information?
- A. Business impact analysis
- B. Crisis management plan
- C. Third-party risk review
- D. Incident response playbook
Answer: A
Explanation:
The correct source is the Business Impact Analysis (BIA). A BIA provides context about which systems and applications are most critical to business operations, regulatory compliance, and customer obligations. While CVSS scores indicate severity in technical terms, they do not reflect the business impact of exploitation. For example, a medium-severity vulnerability on a critical payment system may pose more business risk than a high-severity vulnerability on a test server.
Option A (third-party risk review) focuses on vendor security posture, not internal remediation priorities. Option C (incident response playbook) guides response during active incidents, not vulnerability prioritization. Option D (crisis management plan) addresses executive-level communications during crises, not technical risk assessment.
By combining vulnerability scan data with BIA context, security teams can prioritize remediation efforts based on business-critical systems, ensuring the highest-risk vulnerabilities are remediated first. This aligns with CAS-005's guidance on risk-based prioritization of remediation efforts.
NEW QUESTION # 167
A security analyst received a report that an internal web page is down after a company-wide update to the web browser Given the following error message:
Which of the following is the best way to fix this issue?
- A. Rewriting any legacy web functions
- B. Discontinuing the use of self-signed certificates
- C. Disabling all deprecated ciphers
- D. Blocking all non-essential pons
Answer: B
Explanation:
The error message "NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM" indicates that the web browser is rejecting the certificate because it uses a weak signature algorithm. This commonly happens with self-signed certificates, which often use outdated or insecure algorithms.
Why Discontinue Self-Signed Certificates?
Security Compliance: Modern browsers enforce strict security standards and may reject certificates that do not comply with these standards.
Trusted Certificates: Using certificates from a trusted Certificate Authority (CA) ensures compliance with security standards and is less likely to be flagged as insecure.
Weak Signature Algorithm: Self-signed certificates might use weak algorithms like MD5 or SHA-1, which are considered insecure.
Other options do not address the specific cause of the certificate error:
A: Rewriting legacy web functions: Does not address the certificate issue.
B: Disabling deprecated ciphers: Useful for improving security but not related to the certificate error.
C: Blocking non-essential ports: This is unrelated to the issue of certificate validation.
NEW QUESTION # 168
A company acquires a location with a large infrastructure of legacy devices. Because of the hardware's age and the legacy software's limitations, the OS cannot be upgraded, and the machines cannot be virtualized. These machines are not publicly facing, but they do have internet access. The following controls are currently in place:
- EDR
- Anti-malware
- Logging and monitoring
- Host-based firewall
- Proxied internet access
A security architect needs to supplement the existing control strategy with one that restricts unauthorized software. Which of the following controls should the architect recommend to best supplement the existing environment?
- A. Application control
- B. Conditional access
- C. SIEM
- D. Isolation
Answer: A
NEW QUESTION # 169
Developers have been creating and managing cryptographic material on their personal laptops fix use in production environment. A security engineer needs to initiate a more secure process. Which of the following is the best strategy for the engineer to use?
- A. Managing key material on a HSM
- B. Employing shielding lo prevent LMI
- C. Disabling the BIOS and moving to UEFI
- D. Managing secrets on the vTPM hardware
Answer: A
Explanation:
The best strategy for securely managing cryptographic material is to use a Hardware Security Module (HSM).
Here's why:
Security and Integrity: HSMs are specialized hardware devices designed to protect and manage digital keys.
They provide high levels of physical and logical security, ensuring that cryptographic material is well protected against tampering and unauthorized access.
Centralized Key Management: Using HSMs allows for centralized management of cryptographic keys, reducing the risks associated with decentralized and potentially insecure key storage practices, such as on personal laptops.
Compliance and Best Practices: HSMs comply with various industry standards and regulations (such as FIPS
140-2) for secure key management. This ensures that the organization adheres to best practices and meets compliance requirements.
References:
CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
NIST Special Publication 800-57: Recommendation for Key Management
ISO/IEC 19790:2012: Information Technology - Security Techniques - Security Requirements for Cryptographic Modules
NEW QUESTION # 170
......
CAS-005 Dumps PDF - CAS-005 Real Exam Questions Answers: https://www.prepawaypdf.com/CompTIA/CAS-005-practice-exam-dumps.html
Realistic CAS-005 Dumps Latest Practice Tests Dumps: https://drive.google.com/open?id=1pQqXcYMso6OLz1JpnxjqtpC1Y6TyiolH