CompTIA CAS-004 Practice Test Pdf Exam Material
CAS-004 Answers CAS-004 Free Demo Are Based On The Real Exam
NEW QUESTION # 50
A new web server must comply with new secure-by-design principles and PCI DSS. This includes mitigating the risk of an on-path attack. A security analyst is reviewing the following web server configuration:
Which of the following ciphers should the security analyst remove to support the business requirements?
- A. TLS_AES_128_CCM_8_SHA256
- B. TLS_CHACHA20_POLY1305_SHA256
- C. TLS_AES_128_GCM_SHA256
- D. TLS_DHE_DSS_WITH_RC4_128_SHA
Answer: D
Explanation:
The security analyst should remove the cipher TLS_DHE_DSS_WITH_RC4_128_SHA to support the business requirements, as it is considered weak and vulnerable to on-path attacks. RC4 is an outdated stream cipher that has been deprecated by major browsers and protocols due to its flaws and weaknesses. The other ciphers are more secure and compliant with secure-by-design principles and PCI DSS. Verified References:
https://www.comptia.org/blog/what-is-a-cipher
https://partners.comptia.org/docs/default-source/resources/casp-content-guide
NEW QUESTION # 51
As part of the asset management life cycle, a company engages a certified equipment disposal vendor to appropriately recycle and destroy company assets that are no longer in use. As part of the company's vendor due diligence, which of the following would be MOST important to obtain from the vendor?
- A. A copy of the procedures used to demonstrate compliance with certification requirements.
- B. A copy of the current audit reports and certifications held by the vendor.
- C. A copy of the vendor's information security policies.
- D. A signed NDA that covers all the data contained on the corporate systems.
Answer: A
NEW QUESTION # 52
A Chief Information Security Officer (CISO) received a call from the Chief Executive Officer (CEO) about a data breach from the SOC lead around 9:00 a.m. At 10:00 a.m. The CEO informs the CISO that a breach of the firm is being reported on national news. Upon investigation, it is determined that a network administrator has reached out to a vendor prior to the breach for information on a security patch that failed to be installed. Which of the following should the CISO do to prevent this from happening again?
- A. Create an effective communication plan and socialize it with all employees.
- B. Send out a press release denying the breach until more information can be obtained.
- C. Implement a more robust vulnerability identification process.
- D. Properly triage events based on brand imaging and ensure the CEO is on the call roster.
Answer: A
Explanation:
To prevent similar issues from occurring again, the CISO should create an effective communication plan and ensure all employees are aware of it. A clear communication plan ensures that critical security information, such as breaches or vulnerabilities, is promptly communicated to the right stakeholders (e.g., the CEO) in a timely manner, preventing situations where the media reports on breaches before internal teams are fully informed. CASP+ emphasizes the importance of having structured communication protocols during security incidents to ensure accurate and timely responses.
Reference:
CASP+ CAS-004 Exam Objectives: Domain 2.0 - Enterprise Security Operations (Incident Communication Plans) CompTIA CASP+ Study Guide: Developing and Implementing Effective Incident Communication Plans
NEW QUESTION # 53
The Chief Information Security Officer (CISO) asked a security manager to set up a system that sends an alert whenever a mobile device enters a sensitive area of the company's data center. The CISO would also like to be able to alert the individual who is entering the area that the access was logged and monitored. Which of the following would meet these requirements?
- A. Short Message Service
- B. Geofencing
- C. Bluetooth
- D. Near-field communication
Answer: B
Explanation:
Geofencing is a location-based service that allows an organization to define and enforce a virtual boundary around a sensitive area, such as a data center. Geofencing can use various technologies, such as GPS, Wi-Fi, cellular data, or RFID, to detect when a mobile device enters or exits the geofence. Geofencing can also trigger certain actions or notifications based on the device's location. For example, the organization can set up a geofencing policy that sends an alert to the CISO and the device user when a mobile device enters the data center area. Geofencing can also be used to restrict access to certain apps or features based on the device's location. Verified Reference:
https://developer.android.com/training/location/geofencing
https://www.manageengine.com/mobile-device-management/mdm-geofencing.html
https://www.koombea.com/blog/mobile-geofencing/
NEW QUESTION # 54
A security analyst needs to recommend a remediation to the following threat:
Which of the following actions should the security analyst propose to prevent this successful exploitation?
- A. Update the antivirus.
- B. Patch the system.
- C. Enable TLS 1.2.
- D. Install a host-based firewall.
Answer: C
NEW QUESTION # 55
A security analyst notices a number of SIEM events that show the following activity:
Which of the following response actions should the analyst take FIRST?
- A. Disable powershell.exe on all Microsoft Windows endpoints.
- B. Disable local administrator privileges on the endpoints.
- C. Restart Microsoft Windows Defender.
- D. Configure the forward proxy to block 40.90.23.154.
Answer: D
Explanation:
Stop the data exfiltration and sever all malicious traffic first, and then clean up the internal mess.
NEW QUESTION # 56
A security administrator was informed that a server unexpectedly rebooted. The administrator received an export of syslog entries for analysis:
Which of the following does the log sample indicate? (Choose two.)
- A. Syslog entries were lost due to the host being rebooted
- B. Buffer overflow in memory paging caused a kernel panic
- C. Payroll data was exfiltrated to an attacker-controlled host
- D. A root user performed an injection attack via kernel module
- E. Encrypted payroll data was successfully decrypted by the attacker
- F. Jsmith successfully used a privilege escalation attack
Answer: B,F
NEW QUESTION # 57
A regulated company is in the process of refreshing its entire infrastructure. The company has a business-critical process running on an old 2008 Windows server. If this server fails, the company would lose millions of dollars in revenue. Which of the following actions should the company take?
- A. Accept the risk as the cost of doing business.
- B. Create an organizational risk register for project prioritization.
- C. Implement network compensating controls.
- D. Purchase insurance to offset the cost if a failure occurred.
Answer: B
Explanation:
Step by Step
Creating an organizational risk register ensures the issue is documented and prioritized for mitigation, aligning with risk management best practices.
Accepting the risk is not advisable due to the financial implications of failure.
Implementing network compensating controls does not address server reliability.
Purchasing insurance only offsets financial risk and does not ensure system functionality.
NEW QUESTION # 58
A developer wants to develop a secure external-facing web application. The developer is looking for an online community that produces tools, methodologies, articles, and documentation in the field of web-application security Which of the following is the BEST option?
- A. ICANN
- B. PCI DSS
- C. CSA
- D. OWASP
- E. NIST
Answer: D
NEW QUESTION # 59
A security analyst sees that a hacker has discovered some keys and they are being made available on a public website. The security analyst is then able to successfully decrypt the data using the keys from the website. Which of the following should the security analyst recommend to protect the affected data?
- A. Key rotation
- B. Key revocation
- C. Zeroization
- D. Key escrow
- E. Cryptographic obfuscation
Answer: E
NEW QUESTION # 60
A security analyst discovered that the company's WAF was not properly configured. The main web server was breached, and the following payload was found in one of the malicious requests:
Which of the following would BEST mitigate this vulnerability?
- A. CAPTCHA
- B. Data encoding
- C. Input validation
- D. Network intrusion prevention
Answer: C
Explanation:
Reference: https://hdivsecurity.com/owasp-xml-external-entities-xxe
NEW QUESTION # 61
Ransomware encrypted the entire human resources fileshare for a large financial institution. Security operations personnel were unaware of the activity until it was too late to stop it. The restoration will take approximately four hours, and the last backup occurred 48 hours ago. The management team has indicated that the RPO for a disaster recovery event for this data classification is 24 hours.
Based on RPO requirements, which of the following recommendations should the management team make?
- A. Decrease the frequency of backups and pay the ransom to decrypt the data.
- B. Increase the frequency of backups and create SIEM alerts for IOCs.
- C. Leave the current backup schedule intact and make the human resources fileshare read-only.
- D. Leave the current backup schedule intact and pay the ransom to decrypt the data.
Answer: B
Explanation:
Explanation
Increasing the frequency of backups and creating SIEM (security information and event management) alerts for IOCs (indicators of compromise) are the best recommendations that the management team can make based on RPO (recovery point objective) requirements. RPO is a metric that defines the maximum acceptable amount of data loss that can occur during a disaster recovery event. Increasing the frequency of backups can reduce the amount of data loss that can occur, as it can create more recent copies or snapshots of the data.
Creating SIEM alerts for IOCs can help detect and respond to ransomware attacks, as it can collect, correlate, and analyze security events and data from various sources and generate alerts based on predefined rules or thresholds. Leaving the current backup schedule intact and paying the ransom to decrypt the data are not good recommendations, as they could result in more data loss than the RPO allows, as well as encourage more ransomware attacks or expose the company to legal or ethical issues. Leaving the current backup schedule intact and making the human resources fileshare read-only are not good recommendations, as they could result in more data loss than the RPO allows, as well as affect the normal operations or functionality of the fileshare.
Decreasing the frequency of backups and paying the ransom to decrypt the data are not good recommendations, as they could result in more data loss than the RPO allows, as well as increase the risk of losing data due to less frequent backups or unreliable decryption. Verified References:
https://www.comptia.org/blog/what-is-rpo
https://partners.comptia.org/docs/default-source/resources/casp-content-guide
NEW QUESTION # 62
Which of the following describes how a risk assessment is performed when an organization has a critical vendor that provides multiple products?
- A. Through the selection of a random product
- B. Using a third-party audit report
- C. By choosing a major product
- D. At the individual product level
Answer: D
Explanation:
When conducting a risk assessment for a vendor that provides multiple products, it is important to perform the assessment at the individual product level. Each product might have different risk factors, security requirements, and vulnerabilities, so assessing each one ensures a comprehensive understanding of the risks involved. Assessing randomly or only major products could leave gaps in understanding the risks for smaller but still critical products.
NEW QUESTION # 63
A company suspects a web server may have been infiltrated by a rival corporation. The security engineer reviews the web server logs and finds the following:
The security engineer looks at the code with a developer, and they determine the log entry is created when the following line is run:
Which of the following is an appropriate security control the company should implement?
- A. Use server-side processing to avoid XSS vulnerabilities in path input.
- B. Restrict directory permission to read-only access.
- C. Parameterize a query in the path variable to prevent SQL injection.
- D. Separate the items in the system call to prevent command injection.
Answer: D
NEW QUESTION # 64 
An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.
Answer:
Explanation:
NEW QUESTION # 65
Following a complete outage of the electronic medical record system for more than 18 hours, the hospital's Chief Executive Officer (CEO) has requested that the Chief Information Security Officer (CISO) perform an investigation into the possibility of a disgruntled employee causing the outage maliciously. To begin the investigation, the CISO pulls all event logs and device configurations from the time of the outage. The CISO immediately notices the configuration of a top-of-rack switch from one day prior to the outage does not match the configuration that was in place at the time of the outage. However, none of the event logs show who changed the switch configuration, and seven people have the ability to change it. Because of this, the investigation is inconclusive.
Which of the following processes should be implemented to ensure this information is available for future investigations?
- A. Asset inventory management
- B. Incident response plan
- C. Configuration and change management
- D. Test and evaluation
Answer: C
NEW QUESTION # 66
......
CAS-004 [Apr-2026] Newly Released] Exam Questions For You To Pass: https://pass4sure.practicedump.com/CAS-004-exam-questions.html