CAS-005 Exam Questions and Answers | Exam-Dumps (Page: 5)

QUESTION: 33

Which of the following utilizes policies that route packets to ensure only specific types of traffic are being sent to the correct destination based on application usage?

SDN
pcap
vmstat
DNSSEC
VPC

Answer(s): A

Explanation:

SDN (Software-Defined Networking) utilizes policies and centralized control to dynamically route packets and ensure that specific types of traffic are sent to the correct destination based on application usage. SDN provides flexibility and programmability to control network traffic and routing at the application level, allowing policies to be applied to direct packets in a way that optimizes the network and meets security or performance requirements.

Reveal Solution Next Question

QUESTION: 34

An incident response team completed recovery from offline backup for several workstations. The workstations were subjected to a ransomware attack after users fell victim to a spear-phishing campaign, despite a robust training program.
Which of the following questions should be considered during the lessons-learned phase to most likely reduce the risk of reoccurrence? (Choose two.)

Are there opportunities for legal recourse against the originators of the spear-phishing campaign?
What internal and external stakeholders need to be notified of the breach?
Which methods can be implemented to increase speed of offline backup recovery?
What measurable user behaviors were exhibited that contributed to the compromise?
Which technical controls, if implemented, would provide defense when user training fails?
Which user roles are most often targeted by spear phishing attacks?

Answer(s): D,E

Explanation:

What measurable user behaviors were exhibited that contributed to the compromise? During the lessons-learned phase, it's important to analyze the specific user behaviors that led to the successful spear-phishing attack, even after a robust training program. This could involve understanding patterns such as clicking on suspicious links, failing to verify emails, or not reporting unusual activity. By identifying these behaviors, the organization can target specific areas for improvement in training or behavior modification.

Which technical controls, if implemented, would provide defense when user training fails? Since users fell victim to the spear-phishing attack despite training, it's critical to implement technical controls that can provide an additional layer of defense. This may include email filtering to block phishing attempts, multi-factor authentication (MFA), endpoint detection and response (EDR) tools, and sandboxing for suspicious attachments. These controls will help prevent or mitigate attacks when training alone is insufficient.

Reveal Solution Next Question

QUESTION: 35

Two companies that recently merged would like to unify application access between the companies, without initially merging internal authentication stores.
Which of the following technical strategies would best meet this objective?

Federation
RADIUS
TACACS+
MFA
ABAC

Answer(s): A

Explanation:

Federation allows two or more organizations to establish a trust relationship for sharing authentication and authorization information without merging internal authentication stores. With federation, users from both companies can access resources in the other company's environment by using their own credentials, typically through a centralized identity provider (IdP). This approach allows the companies to keep their authentication systems separate but still provide seamless access to applications and services, making it ideal for scenarios like mergers where complete consolidation of authentication systems might not be immediate.

Reveal Solution Next Question

QUESTION: 36

An analyst needs to evaluate all images and documents that are publicly shared on a website.
Which of the following would be the best tool to evaluate the metadata of these files?

OllyDbg
ExifTool
Volatility
Ghidra

Answer(s): B

Explanation:

ExifTool is a powerful tool for reading, writing, and editing metadata in various types of files, including images and documents. It can extract metadata such as the creation date, software used, author information, GPS coordinates, and more, which can be useful for evaluating the characteristics of publicly shared files.

Reveal Solution Next Question

QUESTION: 37

An organization has deployed a cloud-based application that provides virtual event services globally to clients. During a typical event, thousands of users access various entry pages within a short period of time. The entry pages include sponsor-related content that is relatively static and is pulled from a database.
When the first major event occurs, users report poor response time on the entry pages.
Which of the following features is the most appropriate for the company to implement?

Horizontal scalability
Vertical scalability
Containerization
Static code analysis
Caching

Answer(s): E

Explanation:

Since the entry pages contain sponsor-related content that is relatively static and pulled from a database, implementing caching would be the most appropriate solution. Caching stores frequently accessed data in a location that is faster to access than querying the database repeatedly. This reduces the load on the database and improves response times for users, especially during high-traffic events. By caching the static content (like sponsor information), the application can serve those pages faster and handle large numbers of users more efficiently.

Reveal Solution Next Question

QUESTION: 38

An organization's board of directors has asked the Chief Information Security Officer to build a third-party management program.
Which of the following best explains a reason for this request?

Risk transference
Supply chain visibility
Support availability
Vulnerability management

Answer(s): B

Explanation:

A third-party management program is typically designed to manage the risks associated with external vendors, partners, or service providers. One of the key goals of such a program is to ensure supply chain visibility. This means the organization wants to understand and manage the risks posed by third parties in its supply chain, including security risks, compliance issues, and the overall integrity of its external relationships.
By implementing a third-party management program, the organization can monitor and assess the security posture of its vendors, ensuring that they align with the company's risk management practices and that the supply chain remains secure.

Reveal Solution Next Question

QUESTION: 39

A company is rewriting a vulnerable application and adding the mprotect() system call in multiple parts of the application's code that was being leveraged by a recent exploitation tool.
Which of the following should be enabled to ensure the application can leverage the new system call against similar attacks in the future?

TPM
Secure boot
NX bit
HSM

Answer(s): C

Explanation:

The NX bit (No eXecute bit) is a security feature that marks certain areas of memory as non-executable. This prevents code from being run in those areas, which is a common technique used in modern operating systems to protect against buffer overflow and other exploits.
When the application leverages the mprotect() system call, it can mark memory regions as non-executable, making it more difficult for attackers to execute injected malicious code. By enabling the NX bit, the system enforces that no code can be executed from areas that should only contain data, preventing certain types of exploits.

Reveal Solution Next Question

QUESTION: 40

Which of the following items should be included when crafting a disaster recovery plan?

Redundancy
Testing exercises
Autoscaling
Competitor locations

Answer(s): B

Explanation:

Testing exercises are a critical component of a disaster recovery (DR) plan because they ensure that the plan works effectively in a real-world scenario. Testing allows organizations to validate their recovery procedures, identify potential gaps, and make improvements before an actual disaster occurs. It helps ensure that all team members are familiar with their roles and that the recovery process can be executed smoothly.

Reveal Solution Next Question

CompTIA CAS-005 Exam (page: 5) CompTIA SecurityX Updated on: 25-Dec-2025

QUESTION: 33

Explanation:

QUESTION: 34

Explanation:

QUESTION: 35

Explanation:

QUESTION: 36

Explanation:

QUESTION: 37

Explanation:

QUESTION: 38

Explanation:

QUESTION: 39

Explanation:

QUESTION: 40

Explanation:

CompTIA CAS-005 Exam (page: 5)
CompTIA SecurityX
Updated on: 25-Dec-2025