Which of the following is the best reason for obtaining file hashes from a confiscated laptop?
Answer(s): B
Obtaining file hashes from a confiscated laptop is primarily done to ensure that the integrity of each file can be validated later. By generating a hash of each file, investigators can later compare the hash values to ensure that no files have been altered or tampered with during the investigation process. This helps confirm that the files remain unchanged from the time they were seized.
A security analyst is using data provided from a recent penetration test to calculate CVSS scores to prioritize remediation. Which of the following metric groups would the analyst need to determine to get the overall scores? (Choose three.)
Answer(s): A,E,F
To calculate the overall CVSS (Common Vulnerability Scoring System) score, an analyst needs to determine three metric groups:Base: This group captures the intrinsic characteristics of a vulnerability that are constant over time and across environments, such as exploitability and impact.Temporal: This group considers the current state of the vulnerability, such as how easily it can be exploited at the moment or whether mitigation is available.Environmental: This group takes into account the specific environment where the vulnerability exists,adjusting the score based on factors such as security controls in place or the importance of the affected system.
Which of the following describes how a risk assessment is performed when an organization has a critical vendor that provides multiple products?
Answer(s): A
A risk assessment should be performed at the individual product level when an organization has a critical vendor providing multiple products. This approach ensures that each product is evaluated for its specific risks, vulnerabilities, and impact on the organization. By assessing each product separately, the organization can identify and prioritize the risks associated with each product rather than making assumptions based on a single product or a general overview.
A security engineer is performing a vulnerability management scan on multihomed Linux systems. The engineer notices that the vulnerability count is high due to the fact that each vulnerability is multiplied by the number of NICs on each system. Which of the following should the engineer do to deduplicate the vulnerabilities and to associate the vulnerabilities with a particular host?
Deploying an agent on the systems will allow for more accurate and centralized vulnerability management. The agent can deduplicate vulnerabilities by associating them with a specific host, regardless of how many network interface cards (NICs) the system has. This helps eliminate the issue of vulnerabilities being counted multiple times for each NIC. Agents can also collect data from the system more accurately and ensure that vulnerabilities are tied to the correct host.
Which of the following best describes a risk associated with using facial recognition to locally authenticate to a mobile device?
Answer(s): D
Biometric impersonation refers to the risk of someone using a photo, video, or other methods to spoof or trick a facial recognition system into authenticating them as the legitimate user. This is a significant concern with facial recognition used for local authentication on mobile devices, as attackers might exploit this vulnerability to gain unauthorized access. Other options such as "deepfake" could be a method used in biometric impersonation, but the best description of the risk is biometric impersonation itself.
The principal security analyst for a global manufacturer is investigating a security incident related to abnormal behavior in the ICS network. A controller was restarted as part of the troubleshooting process, and the following issue was identified when the controller was restarted:SECURE BOOT FAILED:FIRMWARE MISMATCH EXPECTED UXFDC479 ACTUAL 0x79F31BDuring the investigation, this modified firmware version was identified on several other controllers at the site. The official vendor firmware versions do not have this checksum. Which of the following stages of the MITRE ATT&CK framework for ICS includes this technique?
The technique described in the scenario, where modified firmware with an altered checksum is found on multiple controllers, aligns with the Persistence stage of the MITRE ATT&CK framework for ICS (Industrial Control Systems). Persistence involves ensuring that an adversary can maintain access to a system even after reboots, credential changes, or other defensive measures. The manipulation of firmware is a classic method used by attackers to ensure that they can maintain control over a system or device across reboots or resets, which is a key characteristic of the Persistence stage.
A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented. In order to meet contractual requirements, the company must achieve the following thresholds:99.99% uptimeLoad time in 3 secondsResponse time = <1.0 secondsStarting with the computing environment, which of the following should a security engineer recommend to best meet the requirements? (Choose three.)
Answer(s): B,C,E
To meet the high uptime, load time, and response time requirements, the following recommendations would be most effective:Deploying a content delivery network (CDN): A CDN can distribute content across multiple locations globally, reducing load times by serving content from the nearest edge server to the user.Implementing server clusters: Server clusters can ensure high availability and load balancing, which is essential for maintaining 99.99% uptime and improving response times during high traffic periods.Lowering storage input/output (I/O): Reducing storage I/O can improve performance by speeding up data access and enhancing the system's ability to meet load time and response time requirements.These solutions directly address the performance and availability metrics that are required for the contract.Other options like implementing RAID, using redundant power for workstations, or installing firewalls would not directly contribute to the high availability or performance requirements.
An analyst is working to address a potential compromise of a corporate endpoint and discovers the attacker accessed a user's credentials. However, it is unclear if the system baseline was modified to achieve persistence. Which of the following would most likely support forensic activities in this scenario?
Bit-level disk duplication is the best option in this scenario for supporting forensic activities. It involves creating an exact, sector-by-sector copy of the hard drive, which allows forensic analysts to examine the entire disk, including deleted files, hidden data, or modifications that may have been made by the attacker to achieve persistence. This approach provides the most comprehensive data for investigating the potential compromise and determining if the system baseline was modified.
Share your comments for CompTIA CAS-005 exam with other users:
vraag 20c: rsa veilig voor symmtrische cryptografie? antwoord c is toch fout. rsa is voor asymmetrische cryptogafie??
so far good
question 31 has obviously wrong answers. tls and ssl are used to encrypt data at transit, not at rest.
pls provide dump for 1z0-1080-23 planning exams
could you please upload the exam?
please upload this
good material
lets see if this is good stuff...
useful information
intéressant
thank you for making the interactive questions
questions are accurate
i need questions/dumps for this exam.
i need this exam, when will it be uploaded
i need the dumps !
very helpful
good source
my 3rd test and passed on first try. hats off to this brain dumps site.
please upload it
does anybody know if are these real exam questions?
are these questions similar to actual questions in the exam? because they seem to be too easy
i have a lot of experience but what comes in the exam is totally different from the practical day to day tasks. so i thought i would rather rely on these brain dumps rather failing the exam.
good questions
valied exam dumps. they were very helpful and i got a pretty good score. i am very grateful for this service and exam questions
will it help?
very useful to verify knowledge before exam
good stuffs
question 17 : responses arent b and c ?
just passed the exam on my first try using these dumps.
these questions look good.
this is very helpful content
please provide the dumps
it is amazing