Which of the following is the best reason for obtaining file hashes from a confiscated laptop?
Answer(s): B
Obtaining file hashes from a confiscated laptop is primarily done to ensure that the integrity of each file can be validated later. By generating a hash of each file, investigators can later compare the hash values to ensure that no files have been altered or tampered with during the investigation process. This helps confirm that the files remain unchanged from the time they were seized.
A security analyst is using data provided from a recent penetration test to calculate CVSS scores to prioritize remediation. Which of the following metric groups would the analyst need to determine to get the overall scores? (Choose three.)
Answer(s): A,E,F
To calculate the overall CVSS (Common Vulnerability Scoring System) score, an analyst needs to determine three metric groups:Base: This group captures the intrinsic characteristics of a vulnerability that are constant over time and across environments, such as exploitability and impact.Temporal: This group considers the current state of the vulnerability, such as how easily it can be exploited at the moment or whether mitigation is available.Environmental: This group takes into account the specific environment where the vulnerability exists,adjusting the score based on factors such as security controls in place or the importance of the affected system.
Which of the following describes how a risk assessment is performed when an organization has a critical vendor that provides multiple products?
Answer(s): A
A risk assessment should be performed at the individual product level when an organization has a critical vendor providing multiple products. This approach ensures that each product is evaluated for its specific risks, vulnerabilities, and impact on the organization. By assessing each product separately, the organization can identify and prioritize the risks associated with each product rather than making assumptions based on a single product or a general overview.
A security engineer is performing a vulnerability management scan on multihomed Linux systems. The engineer notices that the vulnerability count is high due to the fact that each vulnerability is multiplied by the number of NICs on each system. Which of the following should the engineer do to deduplicate the vulnerabilities and to associate the vulnerabilities with a particular host?
Deploying an agent on the systems will allow for more accurate and centralized vulnerability management. The agent can deduplicate vulnerabilities by associating them with a specific host, regardless of how many network interface cards (NICs) the system has. This helps eliminate the issue of vulnerabilities being counted multiple times for each NIC. Agents can also collect data from the system more accurately and ensure that vulnerabilities are tied to the correct host.
Which of the following best describes a risk associated with using facial recognition to locally authenticate to a mobile device?
Answer(s): D
Biometric impersonation refers to the risk of someone using a photo, video, or other methods to spoof or trick a facial recognition system into authenticating them as the legitimate user. This is a significant concern with facial recognition used for local authentication on mobile devices, as attackers might exploit this vulnerability to gain unauthorized access. Other options such as "deepfake" could be a method used in biometric impersonation, but the best description of the risk is biometric impersonation itself.
The principal security analyst for a global manufacturer is investigating a security incident related to abnormal behavior in the ICS network. A controller was restarted as part of the troubleshooting process, and the following issue was identified when the controller was restarted:SECURE BOOT FAILED:FIRMWARE MISMATCH EXPECTED UXFDC479 ACTUAL 0x79F31BDuring the investigation, this modified firmware version was identified on several other controllers at the site. The official vendor firmware versions do not have this checksum. Which of the following stages of the MITRE ATT&CK framework for ICS includes this technique?
The technique described in the scenario, where modified firmware with an altered checksum is found on multiple controllers, aligns with the Persistence stage of the MITRE ATT&CK framework for ICS (Industrial Control Systems). Persistence involves ensuring that an adversary can maintain access to a system even after reboots, credential changes, or other defensive measures. The manipulation of firmware is a classic method used by attackers to ensure that they can maintain control over a system or device across reboots or resets, which is a key characteristic of the Persistence stage.
A web service provider has just taken on a very large contract that comes with requirements that are currently not being implemented. In order to meet contractual requirements, the company must achieve the following thresholds:99.99% uptimeLoad time in 3 secondsResponse time = <1.0 secondsStarting with the computing environment, which of the following should a security engineer recommend to best meet the requirements? (Choose three.)
Answer(s): B,C,E
To meet the high uptime, load time, and response time requirements, the following recommendations would be most effective:Deploying a content delivery network (CDN): A CDN can distribute content across multiple locations globally, reducing load times by serving content from the nearest edge server to the user.Implementing server clusters: Server clusters can ensure high availability and load balancing, which is essential for maintaining 99.99% uptime and improving response times during high traffic periods.Lowering storage input/output (I/O): Reducing storage I/O can improve performance by speeding up data access and enhancing the system's ability to meet load time and response time requirements.These solutions directly address the performance and availability metrics that are required for the contract.Other options like implementing RAID, using redundant power for workstations, or installing firewalls would not directly contribute to the high availability or performance requirements.
An analyst is working to address a potential compromise of a corporate endpoint and discovers the attacker accessed a user's credentials. However, it is unclear if the system baseline was modified to achieve persistence. Which of the following would most likely support forensic activities in this scenario?
Bit-level disk duplication is the best option in this scenario for supporting forensic activities. It involves creating an exact, sector-by-sector copy of the hard drive, which allows forensic analysts to examine the entire disk, including deleted files, hidden data, or modifications that may have been made by the attacker to achieve persistence. This approach provides the most comprehensive data for investigating the potential compromise and determining if the system baseline was modified.
Share your comments for CompTIA CAS-005 exam with other users:
question 4 answer is c. this site shows the correct answer as b. "adopt a consumption model" is clearly a cost optimization design principle. looks like im done using this site to study!!!
number 52 answer is d
just started preparing for my exam , and this site is so much help
question 35 is incorrect, the correct answer is c, it even states so: explanation: when a vm is infected with ransomware, you should not restore the vm to the infected vm. this is because the ransomware will still be present on the vm, and it will encrypt the files again. you should also not restore the vm to any vm within the companys subscription. this is because the ransomware could spread to other vms in the subscription. the best way to restore a vm that is infected with ransomware is to restore it to a new azure vm. this will ensure that the ransomware is not present on the new vm.
i would like to take psm1 exam.
cbd and pdb are key to the database
the purchase and download process is very much streamlined. the xengine application is very nice and user-friendly but there is always room for improvement.
please upload p_sapea_2023
anyone use this? the question dont seem to follow other formats and terminology i have been studying im getting worried
good questions
hello are these questions valid for ms-102
some questions are wrongly answered but its good nonetheless
how to get system serial number using intune
is it really helpful to pass the exam
#229 in incorrect - all the customers require an annual review
kindy upload
fantastic assessment on psm 1
56 question correct answer a,b
thank you for providing the q bank
true quesstions
i can´t believe ms asks things like this, seems to be only marketing material.
hi, could you please add the last update of ns0-527
question #3 refers to vnet4 and vnet5. however, there is no vnet5 listed in the case study (testlet 2).
sometimes it may be good some times it may be
qs 4 answer seems wrong- please check
very detailed explanation !
the interactive nature of the test engine application makes the preparation process less boring.
very useful.
complete question dump should be made available for practice.
i just passed my first exam. i got 2 exam dumps as part of the 50% sale. my second exam is under work. once i write that exam i report my result. but so far i am confident.
nice create dewey stefen
i just wrote this exam and it is still valid. the questions are exactly the same but there are about 4 or 5 questions that are answered incorrectly. so watch out for those. best of luck with your exam.
passed my exam today. this is a good start to 2023.
great sharing