Pass4sure CAS-003 Exam Dumps | Get Valid CompTIA PDF Questions Answers - 2019
                      
 
Comp tia
CAS-00 3
CompTIA Advanced Security Practitioner
 
 
 
 
https://www.realexamcollection.com/comptia/cas-003-dumps.html
 
 
 
 
Question: 1 
   
DRAG DROP 
Drag and drop the cloud deployment model to the associated use-case scenario. Options may be 
used only once or not at all. 
 
 
 
Answer:  
 
 
 
 
Question: 2 
DRAG DROP 
A security consultant is considering authentication options for a financial institution. The following 
authentication options are available. Drag and drop the security mechanism to the appropriate use 
 
case. Options may be used once. 
 
 
 
Answer:  
 
 
 
 
Question: 3 
An infrastructure team is at the end of a procurement process and has selected a vendor. As part of 
the final negotiations, there are a number of outstanding issues, including: 
1. Indemnity clauses have identified the maximum liability 
2. The data will be hosted and managed outside of the company’s geographical location 
The number of users accessing the system will be small, and no sensitive data will be hosted in the 
solution. As the security consultant on the project, which of the following should the project’s 
security consultant recommend as the NEXT step? 
 
A. Develop a security exemption, as it does not meet the security policies 
B. Mitigate the risk by asking the vendor to accept the in-country privacy principles 
C. Require the solution owner to accept the identified risks and consequences 
D. Review the entire procurement process to determine the lessons learned 
 
Answer: C     
 
Question: 4 
   
DRAG DROP 
A security administrator must configure the database server shown below to comply with the four 
requirements listed. Drag and drop the appropriate ACL that should be configured on the database 
 
server to its corresponding requirement. Answer options may be used once or not at all. 
 
 
 
Answer:  
 
 
 
 
Question: 5 
 
A security administrator is hardening a TrustedSolaris server that processes sensitive data. The data 
owner has established the following security requirements: 
The data is for internal consumption only and shall not be distributed to outside individuals 
The systems administrator should not have access to the data processed by the server 
The integrity of the kernel image is maintained 
Which of the following host-based security controls BEST enforce the data owner’s requirements? 
(Choose three.) 
 
A. SELinux 
B. DLP 
C. HIDS 
D. Host-based firewall 
E. Measured boot 
F. Data encryption 
G. Watermarking 
 
Answer: C,E,F     
 
Question: 6 
   
An SQL database is no longer accessible online due to a recent security breach. An investigation 
 
reveals that unauthorized access to the database was possible due to an SQL injection vulnerability. 
To prevent this type of breach in the future, which of the following security controls should be put in 
place before bringing the database back online? (Choose two.) 
 
A. Secure storage policies 
B. Browser security updates 
C. Input validation 
D. Web application firewall 
E. Secure coding standards 
F. Database activity monitoring 
 
Answer: C,F     
 
Question: 7 
   
A company has entered into a business agreement with a business partner for managed human 
resources services. The Chief Information Security Officer (CISO) has been asked to provide 
documentation that is required to set up a business-to-business VPN between the two organizations. 
Which of the following is required in this scenario? 
 
A. ISA 
B. BIA 
C. SLA 
D. RA 
 
Answer: A     
 
Question: 8 
   
Given the following output from a local PC: 
 
Which of the following ACLs on a stateful host-based firewall would allow the PC to serve an intranet 
website? 
 
 
A. Allow 172.30.0.28:80 -> ANY 
B. Allow 172.30.0.28:80 -> 172.30.0.0/16 
C. Allow 172.30.0.28:80 -> 172.30.0.28:443 
D. Allow 172.30.0.28:80 -> 172.30.0.28:53 
 
Answer: B     
 
Question: 9 
   
A penetration tester has been contracted to conduct a physical assessment of a site. Which of the 
following is the MOST plausible method of social engineering to be conducted during this 
engagement? 
 
A. Randomly calling customer employees and posing as a help desk technician requiring user 
password to resolve issues 
B. Posing as a copier service technician and indicating the equipment had “phoned home” to alert 
the technician for a service call 
C. Simulating an illness while at a client location for a sales call and then recovering once listening 
devices are installed 
D. Obtaining fake government credentials and impersonating law enforcement to gain access to a 
company facility 
 
Answer: A     
 
Question: 10 
   
A penetration tester is conducting an assessment on Comptia.org and runs the following command 
from a coffee shop while connected to the public Internet: 
 
Which of the following should the penetration tester conclude about the command output? 
 
A. The public/private views on the Comptia.org DNS servers are misconfigured 
B. Comptia.org is running an older mail server, which may be vulnerable to exploits 
C. The DNS SPF records have not been updated for Comptia.org 
D. 192.168.102.67 is a backup mail server that may be more vulnerable to attack 
 
 
Answer: B     
 
Question: 11 
   
Two new technical SMB security settings have been enforced and have also become policies that 
increase secure communications. 
Network Client: Digitally sign communication 
Network Server: Digitally sign communication 
A storage administrator in a remote location with a legacy storage array, which contains timesensitive 
data, reports employees can no longer connect to their department shares. Which of the 
following mitigation strategies should an information security manager recommend to the data 
owner? 
 
A. Accept the risk, reverse the settings for the remote location, and have the remote location file a 
risk exception until the legacy storage device can be upgraded 
B. Accept the risk for the remote location, and reverse the settings indefinitely since the legacy 
storage device will not be upgraded 
C. Mitigate the risk for the remote location by suggesting a move to a cloud service provider. Have 
the remote location request an indefinite risk exception for the use of cloud storage 
D. Avoid the risk, leave the settings alone, and decommission the legacy storage device 
 
Answer: A     
 
Question: 12 
   
A security engineer is designing a system in which offshore, outsourced staff can push code from the 
development environment to the production environment securely. The security engineer is 
concerned with data loss, while the business does not want to slow down its development process. 
Which of the following solutions BEST balances security requirements with business need? 
 
A. Set up a VDI environment that prevents copying and pasting to the local workstations of 
outsourced staff members 
B. Install a client-side VPN on the staff laptops and limit access to the development network 
C. Create an IPSec VPN tunnel from the development network to the office of the outsourced staff 
D. Use online collaboration tools to initiate workstation-sharing sessions with local staff who have 
access to the development network 
 
Answer: D     
 
Question: 13 
   
 
A systems security engineer is assisting an organization’s market survey team in reviewing 
requirements for an upcoming acquisition of mobile devices. The engineer expresses concerns to the 
survey team about a particular class of devices that uses a separate SoC for baseband radio I/O. For 
which of the following reasons is the engineer concerned? 
 
A. These devices can communicate over networks older than HSPA+ and LTE standards, exposing 
device communications to poor encryptions routines 
B. The organization will be unable to restrict the use of NFC, electromagnetic induction, and 
Bluetooth technologies 
C. The associated firmware is more likely to remain out of date and potentially vulnerable 
D. The manufacturers of the baseband radios are unable to enforce mandatory access controls within 
their driver set 
 
Answer: B     
 
Question: 14 
   
During a security assessment, an organization is advised of inadequate control over network 
segmentation. The assessor explains that the organization’s reliance on VLANs to segment traffic is 
insufficient to provide segmentation based on regulatory standards. 
Which of the following should the organization consider implementing along with VLANs to provide a 
greater level of segmentation? 
 
A. Air gaps 
B. Access control lists 
C. Spanning tree protocol 
D. Network virtualization 
E. Elastic load balancing 
 
Answer: D     
 
Question: 15 
   
A security administrator was informed that a server unexpectedly rebooted. The administrator 
received an export of syslog entries for analysis: 
 
 
Which of the following does the log sample indicate? (Choose two.) 
 
A. A root user performed an injection attack via kernel module 
B. Encrypted payroll data was successfully decrypted by the attacker 
C. Jsmith successfully used a privilege escalation attack 
D. Payroll data was exfiltrated to an attacker-controlled host 
E. Buffer overflow in memory paging caused a kernel panic 
F. Syslog entries were lost due to the host being rebooted 
 
Answer: C,E     
 
Question: 16 
   
An organization has employed the services of an auditing firm to perform a gap assessment in 
preparation for an upcoming audit. As part of the gap assessment, the auditor supporting the 
assessment recommends the organization engage with other industry partners to share information 
 
about emerging attacks to organizations in the industry in which the organization functions. 
Which of the following types of information could be drawn from such participation? 
 
A. Threat modeling 
B. Risk assessment 
C. Vulnerability data 
D. Threat intelligence 
E. Risk metrics 
F. Exploit frameworks 
 
Answer: F     
 
Question: 17 
   
A recent penetration test identified that a web server has a major vulnerability. The web server hosts 
a critical shipping application for the company and requires 99.99% availability. Attempts to fix the 
vulnerability would likely break the application. The shipping application is due to be replaced in the 
next three months. Which of the following would BEST secure the web server until the replacement 
web server is ready? 
 
A. Patch management 
B. Antivirus 
C. Application firewall 
D. Spam filters 
E. HIDS 
 
Answer: E     
 
Question: 18 
   
To prepare for an upcoming audit, the Chief Information Security Officer (CISO) asks for all 1200 
vulnerabilities on production servers to be remediated. The security engineer must determine which 
vulnerabilities represent real threats that can be exploited so resources can be prioritized to migrate 
the most dangerous risks. The CISO wants the security engineer to act in the same manner as would 
an external threat, while using vulnerability scan results to prioritize any actions. 
Which of the following approaches is described? 
 
A. Blue team 
B. Red team 
C. Black box 
D. White team 
 
Answer: C     
 
 
Question: 19 
   
An engineer is evaluating the control profile to assign to a system containing PII, financial, and 
proprietary data. 
 
Based on the data classification table above, which of the following BEST describes the overall 
classification? 
 
A. High confidentiality, high availability 
B. High confidentiality, medium availability 
C. Low availability, low confidentiality 
D. High integrity, low availability 
 
Answer: B     
 
Question: 20 
   
A security analyst is reviewing the corporate MDM settings and notices some disabled settings, 
which consequently permit users to download programs from untrusted developers and manually 
install them. After some conversations, it is confirmed that these settings were disabled to support 
the internal development of mobile applications. The security analyst is now recommending that 
developers and testers have a separate device profile allowing this, and that the rest of the 
organization’s users do not have the ability to manually download and install untrusted applications. 
Which of the following settings should be toggled to achieve the goal? (Choose two.) 
 
A. OTA updates 
B. Remote wiping 
C. Side loading 
D. Sandboxing 
E. Containerization 
F. Signed applications 
 
 
Answer: E,F     
 
Question: 21 
   
A security incident responder discovers an attacker has gained access to a network and has 
overwritten key system files with backdoor software. The server was reimaged and patched offline. 
Which of the following tools should be implemented to detect similar attacks? 
 
A. Vulnerability scanner 
B. TPM 
C. Host-based firewall 
D. File integrity monitor 
E. NIPS 
 
Answer: C     
 
Question: 22 
   
An organization is in the process of integrating its operational technology and information 
technology areas. As part of the integration, some of the cultural aspects it would like to see include 
more efficient use of resources during change windows, better protection of critical infrastructure, 
and the ability to respond to incidents. The following observations have been identified: 
The ICS supplier has specified that any software installed will result in lack of support. 
There is no documented trust boundary defined between the SCADA and corporate networks. 
Operational technology staff have to manage the SCADA equipment via the engineering workstation. 
There is a lack of understanding of what is within the SCADA network. 
Which of the following capabilities would BEST improve the security position? 
 
A. VNC, router, and HIPS 
B. SIEM, VPN, and firewall 
C. Proxy, VPN, and WAF 
D. IDS, NAC, and log monitoring 
 
Answer: A     
 
Question: 23 
   
A company has hired an external security consultant to conduct a thorough review of all aspects of 
corporate security. The company is particularly concerned about unauthorized access to its physical 
offices resulting in network compromises. Which of the following should the consultant recommend 
be performed to evaluate potential risks? 
 
 
A. The consultant should attempt to gain access to physical offices through social engineering and 
then attempt data exfiltration 
B. The consultant should be granted access to all physical access control systems to review logs and 
evaluate the likelihood of the threat 
C. The company should conduct internal audits of access logs and employee social media feeds to 
identify potential insider threats 
D. The company should install a temporary CCTV system to detect unauthorized access to physical 
offices 
 
Answer: A     
 
Question: 24 
   
A server (10.0.0.2) on the corporate network is experiencing a DoS from a number of marketing 
desktops that have been compromised and are connected to a separate network segment. The 
security engineer implements the following configuration on the management router: 
 
Which of the following is the engineer implementing? 
 
A. Remotely triggered black hole 
B. Route protection 
C. Port security 
D. Transport security 
E. Address space layout randomization 
 
Answer: B     
 
Question: 25 
   
An internal penetration tester was assessing a recruiting page for potential issues before it was 
pushed to the production website. The penetration tester discovers an issue that must be corrected 
before the page goes live. The web host administrator collects the log files below and gives them to 
 
the development team so improvements can be made to the security design of the website. 
 
Which of the following types of attack vector did the penetration tester use? 
 
A. SQL injection 
B. CSRF 
C. Brute force 
D. XSS 
E. TOC/TOU 
 
Answer: B     
 
Question: 26 
   
The Chief Information Security Officer (CISO) for an organization wants to develop custom IDS 
rulesets faster, prior to new rules being released by IDS vendors. Which of the following BEST meets 
this objective? 
 
A. Identify a third-party source for IDS rules and change the configuration on the applicable IDSs to 
pull in the new rulesets 
B. Encourage cybersecurity analysts to review open-source intelligence products and threat database 
to generate new IDS rules based on those sources 
C. Leverage the latest TCP- and UDP-related RFCs to arm sensors and IDSs with appropriate heuristics 
 
for anomaly detection 
D. Use annual hacking conventions to document the latest attacks and threats, and then develop IDS 
rules to counter those threats 
 
Answer: B     
 
Question: 27 
   
A user workstation was infected with a new malware variant as a result of a drive-by download. The 
security administrator reviews key controls on the infected workstation and discovers the following: 
 
Which of the following would BEST prevent the problem from reoccurring in the future? (Choose 
two.) 
 
A. Install HIPS 
B. Enable DLP 
C. Install EDR 
D. Install HIDS 
E. Enable application blacklisting 
F. Improve patch management processes 
 
Answer: B,E     
 
 
Question: 28 
   
An engineer is assisting with the design of a new virtualized environment that will house critical 
company services and reduce the datacenter’s physical footprint. The company has expressed 
concern about the integrity of operating systems and wants to ensure a vulnerability exploited in one 
datacenter segment would not lead to the compromise of all others. 
Which of the following design objectives should the engineer complete to BEST mitigate the 
company’s concerns? (Choose two.) 
 
A. Deploy virtual desktop infrastructure with an OOB management network 
B. Employ the use of vT PM with boot attestation 
C. Leverage separate physical hardware for sensitive services and data 
D. Use a community CSP with independently managed security services 
E. Deploy to a private cloud with hosted hypervisors on each physical machine 
 
Answer: A,C     
 
Question: 29 
   
After embracing a BYOD policy, a company is faced with new security challenges from unmanaged 
mobile devices and laptops. The company’s IT department has seen a large number of the following 
incidents: 
Duplicate IP addresses 
Rogue network devices 
Infected systems probing the company’s network 
Which of the following should be implemented to remediate the above issues? (Choose two.) 
 
A. Port security 
B. Route protection 
C. NAC 
D. HIPS 
E. NIDS 
 
Answer: B,C     
 
Question: 30 
   
Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the results 
of the assessment and evaluating potential risk treatment strategies. As part of the CISO’s 
evaluation, a judgment of potential impact based on the identified risk is performed. To prioritize 
response actions, the CISO uses past experience to take into account the exposure factor as well as 
 
the external accessibility of the weakness identified. 
Which of the following is the CISO performing? 
 
A. Documentation of lessons learned 
B. Quantitative risk assessment 
C. Qualitative assessment of risk 
D. Business impact scoring 
E. Threat modeling 
 
Answer: B     
 
https://www.realexamcollection.com/comptia/cas-003-dumps.html