CompTIA CAS-003 CompTIA Advanced Security Practitioner (CASP) Online Training
CompTIA CAS-003 Online Training
The questions for CAS-003 were last updated at May 01,2024.
- Exam Code: CAS-003
- Exam Name: CompTIA Advanced Security Practitioner (CASP)
- Certification Provider: CompTIA
- Latest update: May 01,2024
A security engineer must establish a method to assess compliance with company security policies as they apply to the unique configuration of individual endpoints, as well as to the shared configuration policies of common devices.
Which of the following tools is the security engineer using to produce the above output?
- A . Vulnerability scanner
- B . SIEM
- C . Port scanner
- D . SCAP scanner
A security analyst has been asked to create a list of external IT security concerns, which are applicable to the organization. The intent is to show the different types of external actors, their attack vectors, and the types of vulnerabilities that would cause business impact. The Chief Information Security Officer (CISO) will then present this list to the board to request funding for controls in areas that have insufficient coverage.
Which of the following exercise types should the analyst perform?
- A . Summarize the most recently disclosed vulnerabilities.
- B . Research industry best practices and latest RFCs.
- C . Undertake an external vulnerability scan and penetration test.
- D . Conduct a threat modeling exercise.
An online bank has contracted with a consultant to perform a security assessment of the bank’s web portal. The consultant notices the login page is linked from the main page with HTTPS, but when the URL is changed to HTTP, the browser is automatically redirected back to the HTTPS site .
Which of the following is a concern for the consultant, and how can it be mitigated?
- A . XSS could be used to inject code into the login page during the redirect to the HTTPS site. The consultant should implement a WAF to prevent this.
- B . The consultant is concerned the site is using an older version of the SSL 3.0 protocol that is vulnerable to a variety of attacks. Upgrading the site to TLS 1.0 would mitigate this issue.
- C . The HTTP traffic is vulnerable to network sniffing, which could disclose usernames and passwords to an attacker. The consultant should recommend disabling HTTP on the web server.
- D . A successful MITM attack Could intercept the redirect and use sslstrip to decrypt further HTTPS traffic. Implementing HSTS on the web server would prevent this.
The risk subcommittee of a corporate board typically maintains a master register of the most prominent risks to the company.
A centralized holistic view of risk is particularly important to the corporate Chief Information Security Officer (CISO) because:
- A . IT systems are maintained in silos to minimize interconnected risks and provide clear risk boundaries used to implement compensating controls
- B . risks introduced by a system in one business unit can affect other business units in ways in which the individual business units have no awareness
- C . corporate general counsel requires a single system boundary to determine overall corporate risk exposure
- D . major risks identified by the subcommittee merit the prioritized allocation of scare funding to address cybersecurity concerns
A development team is testing an in-house-developed application for bugs. During the test, the application crashes several times due to null pointer exceptions .
Which of the following tools, if integrated into an IDE during coding, would identify these bugs routinely?
- A . Issue tracker
- B . Static code analyzer
- C . Source code repository
- D . Fuzzing utility
Click on the exhibit buttons to view the four messages.
A security architect is working with a project team to deliver an important service that stores and processes customer banking details. The project, internally known as ProjectX, is due to launch its first set of features publicly within a week, but the team has not been able to implement encryption-at-rest of the customer records. The security architect is drafting an escalation email to senior leadership.
Which of the following BEST conveys the business impact for senior leadership?
- A . Message 1
- B . Message 2
- C . Message 3
- D . Message 4
A software development manager is running a project using agile development methods. The company cybersecurity engineer has noticed a high number of vulnerabilities have been making it into production code on the project.
Which of the following methods could be used in addition to an integrated development environment to reduce the severity of the issue?
- A . Conduct a penetration test on each function as it is developed
- B . Develop a set of basic checks for common coding errors
- C . Adopt a waterfall method of software development
- D . Implement unit tests that incorporate static code analyzers
A security architect is implementing security measures in response to an external audit that found vulnerabilities in the corporate collaboration tool suite. The report identified the lack of any mechanism to provide confidentiality for electronic correspondence between users and between users and group mailboxes .
Which of the following controls would BEST mitigate the identified vulnerability?
- A . Issue digital certificates to all users, including owners of group mailboxes, and enable S/MIME
- B . Federate with an existing PKI provider, and reject all non-signed emails
- C . Implement two-factor email authentication, and require users to hash all email messages upon receipt
- D . Provide digital certificates to all systems, and eliminate the user group or shared mailboxes
An organization based in the United States is planning to expand its operations into the European market later in the year Legal counsel is exploring the additional requirements that must be established as a result of the expansion. The BEST course of action would be to
- A . revise the employee provisioning and deprovisioning procedures
- B . complete a quantitative risk assessment
- C . draft a memorandum of understanding
- D . complete a security questionnaire focused on data privacy.
A company has hired an external security consultant to conduct a thorough review of all aspects of corporate security. The company is particularly concerned about unauthorized access to its physical offices resulting in network compromises .
Which of the following should the consultant recommend be performed to evaluate potential risks?
- A . The consultant should attempt to gain access to physical offices through social engineering and then attempt data exfiltration
- B . The consultant should be granted access to all physical access control systems to review logs and evaluate the likelihood of the threat
- C . The company should conduct internal audits of access logs and employee social media feeds to identify potential insider threats
- D . The company should install a temporary CCTV system to detect unauthorized access to physical offices
Latest CAS-003 Dumps Valid Version with 509 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
ddd
nnn