Actualtests has service hotline for you in order to consult us in case you have just about any question. Our objective would be to make each of our customers satisfied along with successful. We are so proud of the pass rate that individuals promise you will get the CompTIA CAS-001 certification without any difficulty. As well as you can get 100% funds back with the paying fees.
2021 Oct CAS-001 practice test
Q231. - (Topic 4)
A vulnerability research team has detected a new variant of a stealth Trojan that disables itself when it detects that it is running on a virtualized environment. The team decides to use dedicated hardware and local network to identify the Trojan’s behavior and the remote DNS and IP addresses it connects to. Which of the following tools is BEST suited to identify the DNS and IP addresses the stealth Trojan communicates with after its payload is decrypted?
A. HIDS
B. Vulnerability scanner
C. Packet analyzer
D. Firewall logs
E. Disassembler
Answer: C
Q232. - (Topic 2)
Which of the following implementations of a continuous monitoring risk mitigation strategy
is correct?
A. Audit successful and failed events, transfer logs to a centralized server, institute computer assisted audit reduction, and email alerts to NOC staff hourly.
B. Audit successful and critical failed events, transfer logs to a centralized server once a month, tailor logged event thresholds to meet organization goals, and display alerts in real time when thresholds are approached.
C. Audit successful and failed events, transfer logs to a centralized server, institute computer assisted audit reduction, tailor logged event thresholds to meet organization goals, and display alerts in real time when thresholds are exceeded.
D. Audit failed events only, transfer logs to a centralized server, implement manual audit reduction, tailor logged event thresholds to meet organization goals, and display alerts in real time when thresholds are approached and exceeded.
Answer: C
Q233. - (Topic 2)
SAML entities can operate in a variety of different roles. Valid SAML roles include which of the following?
A. Attribute authority and certificate authority
B. Certificate authority and attribute requestor
C. Identity provider and service provider
D. Service provider and administrator
Answer: C
Q234. - (Topic 1)
An internal employee has sold a copy of the production customer database that was being used for upgrade testing to outside parties via HTTP file upload. The Chief Information Officer (CIO) has resigned and the Chief Executive Officer (CEO) has tasked the incoming CIO with putting effective controls in place to help prevent this from occurring again in the future. Which of the following controls is the MOST effective in preventing this threat from re-occurring?
A. Network-based intrusion prevention system
B. Data loss prevention
C. Host-based intrusion detection system
D. Web application firewall
Answer: B
Q235. - (Topic 5)
The manager of the firewall team is getting complaints from various IT teams that firewall changes are causing issues. Which of the following should the manager recommend to BEST address these issues?
A. Set up a weekly review for relevant teams to discuss upcoming changes likely to have a broad impact.
B. Update the change request form so that requesting teams can provide additional details about the requested changes.
C. Require every new firewall rule go through a secondary firewall administrator for review before pushing the firewall policy.
D. Require the firewall team to verify the change with the requesting team before pushing the updated firewall policy.
Answer: A
Rebirth CAS-001 exam question:
Q236. - (Topic 3)
An organization did not know its internal customer and financial databases were compromised until the attacker published sensitive portions of the database on several popular attacker websites. The organization was unable to determine when, how, or who conducted the attacks but rebuilt, restored, and updated the compromised database server to continue operations.
Which of the following is MOST likely the cause for the organization’s inability to determine what really occurred?
A. Too few layers of protection between the Internet and internal network
B. Lack of a defined security auditing methodology
C. Poor intrusion prevention system placement and maintenance
D. Insufficient logging and mechanisms for review
Answer: D
Q237. - (Topic 1)
A system administrator needs to develop a policy for when an application server is no longer needed. Which of the following policies would need to be developed?
A. Backup policy
B. De-provisioning policy
C. Data retention policy
D. Provisioning policy
Answer: C
Q238. - (Topic 5)
A security engineer at a software development company has identified several vulnerabilities in a product late in the development cycle. This causes a huge delay for the release of the product. Which of the following should the administrator do to prevent these issues from occurring in the future?
A. Recommend switching to an SDLC methodology and perform security testing during eachmaintenance iteration
B. Recommend switching to a spiral software development model and perform security testing during the requirements gathering
C. Recommend switching to a waterfall development methodology and perform security testing during the testing phase
D. Recommend switching to an agile development methodology and perform security testing during iterations
Answer: D
Q239. - (Topic 2)
After a recent outbreak of malware attacks, the Chief Information Officer (CIO) tasks the new security manager with determining how to keep these attacks from reoccurring. The company has a standard image for all laptops/workstations and uses a host-based firewall and anti-virus. Which of the following should the security manager suggest to INCREASE each system’s security level?
A. Upgrade all system’s to use a HIPS and require daily anti-virus scans.
B. Conduct a vulnerability assessment of the standard image and remediate findings.
C. Upgrade the existing NIDS to NIPS and deploy the system across all network segments.
D. Rebuild the standard image and require daily anti-virus scans of all PCs and laptops.
Answer: B
Q240. - (Topic 4)
A university Chief Information Security Officer is analyzing various solutions for a new project involving the upgrade of the network infrastructure within the campus. The campus has several dorms (two-four person rooms) and administrative buildings. The network is currently setup to provide only two network ports in each dorm room and ten network ports per classroom. Only administrative buildings provide 2.4 GHz wireless coverage.
The following three goals must be met after the new implementation:
1.Provide all users (including students in their dorms) connections to the Internet.
2.Provide IT department with the ability to make changes to the network environment to improve performance.
3.Provide high speed connections wherever possible all throughout campus including sporting event areas.
Which of the following risk responses would MOST likely be used to reduce the risk of network outages and financial expenditures while still meeting each of the goals stated above?
A. Avoid any risk of network outages by providing additional wired connections to each user and increasing the number of data ports throughout the campus.
B. Transfer the risk of network outages by hiring a third party to survey, implement and manage a 5.0 GHz wireless network.
C. Accept the risk of possible network outages and implement a WLAN solution to provide complete 5.0 GHz coverage in each building that can be managed centrally on campus.
D. Mitigate the risk of network outages by implementing SOHO WiFi coverage throughout the dorms and upgrading only the administrative buildings to 5.0 GHz coverage using a one for one AP replacement.
Answer: C