CompTIA CAS-005 Exam Dumps

Question # 1

A security analyst is performing threat modeling for a new AI chatbot. The AI chatbot will be rolled out to help customers develop configuration information within the company's SaaS offering. Which of the following issues would require involvement from the company's internal legal team? 

A. An internal user finds a way to use prompt injection to disregard guardrails. 
B. A DoS vulnerability exists that could impact all customers who use the chatbot. 
C. A bug bounty of an exploitable model inversion vulnerability is submitted. 
D. User consent is not being collected before training models on customer data. 
E. An access control issue is allowing the model to be poisoned with incorrect information. 

  Show Answer

Question # 2

 A company developed a new solution that needs to track any changes to the data, and the changes need to be quickly identified. If any changes are attempted without prior approval, multiple events must be triggered, such as: Raising alerts Blocking the unapproved changes Quickly removing access to the data Which of the following solutions best meets these requirements? 

A. Tracking all application logs, integrating them to the existing SIEM, flagging any changes, and making them visible on security dashboards 
B. Implementing a file integrity monitoring tool and integrating it via orchestration and automation with other security tools 
C. Introducing more granular access controls and allowing read-only access for non-privileged users 
D. Configuring CASB rules, making access to the data available only to authorized personnel 

  Show Answer

Question # 3

 A security engineer reviews an after action report from a previous security breach and notes a long lag time between detection and containment of a compromised account. The engineer suggests using SOAR to address this concern. Which of the following best explains the engineer's goal? 

A. To prevent accounts from being compromised 
B. To enable log correlation using machine learning 
C. To orchestrate additional reporting for the security operations center 
D. To prepare runbooks to automate future incident response 

  Show Answer

Question # 4

 During an incident response activity, the response team collected some artifacts from a compromised server, but the following information is missing: Source of the malicious files Initial attack vector Lateral movement activities The next step in the playbook is to reconstruct a timeline. Which of the following best supports this effort? 

A. Executing decompilation of binary files 
B. Analyzing all network routes and connections 
C. Performing primary memory analysis 
D. Collecting operational system logs and storage disk data 

  Show Answer

Question # 5

 A company must meet the following security requirements when implementing controls in order to be compliant with government policy: Access to the system document repository must be MFA enabled. Ongoing risk monitoring must be displayed on a system dashboard. Staff must receive email notifications about periodic tasks. Which of the following best meets all of these requirements? 

A. Implementing a GRC tool 
B. Configuring a privileged access management system 
C. Launching a vulnerability management program 
D. Creating a risk register 

  Show Answer

Question # 6

 While performing threat-hunting functions, an analyst is using the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target. Which of the following must the threat hunter document to use the model effectively? 

A. Knowledge 
B. Capabilities 
C. Phase 
D. Methodologies 

  Show Answer

Question # 7

An organization must provide access to its internal system data. The organization requires that this access complies with the following: Access must be automated. Data confidentiality must be preserved. Access must be authenticated. Data must be preprocessed before it is retrieved. Which of the following actions should the organization take to meet these requirements? 

A. Configure a reverse proxy to protect the data. 
B. Implement an on-demand VPN connection. 
C. Deploy an API gateway protected with access tokens. 
D. Continually publish all relevant data to a CDN. 

  Show Answer

Question # 8

Emails that the marketing department is sending to customers are going to the customers' spam folders. The security team is investigating the issue and discovers that the certificates used by the email server were reissued, but DNS records had not been updated. Which of the following should the security team update in order to fix this issue? (Select three). 

A. DMARC 
B. SPF 
C. DKIM 
D. DNSSEC 
E. SASE 
F. SAN 
G. SOA 
H. MX 

  Show Answer

Question # 9

 A development team must create a website to share indicators of compromise. The team wants to use APIs between industry peers to aid in configuring SIEM and SOAR. The team needs to create a free tier of service, and the senior developer insists on configuring rate limiting. Which of the following best describes the senior developer's reasoning? 

A. To prevent password-spraying attacks on the services hosting the API 
B. To limit the likelihood of resource exhaustion occurring on the API server 
C. To address concerns the team has about API bandwidth utilization 
D. To reduce attack surface exposure of the API endpoints connecting peers 

  Show Answer

Question # 10

An engineer wants to automate several tasks by running commands daily on a UNIX server. The engineer has only built-in, default tools available. Which of the following should the engineer use to best assist with this effort? (Select Two). 

A. Python 
B. Cron 
C. Ansible 
D. PowerShell 
E. Bash 
F. Task Scheduler 

  Show Answer

Question # 11

 A security engineer needs to create multiple servers in a company's private cloud. The servers should have a virtual network infrastructure that supports connectivity, as well as security configurations applied using predefined templates. Which of the following is the best option for the security engineer to consider for the deployment? 

A. Installing a container orchestration solution locally, configuring the infrastructure, and cloning the solution 
B. Creating templates on the cloud provider marketplace and modeling the solution using those templates 
C. Using Terraform to implement an infrastructure as code model with the existing private cloud solution 
D. Integrating the cloud provider API to the CI/CD pipeline model used by the company 

  Show Answer

Question # 12

While investigating an email server that crashed, an analyst reviews the following log files: Which of the following is most likely the root cause? 

A. The administrator's account credentials were intercepted and reused. 
B. The backup process did not complete and caused cascading failure. 
C. A hardware failure in the storage array caused the mailboxes to be inaccessible. 
D. A user with low privileges was able to escalate and erase all mailboxes. 

  Show Answer

Question # 13

An organization is deploying a new data lake that will centralize records from several applications. During the design phase, the security architect identifies the following requirements: The sensitivity levels of the data is different. The data must be accessed through stateless API calls after authentication. Different users will have access to different data sets. Which of the following should the architect implement to best meet these requirements? 

A. Directory services 
B. 802.1X with EAP-TLS 
C. OpenID Connect 
D. CASB 

  Show Answer

Question # 14

 A company wants to perform threat modeling on an internally developed, business-critical application. The Chief Information Security Officer (CISO) is most concerned that the application should maintain 99.999% availability and authorized users should only be able to gain access to data they are explicitly authorized to view. Which of the following threat-modeling frameworks directly addresses the CISO's concerns about this system? 

A. CAPEC 
B. STRIDE 
C. ATT&CK 
D. TAXII 

  Show Answer

Question # 15

 The ISAC for the retail industry recently released a report regarding social engineering tactics in which small groups create distractions for employees while other malicious individuals install advanced card skimmers on the payment systems. The Chief Information Security Officer (CISO) thinks that security awareness training, technical control implementations, and governance already in place is adequate to protect from this threat. The board would like to test these controls. Which of the following should the CISO recommend? 

A. Dark web monitoring 
B. Adversary emulation engagement 
C. Supply chain risk consultation 
D. Tabletop exercises 

  Show Answer