Reliable CompTIA CASP CAS-005 Dumps PDF Jul 16, 2025 Recently Updated Questions
Pass Your CompTIA CAS-005 Exam with Correct 200 Questions and Answers
NEW QUESTION # 45
A systems engineer is configuring a system baseline for servers that will provide email services. As part of the architecture design, the engineer needs to improve performance of the systems by using an access vector cache, facilitating mandatory access control and protecting against:
* Unauthorized reading and modification of data and programs
* Bypassing application security mechanisms
* Privilege escalation
* interference with other processes
Which of the following is the most appropriate for the engineer to deploy?
- A. Privileged access management
- B. SELinux
- C. NIPS
- D. Self-encrypting disks
Answer: B
Explanation:
The most appropriate solution for the systems engineer to deploy is SELinux (Security-Enhanced Linux).
Here's why:
* Mandatory Access Control (MAC): SELinux enforces MAC policies, ensuring that only authorized users and processes can access specific resources. This helps in preventing unauthorized reading and modification of data and programs.
* Access Vector Cache: SELinux utilizes an access vector cache (AVC) to improve performance. The AVC caches access decisions, reducing the need for repetitive policy lookups and thus improving system efficiency.
* Security Mechanisms: SELinux provides a robust framework to enforce security policies and prevent bypassing of application security mechanisms. It controls access based on defined policies, ensuring that security measures are consistently applied.
* Privilege Escalation and Process Interference: SELinux limits the ability of processes to escalate privileges and interfere with each other by enforcing strict access controls. This containment helps in isolating processes and minimizing the risk of privilege escalation attacks.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NSA's Guide to the Secure Configuration of Red Hat Enterprise Linux 5 (SELinux)
* NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 46
A company hired an email service provider called my-email.com to deliver company emails. The company started having several issues during the migration. A security engineer is troubleshooting and observes the following configuration snippet:
Which of the following should the security engineer modify to fix the issue? (Choose two.)
- A. The TXT record must be Changed to "v=dmarc ip4:192.168.1.10 include:my-email.com -all"
- B. The srvo1 A record must be changed to a type CNAME record pointing to the email server
- C. The email CNAME record must be changed to a type A record pointing to 192.168.1.10
- D. The TXT record must be Changed to "v=dkim ip4:192.168.1.10 include:email-all"
- E. The TXT record must be changed to "v=dkim ip4:l92.168.1.11 include my-email.com -ell"
- F. The email CNAME record must be changed to a type A record pointing to 192.168.1.11
- G. The srv01 A record must be changed to a type CNAME record pointing to the web01 server
Answer: A,C
Explanation:
The security engineer should modify the following to fix the email migration issues:
Email CNAME Record: The email CNAME record must be changed to a type A record pointing to
192.168.1.10. This is because CNAME records should not be used where an IP address (A record) is required. Changing it to an A record ensures direct pointing to the correct IP.
TXT Record for DMARC: The TXT record must be changed to "v=dmarc ip4:192.168.1.10 include .com -all". This ensures proper configuration of DMARC (Domain-based Message Authentication, Reporting & Conformance) to include the correct IP address and the email service provider domain.
DMARC: Ensuring the DMARC record is correctly set up helps in preventing email spoofing and phishing, aligning with email security best practices.
NEW QUESTION # 47
A security review revealed that not all of the client proxy traffic is being captured. Which of the following architectural changes best enables the capture of traffic for analysis?
- A. Enabling client device logging and system event auditing
- B. Adding an additional proxy server to each segmented VLAN
- C. Setting up a reverse proxy for client logging at the gateway
- D. Configuring a span port on the perimeter firewall to ingest logs
Answer: D
Explanation:
Configuring a span port on the perimeter firewall to ingest logs is the best architectural change to ensure that all client proxy traffic is captured for analysis.
Comprehensive Traffic Capture: A span port (or mirror port) on the perimeter firewall can capture all inbound and outbound traffic, including traffic that might bypass the proxy. This ensures that all network traffic is available for analysis.
Centralized Logging: By capturing logs at the perimeter firewall, the organization can centralize logging and analysis, making it easier to detect and investigate anomalies.
Minimal Disruption: Implementing a span port is a non-intrusive method that does not require significant changes to the network architecture, thus minimizing disruption to existing services.
NEW QUESTION # 48
A company lined an email service provider called my-email.com to deliver company emails. The company stalled having several issues during the migration. A security engineer is troubleshooting and observes the following configuration snippet:
Which of the following should the security engineer modify to fix the issue? (Select two).
- A. The TXT record must be Changed to "v=dmarc ip4:192.168.1.10 include:my-email.com -all"
- B. The srvo1 A record must be changed to a type CNAME record pointing to the email server
- C. The email CNAME record must be changed to a type A record pointing to 192.168.1.10
- D. The TXT record must be Changed to "v=dkim ip4:192.168.1.10 include:email-all"
- E. The TXT record must be changed to "v=dkim ip4:l92.168.1.11 include my-email.com -ell"
- F. The srv01 A record must be changed to a type CNAME record pointing to the web01 server
- G. The email CNAME record must be changed to a type A record pointing to 192.168.111
Answer: A,C
Explanation:
The security engineer should modify the following to fix the email migration issues:
Email CNAME Record: The email CNAME record must be changed to a type A record pointing to
192.168.1.10. This is because CNAME records should not be used where an IP address (A record) is required.
Changing it to an A record ensures direct pointing to the correct IP.
TXT Record for DMARC: The TXT record must be changed to "v=dmarc ip4:192.168.1.10 include com -all". This ensures proper configuration of DMARC (Domain-based Message Authentication, Reporting
& Conformance) to include the correct IP address and the email service provider domain.
DMARC: Ensuring the DMARC record is correctly set up helps in preventing email spoofing and phishing, aligning with email security best practices.
NEW QUESTION # 49
SIMULATION
You are a security analyst tasked with interpreting an Nmap scan output from company's privileged network.
The company's hardening guidelines indicate the following:
- There should be one primary server or service per device.
- Only default ports should be used.
- Non-secure protocols should be disabled.
INSTRUCTIONS
Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed.
For each device found by Nmap, add a device entry to the Devices Discovered list, with the following information:
- The IP address of the device
- The primary server or service of the device (Note that each IP should by associated with one service/port only)
- The protocol(s) that should be disabled based on the hardening guidelines (Note that multiple ports may need to be closed to comply with the hardening guidelines) If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
10.1.45.65 SFTP Server Disable 8080
10.1.45.66 Email Server Disable 415 and 443
10.1.45.67 Web Server Disable 21, 80
10.1.45.68 UTM Appliance Disable 21
NEW QUESTION # 50
A company is having issues with its vulnerability management program New devices/lPs are added and dropped regularly, making the vulnerability report inconsistent. Which of the following actions should the company lake to most likely improve the vulnerability management process?
- A. Perform regular discovery scanning throughout the 11 landscape using the vulnerability management tool
- B. Implement a shadow IT detection process to avoid rogue devices on the network
- C. Request a weekly report with all new assets deployed and decommissioned
- D. Extend the DHCP lease lime to allow the devices to remain with the same address for a longer period.
Answer: A
Explanation:
To improve the vulnerability management process in an environment where new devices/IPs are added and dropped regularly, the company should perform regular discovery scanning throughout the IT landscape using the vulnerability management tool.
Accurate Asset Inventory: Regular discovery scans help maintain an up-to-date inventory of all assets, ensuring that the vulnerability management process includes all relevant devices and IPs.
Consistency in Reporting: By continuously discovering and scanning new and existing assets, the company can generate consistent and comprehensive vulnerability reports that reflect the current state of the network.
Proactive Management: Regular scans enable the organization to proactively identify and address vulnerabilities on new and existing assets, reducing the window of exposure to potential threats.
NEW QUESTION # 51 
Which of the following is the security engineer most likely doing?
- A. Reporting on remote log-in activities to track team metrics
- B. Baselining user behavior to support advanced analytics
- C. Threat hunting for suspicious activity from an insider threat
- D. Assessing log in activities using geolocation to tune impossible Travel rate alerts
Answer: D
Explanation:
In the given scenario, the security engineer is likely examining login activities and their associated geolocations. This type of analysis is aimed at identifying unusual login patterns that might indicate an impossible travel scenario. An impossible travel scenario is when a single user account logs in from geographically distant locations in a short time, which is physically impossible. By assessing login activities using geolocation, the engineer can tune alerts to identify and respond to potential security breaches more effectively.
NEW QUESTION # 52
A company's security policy states that any publicly available server must be patched within 12 hours after a patch is released A recent llS zero-day vulnerability was discovered that affects all versions of the Windows Server OS:
Which of the following hosts should a security analyst patch first once a patch is available?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
- F. 5
Answer: B
Explanation:
Based on the security policy that any publicly available server must be patched within 12 hours after a patch is released, the security analyst should patch Host 1 first. Here's why:
* Public Availability: Host 1 is externally available, making it accessible from the internet. Publicly available servers are at higher risk of being targeted by attackers, especially when a zero-day vulnerability is known.
* Exposure to Threats: Host 1 has IIS installed and is publicly accessible, increasing its exposure to potential exploitation. Patching this host first reduces the risk of a successful attack.
* Prioritization of Critical Assets: According to best practices, assets that are exposed to higher risks should be prioritized for patching to mitigate potential threats promptly.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-40: Guide to Enterprise Patch Management Technologies
* CIS Controls: Control 3 - Continuous Vulnerability Management
NEW QUESTION # 53
PKI can be used to support security requirements in the change management process. Which of the following capabilities does PKI provide for messages?
- A. Confidentiality
- B. Non-repudiation
- C. Delivery receipts
- D. Attestation
Answer: B
Explanation:
Public Key Infrastructure (PKI) supports change management by securing messages (e.g., approvals, updates).
Non-repudiation, provided via digital signatures, ensures a sender cannot deny sending a message, critical for auditability in change processes.
* Option A:Correct-PKI's digital signatures ensure non-repudiation.
* Option B:Confidentiality (via encryption) is a PKI feature but less tied to change management's focus on accountability.
* Option C:Delivery receipts are not a PKI function; they're protocol-specific (e.g., SMTP).
* Option D:Attestation relates to verifying attributes, not a direct PKI message capability.
NEW QUESTION # 54
A global organization wants to manage all endpoint and user telemetry. The organization also needs to differentiate this data based on which office it is correlated to. Which of the following strategies best aligns with this goal?
- A. Centralized logging
- B. Sensor placement
- C. Continuous monitoring
- D. Data labeling
Answer: D
Explanation:
Comprehensive and Detailed
Managing telemetry and differentiating it by office requires a way to categorize data. Let's evaluate:
A . Sensor placement: Useful for data collection but doesn't inherently differentiate by office.
B . Data labeling: Assigns metadata (e.g., office location) to telemetry, enabling differentiation. This aligns with CAS-005's focus on data management for security operations.
C . Continuous monitoring: Ensures ongoing data collection but doesn't address differentiation.
D . Centralized logging: Consolidates data but lacks specific office-based categorization without labeling.
NEW QUESTION # 55
An organization mat performs real-time financial processing is implementing a new backup solution Given the following business requirements?
* The backup solution must reduce the risk for potential backup compromise
* The backup solution must be resilient to a ransomware attack.
* The time to restore from backups is less important than the backup data integrity
* Multiple copies of production data must be maintained
Which of the following backup strategies best meets these requirement?
- A. Setting up antitempering on the databases to ensure data cannot be changed unintentionally
- B. Enabling remote journaling on the databases to ensure real-time transactions are mirrored
- C. Creating a secondary, immutable storage array and updating it with live data on a continuous basis
- D. Utilizing two connected storage arrays and ensuring the arrays constantly sync
Answer: C
Explanation:
A: Creating a secondary, immutable storage array and updating it with live data on a continuous basis: An immutable storage array ensures that data, once written, cannot be altered or deleted. This greatly reduces the risk of backup compromise and provides resilience against ransomware attacks, as the ransomware cannot modify or delete the backup data. Maintaining multiple copies of production data with an immutable storage solution ensures data integrity and compliance with the requirement for multiple copies.
Other options:
B: Utilizing two connected storage arrays and ensuring the arrays constantly sync: While this ensures data redundancy, it does not provide protection against ransomware attacks, as both arrays could be compromised simultaneously.
C: Enabling remote journaling on the databases: This ensures real-time transaction mirroring but does not address the requirement for reducing the risk of backup compromise or resilience to ransomware.
D: Setting up anti-tampering on the databases: While this helps ensure data integrity, it does not provide a comprehensive backup solution that meets all the specified requirements.
NEW QUESTION # 56
A security analyst wants to use lessons learned from a poor incident response to reduce dwell lime in the future The analyst is using the following data points
Which of the following would the analyst most likely recommend?
- A. Enabling alerting on all suspicious administrator behavior
- B. Adjusting the SIEM to alert on attempts to visit phishing sites
- C. utilizing allow lists on the WAF for all users using GFT methods
- D. Allowing TRACE method traffic to enable better log correlation
Answer: A
Explanation:
In the context of improving incident response and reducing dwell time, the security analyst needs to focus on proactive measures that can quickly detect and alert on potential security breaches. Here's a detailed analysis of the options provided:
A: Adjusting the SIEM to alert on attempts to visit phishing sites: While this is a useful measure to prevent phishing attacks, it primarily addresses external threats and doesn't directly impact dwell time reduction, which focuses on the time a threat remains undetected within a network.
B: Allowing TRACE method traffic to enable better log correlation: The TRACE method in HTTP is used for debugging purposes, but enabling it can introduce security vulnerabilities. It's not typically recommended for enhancing security monitoring or incident response.
C: Enabling alerting on all suspicious administrator behavior: This option directly targets the potential misuse of administrator accounts, which are often high-value targets for attackers. By monitoring and alerting on suspicious activities from admin accounts, the organization can quickly identify and respond to potential breaches, thereby reducing dwell time significantly. Suspicious behavior could include unusual login times, access to sensitive data not usually accessed by the admin, or any deviation from normal behavior patterns.
This proactive monitoring is crucial for quick detection and response, aligning well with best practices in incident response.
D: Utilizing allow lists on the WAF for all users using GET methods: This measure is aimed at restricting access based on allowed lists, which can be effective in preventing unauthorized access but doesn't specifically address the need for quick detection and response to internal threats.
References:
* CompTIA SecurityX Study Guide: Emphasizes the importance of monitoring and alerting on admin activities as part of a robust incident response plan.
* NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide": Highlights best practices for incident response, including the importance of detecting and responding to suspicious activities quickly.
* "Incident Response & Computer Forensics" by Jason T. Luttgens, Matthew Pepe, and Kevin Mandia:
Discusses techniques for reducing dwell time through effective monitoring and alerting mechanisms, particularly focusing on privileged account activities.
By focusing on enabling alerting for suspicious administrator behavior, the security analyst addresses a critical area that can help reduce the time a threat goes undetected, thereby improving the overall security posture of the organization.
Top of Form
Bottom of Form
NEW QUESTION # 57
A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed
Which of the following is the best action for the security analyst to take?
- A. Block vendor com for repeated attempts to send suspicious messages
- B. Quarantine all messages with sales-mail.com in the email header
- C. Block messages from hr-saas.com because it is not a recognized domain.
- D. Reroute all messages with unusual security warning notices to the IT administrator
Answer: A
Explanation:
In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here's the analysis of the options provided:
A . Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking.
B . Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages.
C . Quarantine all messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails.
D . Block vendor com for repeated attempts to send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.
Reference:
CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity.
NIST Special Publication 800-45 Version 2, "Guidelines on Electronic Mail Security": Provides guidelines on email security, including the management of suspicious email domains.
"Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft" by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent offenders.
By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.
NEW QUESTION # 58
A systems administrator needs to address risks associated with corporate brand impersonation via email. The systems administrator wants a method that permits recipient servers to validate the source authenticity of emails received. Which of the following is the most appropriate?
- A. SPF
- B. DKIM
- C. S/MIME
- D. DMARC
Answer: B
NEW QUESTION # 59
An organization recently acquired another company that is running a different EDR solution. A SOC analyst wants to automate the isolation of endpoints that are found to be compromised.
Which of the following workflows best mitigates the risk of false positives and reduces the spread of malicious code?
- A. Reviewing all alerts manually in the various portals and taking action to isolate them
- B. Setting a policy on each EDR management console to isolate all endpoints that trigger any alerts
- C. Automating the suppression of all alerts that are not critical and sending an email asking SOC analysts to review these alerts
- D. Using a SOAR solution to look up entities via a TIP platform and isolate endpoints via APIs
Answer: D
NEW QUESTION # 60
A news organization wants to implement workflows that allow users to request that untruthful data be retraced and scrubbed from online publications to comply with the right to be forgotten Which of the following regulations is the organization most likely trying to address'
- A. DORA
- B. GDPR
- C. COPPA
- D. CCPA
Answer: B
Explanation:
The General Data Protection Regulation (GDPR) is the regulation most likely being addressed by the news organization. GDPR includes provisions for the "right to be forgotten," which allows individuals to request the deletion of personal data that is no longer necessary for the purposes for which it was collected. This regulation aims to protect the privacy and personal data of individuals within the European Union.
Reference:
CompTIA SecurityX Study Guide: Covers GDPR and its requirements, including the right to be forgotten.
GDPR official documentation: Details the rights of individuals, including data erasure and the right to be forgotten.
"GDPR: A Practical Guide to the General Data Protection Regulation" by IT Governance Privacy Team: Provides a comprehensive overview of GDPR compliance, including workflows for data deletion requests.
NEW QUESTION # 61
A company hosts a platform-as-a-service solution with a web-based front end, through which customer interact with data sets. A security administrator needs to deploy controls to prevent application-focused attacks. Which of the following most directly supports the administrator's objective?
- A. Creating WAF policies for relevant programming languages
- B. Rotating API access and authorization keys every two months
- C. Implementing application toad balancing and cross-region availability
- D. improving security dashboard visualization on SIEM
Answer: A
Explanation:
The best way to prevent application-focused attacks for a platform-as-a-service solution with a web- based front end is to create Web Application Firewall (WAF) policies for relevant programming languages.
Application-Focused Attack Prevention: WAFs are designed to protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. They help prevent attacks such as SQL injection, cross-site scripting (XSS), and other application-layer attacks.
Customizable Rules: WAF policies can be tailored to the specific programming languages and frameworks used by the web application, providing targeted protection based on known vulnerabilities and attack patterns.
Real-Time Protection: WAFs provide real-time protection, blocking malicious requests before they reach the application, thereby enhancing the security posture of the platform.
NEW QUESTION # 62
A security analyst is reviewing suspicious log-in activity and sees the following data in the SICM:
Which of the following is the most appropriate action for the analyst to take?
- A. implement automation to disable accounts that nave been associated with high-risk activity.
- B. Block employees from logging in to applications that are not part of their business area.
- C. Have the admin account owner change their password to avoid credential stuffing.
- D. Update the log configuration settings on the directory server that Is not being captured properly.
Answer: A
Explanation:
The log-in activity indicates a security threat, particularly involving the ADMIN account with a high- risk failure status. This suggests that the account may be targeted by malicious activities such as credential stuffing or brute force attacks.
NEW QUESTION # 63
Which of the following best describes the challenges associated with widespread adoption of homomorphic encryption techniques?
- A. Incomplete mathematical primitives
- B. No use cases to drive adoption
- C. Quantum computers not yet capable
- D. insufficient coprocessor support
Answer: D
Explanation:
Homomorphic encryption allows computations to be performed on encrypted data without decrypting it, providing strong privacy guarantees. However, the adoption of homomorphic encryption is challenging due to several factors:
A: Incomplete mathematical primitives: This is not the primary barrier as the theoretical foundations of homomorphic encryption are well-developed.
B: No use cases to drive adoption: There are several compelling use cases for homomorphic encryption, especially in privacy-sensitive fields like healthcare and finance.
C: Quantum computers not yet capable: Quantum computing is not directly related to the challenges of adopting homomorphic encryption.
D: Insufficient coprocessor support: The computational overhead of homomorphic encryption is significant, requiring substantial processing power. Current general-purpose processors are not optimized for the intensive computations required by homomorphic encryption, limiting its practical deployment. Specialized hardware or coprocessors designed to handle these computations more efficiently are not yet widely available.
NEW QUESTION # 64
A security analyst discovered requests associated with IP addresses known for born legitimate 3nd bot-related traffic. Which of the following should the analyst use to determine whether the requests are malicious?
- A. Byte length of the request
- B. User-agent string
- C. HTML encoding field
- D. Web application headers
Answer: B
Explanation:
The user-agent string can provide valuable information to distinguish between legitimate and bot-related traffic. It contains details about the browser, device, and sometimes the operating system of the client making the request.
Why Use User-Agent String?
Identify Patterns: User-agent strings can help identify patterns that are typical of bots or legitimate users.
Block Malicious Bots: Many bots use known user-agent strings, and identifying these can help block malicious requests.
Anomalies Detection: Anomalous user-agent strings can indicate spoofing attempts or malicious activity.
Other options provide useful information but may not be as effective for initial determination of the nature of the request:
B . Byte length of the request: This can indicate anomalies but does not provide detailed information about the client.
C . Web application headers: While useful, they may not provide enough distinction between legitimate and bot traffic.
D . HTML encoding field: This is not typically used for identifying the nature of the request.
Reference:
CompTIA SecurityX Study Guide
"User-Agent Analysis for Security," OWASP
NIST Special Publication 800-94, "Guide to Intrusion Detection and Prevention Systems (IDPS)"
NEW QUESTION # 65
A systems administrator wants to introduce a newly released feature for an internal application. The administrate docs not want to test the feature in the production environment. Which of the following locations is the best place to test the new feature?
- A. Staging environment
- B. Development environment
- C. Testing environment
- D. CI/CO pipeline
Answer: A
Explanation:
The best location to test a newly released feature for an internal application, without affecting the production environment, is the staging environment. Here's a detailed explanation:
Staging Environment: This environment closely mirrors the production environment in terms of hardware, software, configurations, and settings. It serves as a final testing ground before deploying changes to production. Testing in the staging environment ensures that the new feature will behave as expected in the actual production setup.
Isolation from Production: The staging environment is isolated from production, which means any issues arising from the new feature will not impact the live users or the integrity of the production data. This aligns with best practices in change management and risk mitigation.
Realistic Testing: Since the staging environment replicates the production environment, it provides realistic testing conditions. This helps in identifying potential issues that might not be apparent in a development or testing environment, which often have different configurations and workloads.
References:
CompTIA Security+ SY0-601 Official Study Guide by Quentin Docter, Jon Buhagiar NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 66
A security analyst is using data provided from a recent penetration test to calculate CVSS scores to prioritize remediation. Which of the following metric groups would the analyst need to determine to get the overall scores? (Select three).
- A. Confidentiality
- B. Temporal
- C. Attack vector
- D. Environmental
- E. Base
- F. Availability
- G. Integrity
- H. Impact
Answer: B,D,E
Explanation:
The Common Vulnerability Scoring System (CVSS) v3.1 uses three metric groups to calculate overall scores:
Base,Temporal, andEnvironmental.
* Base (E):Mandatory metrics assessing exploitability (e.g., attack vector) and impact (confidentiality, integrity, availability).
* Temporal (A):Optional metrics reflecting the current state of the vulnerability (e.g., exploit availability, remediation level).
* Environmental (F):Optional metrics tailoring the score to the organization's context (e.g., security requirements).
* B, C, D (Availability, Integrity, Confidentiality):These are subcomponents of the Base Impact metrics, not standalone groups.
* G (Impact):A category within Base, not a group.
* H (Attack vector):A single Base metric, not a group.
NEW QUESTION # 67
All organization is concerned about insider threats from employees who have individual access to encrypted material. Which of the following techniques best addresses this issue?
- A. SSO with MFA
- B. Sating and hashing
- C. Account federation with hardware tokens
- D. SAE
- E. Key splitting
Answer: E
Explanation:
The technique that best addresses the issue of insider threats from employees who have individual access to encrypted material is key splitting. Here's why:
* Key Splitting: Key splitting involves dividing a cryptographic key into multiple parts and distributing these parts among different individuals or systems. This ensures that no single individual has complete access to the key, thereby mitigating the risk of insider threats.
* Increased Security: By requiring multiple parties to combine their key parts to access encrypted material, key splitting provides an additional layer of security. This approach is particularly useful in environments where sensitive data needs to be protected from unauthorized access by insiders.
* Compliance and Best Practices: Key splitting aligns with best practices and regulatory requirements for handling sensitive information, ensuring that access is tightly controlled and monitored.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-57: Recommendation for Key Management
* ISO/IEC 27002:2013: Information Technology - Security Techniques - Code of Practice for Information Security Controls By employing key splitting, organizations can effectively reduce the risk of insider threats and enhance the overall security of encrypted material.
NEW QUESTION # 68
......
CompTIA CAS-005 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
Latest 2025 Realistic Verified CAS-005 Dumps: https://www.examstorrent.com/CAS-005-exam-dumps-torrent.html
Pass CAS-005 Exam Updated 200 Questions: https://drive.google.com/open?id=1hTam78x0LDBDVteemIHpDAa230_9_K_g