CompTIA SecurityX Certification - CAS-005 Exam Practice Test

A global organization wants to manage all endpoint and user telemetry. The organization also needs to differentiate this data based on which office it is correlated to. Which of the following strategies best aligns with this goal?

A company wants to use loT devices to manage and monitor thermostats at all facilities. The thermostats must receive vendor security updates and limit access to other devices within the organization. Which of the following best addresses the company's requirements?

A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears:
Error Message in Database Connection
Connection to host USA-WebApp-Database failed
Database "Prod-DB01" not found
Table "CustomerInfo" not found
Please retry your request later
Which of the following best describes the analyst's findings and a potential mitigation technique?

A Chief Information Security Officer (CISO) is concerned that a company's current data disposal procedures could result in data remanence. The company uses only SSDs. Which of the following would be the most secure way to dispose of the SSDs given the CISO's concern?

A company recently acquired a manufacturing plant. The acquiring company plans to create a unified network that does not impact its security posture. The manufacturing plant has been in operation for more than 30 years and has not followed an equipment replacement life cycle.
Which of the following is the best way to meet this objective?

A company updates its cloud-based services by saving infrastructure code in a remote repository.
The code is automatically deployed into the development environment every time the code is saved to the repository. The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment.
Which of the following should a security engineer recommend to reduce the deployment failures?
(Choose two.)

An auditor is reviewing the logs from a web application to determine the source of an incident.
The web application architecture includes an internet-accessible application load balancer, a number of web servers in a private subnet, application servers, and one database server in a tiered configuration. The application load balancer cannot store the logs. The following are sample log snippets:

Which of the following should the auditor recommend to ensure future incidents can be traced back to the sources?

During a security assessment, a penetration tester executed the following attack:

The tester then shared the results with the security analyst. Which of the following should the analyst do to remediate the attack?

An analyst is working to address a potential compromise of a corporate endpoint and discovers the attacker accessed a user's credentials. However, it is unclear if the system baseline was modified to achieve persistence. Which of the following would most likely support forensic activities in this scenario?

A security officer is receiving alerts from a cloud service provider about a new wave of phishing campaigns. To prepare employees, the cloud service provider advises the company to make announcements and develop basic security competence. Which of the following solutions best aligns with the cloud service provider's advice?

A security analyst collects the logs from the web server that is associated with a security incident.
The analyst finds the following entry in the logs:
SELECT user FROM Customers WHERE userID = "SRequest(userID)"
Which of the following will prevent this incident from reoccurring?

A government agency implements a configuration that disables cellular network access on government-issued devices while roaming internationally. The agency issues mobile hotspots and requires employees to use them for internet access. Which of the following best describes the agency's rationale?

A security analyst notices a number of SIEM events that show the following activity:

Which of the following response actions should the analyst take first?

A security architect discovers the following page while testing a website for vulnerabilities:
404 - page not found: /gy67162
The page you have requested is no. avai.able on .his server.
Apache Tomcat 7.0.52
Which of the following best describes why this issue should be corrected?