Online Access Free CAS-003 Exam Questions

An organization's email filler is an ineffective control and as a result employees have been constantly receiving phishing emails. As part of a security incident investigation a security analyst identifies the following:
1 An employee was working remotely when the security alert was triggered
2 An employee visited a number of uncategorized internet sites
3 A doc file was downloaded
4 A number of files were uploaded to an unknown collaboration site
Which of the following controls would provide the security analyst with more data to identify the root cause of the issue and protect the organization's information during future incidents?

• A.EDR and DLP
• B.HIPS and application whitelisting
• C.FIM and antivirus
• D.DAM and MFA

An organization is implementing a virtualized thin-client solution for normal user computing and access. During a review of the architecture, concerns were raised that an attacker could gain access to multiple user environments by simply gaining a foothold on a single one with malware. Which of the following reasons BEST explains this?

• A.Malware on one virtual environment could enable pivoting to others by leveraging vulnerabilities in the hypervisor.
• B.Malware on one virtual user environment could be copied to all others by the attached network storage controller.
• C.A worm on one virtual environment could spread to others by taking advantage of guest OS networking services vulnerabilities.
• D.One virtual environment may have one or more application-layer vulnerabilities, which could allow an attacker to escape that environment.

An enterprise with global sites processes and exchanges highly sensitive information that is protected under several countries' arms trafficking laws. There is new information that malicious nation-state-sponsored activities are targeting the use of encryption between the geographically disparate sites. The organization currently employs ECDSA and ECDH with P-384, SHA-384, and AES-256-GCM on VPNs between sites.
Which of the following techniques would MOST likely improve the resilience of the enterprise to attack on cryptographic implementation?

• A.Use a stronger elliptic curve cryptography algorithm.
• B.Ensure cryptography modules are kept up to date from vendor supplying them.
• C.Upgrade the cipher suite to use an authenticated AES mode of operation.
• D.Add a second-layer VPN from a different vendor between sites.
• E.Implement an IDS with sensors inside (clear-text) and outside (cipher-text) of each tunnel between sites.

A security analyst has been asked to create a list of external IT security concerns, which are applicable to the organization. The intent is to show the different types of external actors, their attack vectors, and the types of vulnerabilities that would cause business impact. The Chief Information Security Officer (CISO) will then present this list to the board to request funding for controls in areas that have insufficient coverage.
Which of the following exercise types should the analyst perform?

• A.Undertake an external vulnerability scan and penetration test.
• B.Research industry best practices and latest RFCs.
• C.Summarize the most recently disclosed vulnerabilities.
• D.Conduct a threat modeling exercise.

An analyst is investigating behavior on a corporate-owned, corporate-managed mobile device with application whitelisting enabled, based on a name string. The employee to whom the device is assigned reports the approved email client is displaying warning messages that can launch browser windows and is adding unrecognized email addresses to the "compose" window.
Which of the following would provide the analyst the BEST chance of understanding and characterizing the malicious behavior?

• A.Change to a whitelist that uses cryptographic hashing.
• B.Perform static code analysis on the source code.
• C.Penetration test the mobile application.
• D.Analyze the device firmware via the JTAG interface.
• E.Reverse engineer the application binary.