CAS-004 Exam Question 41
Due to budget constraints, an organization created a policy that only permits vulnerabilities rated high and critical according to CVSS to be fixed or mitigated. A security analyst notices that many vulnerabilities that were previously scored as medium are now breaching higher thresholds. Upon further investigation, the analyst notices certain ratings are not aligned with the approved system categorization. Which of the following can the analyst do to get a better picture of the risk while adhering to the organization's policy?
CAS-004 Exam Question 42
Company A acquired Company B. During an initial assessment, the companies discover they are using the same SSO system. To help users with the transition, Company A is requiring the following:
* Before the merger is complete, users from both companies should use a single set of usernames and passwords.
* Users in the same departments should have the same set of rights and privileges, but they should have different sets of rights and privileges if they have different IPs.
* Users from Company B should be able to access Company A's available resources.
Which of the following are the BEST solutions? (Select TWO).
* Before the merger is complete, users from both companies should use a single set of usernames and passwords.
* Users in the same departments should have the same set of rights and privileges, but they should have different sets of rights and privileges if they have different IPs.
* Users from Company B should be able to access Company A's available resources.
Which of the following are the BEST solutions? (Select TWO).
CAS-004 Exam Question 43
An organization's hunt team thinks a persistent threats exists and already has a foothold in the enterprise network.
Which of the following techniques would be BEST for the hunt team to use to entice the adversary to uncover malicious activity?
Which of the following techniques would be BEST for the hunt team to use to entice the adversary to uncover malicious activity?
CAS-004 Exam Question 44
A vulnerability scanner detected an obsolete version of an open-source file-sharing application on one of a company's Linux servers. While the software version is no longer supported by the OSS community, the company's Linux vendor backported fixes, applied them for all current vulnerabilities, and agrees to support the software in the future.
Based on this agreement, this finding is BEST categorized as a:
Based on this agreement, this finding is BEST categorized as a:
CAS-004 Exam Question 45
A small company needs to reduce its operating costs. vendors have proposed solutions, which all focus on management of the company's website and services. The Chief information Security Officer (CISO) insist all available resources in the proposal must be dedicated, but managing a private cloud is not an option. Which of the following is the BEST solution for this company?