Online Access Free CompTIA.CAS-005.v2025-03-05.q137 Practice Test (Page 11)

CAS-005 Exam Question 46

A network engineer must ensure that always-on VPN access is enabled Curt restricted to company assets Which of the following best describes what the engineer needs to do''

A.Generate device certificates using the specific template settings needed

B.Modify signing certificates in order to support IKE version 2

C.Create a wildcard certificate for connections from public networks

D.Add the VPN hostname as a SAN entry on the root certificate

CAS-005 Exam Question 47

Company A acquired Company B and needs to determine how the acquisition will impact the attack surface of the organization as a whole. Which of the following is the best way to achieve this goal? (Select two).
Implementing DLP controls preventing sensitive data from leaving Company B's network

A.Documenting third-party connections used by Company B

B.Reviewing the privacy policies currently adopted by Company B

C.Requiring data sensitivity labeling tor all files shared with Company B

D.Forcing a password reset requiring more stringent passwords for users on Company B's network

E.Performing an architectural review of Company B's network

CAS-005 Exam Question 48

After several companies in the financial industry were affected by a similar incident, they shared information about threat intelligence and the malware used for exploitation. Which of the following should the companies do to best identify whether the attacks are being conducted by the same actor? (Choose two.)

A.Verify malware hashes.

B.Apply code stylometry.

C.Use IoC extractions.

D.Leverage malware detonation.

E.Perform malware decompilation.

F.Look for common TTPs.

CAS-005 Exam Question 49

A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed

Which of the following is the best action for the security analyst to take?

A.Block messages from hr-saas.com because it is not a recognized domain.

B.Reroute all messages with unusual security warning notices to the IT administrator

C.Quarantine all messages with sales-mail.com in the email header

D.Block vendor com for repeated attempts to send suspicious messages

Correct Answer: D

In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here's the analysis of the options provided:
A . Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking.
B . Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages.
C . Quarantine all messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails.
D . Block vendor com for repeated attempts to send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.
Reference:
CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity.
NIST Special Publication 800-45 Version 2, "Guidelines on Electronic Mail Security": Provides guidelines on email security, including the management of suspicious email domains.
"Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft" by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent offenders.
By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.

CAS-005 Exam Question 50