Question 1

A security operations engineer needs to prevent inadvertent data disclosure when encrypted SSDs are reused within an enterprise. Which of the following is the most secure way to achieve this goal?

Options :

A : Executing a script that deletes and overwrites all data on the SSD three times

B : Wiping the SSD through degaussing

C : Securely deleting the encryption keys used by the SSD

D : Writing non-zero, random data to all cells of the SSD

Answer: C

Question 2

An analyst has prepared several possible solutions to a successful attack on the company. The solutions need to be implemented with the least amount of downtime. Which of the following should the analyst perform?

Options :

A :

Implement all the solutions at once in a virtual lab and then run the attack simulation. Collect the metrics and then choose the best solution based on the metrics.

B :

Implement every solution one at a time in a virtual lab, running a metric collection each time. After the collection, run the attack simulation, roll back each solution, and then implement the next. Choose the best solution based on the best metrics.

C :

Implement every solution one at a time in a virtual lab, running an attack simulation each time while collecting metrics. Roll back each solution and then implement the next. Choose the best solution based on the best metrics.

D :

Implement all the solutions at once in a virtual lab and then collect the metrics. After collection, run the attack simulation. Choose the best solution based on the best metrics.

Answer: C

Question 3

A SOC analyst is investigating an event in which a penetration tester was able to successfully create and execute a payload. The analyst pulls the following command history from the affected server

Which of the following should the analyst implement lo improve the security of the server?

Options :

A : Kernel-supported ASLR controls

B : Application controls with allow lists

C : OS restrictions of globally writable folders

D : EDR signatures that terminate specific processes

Answer: B

Question 4

After an incident occurred, a team reported during the lessons-learned review that the team.

* Lost important Information for further analysis.

* Did not utilize the chain of communication

* Did not follow the right steps for a proper response

Which of the following solutions is the best way to address these findinds?

Options :

A : Requestingbudget for better forensic tools to Improve technical capabilities for Incident response operations

B : Building playbooks for different scenarios and performing regular table-top exercises

C : Requiring professional incident response certifications tor each new team member

D : Publishing the incident response policy and enforcing it as part of the security awareness program

Answer: B

Question 5

A systems administrator wants to introduce a newly released feature for an internal application. The administrate docs not want to test the feature in the production environment. Which of the following locations is the best place to test the new feature?

Options :

A : Staging environment

B : Testing environment

C : CI/CO pipeline

D : Development environment

Answer: A

Free CAS-005 Mock Exam – Practice Online Confidently

Buying Options: