Question 1

After an incident occurred, a team reported during the lessons-learned review that the team.

* Lost important Information for further analysis.

* Did not utilize the chain of communication

* Did not follow the right steps for a proper response

Which of the following solutions is the best way to address these findinds?

Options :

A : Requestingbudget for better forensic tools to Improve technical capabilities for Incident response operations

B : Building playbooks for different scenarios and performing regular table-top exercises

C : Requiring professional incident response certifications tor each new team member

D : Publishing the incident response policy and enforcing it as part of the security awareness program

Answer: B

Question 2

A user tried to access a web page at http://10.1.1.1. Previously the web page did not require authentication, and now the browser is prompting for credentials. Which of the following actions would best prevent the issue from reoccurring and reduce the likelihood of credential exposure?

Options :

A : Implementing 802.1x EAP-TTLS on access points to reduce the risk of evil twins

B : Transitioning internal services to use DNS security

C : Modifying web server configuration and utilizing X509 certificates for authentication

D : Installing new rules for the IDS to detect impersonation attacks

Answer: C

Question 3

During a recentsecurity event, access from thenon-production environment to the production

environmentenabledunauthorized usersto:

Installunapproved software

Makeunplanned configuration changes

During theinvestigation, the following findings were identified:

Several new users were added in bulkby theIAM team

Additionalfirewalls and routerswere recently added

Vulnerability assessmentshave been disabled formore than 30 days

Theapplication allow listhas not been modified intwo weeks

Logs were unavailablefor various types of traffic

Endpoints have not been patchedinover ten days

Which of the following actions would most likely need to be taken toensure proper monitoring?(Select two)

Options :

A : Disable bulk user creationsby the IAM team

B : Extend log retention for all security and network devices to180 daysfor all traffic

C : Review the application allow listdaily

D : Routinely update allendpoints and network devicesas soon as new patches/hot fixes are available

E : Ensure allnetwork and security devicesare sending relevant data to theSIEM

F : Configure firewall rules toonly allow production-to-non-productiontraffic

Answer: A,D,E

Question 4

A developer makes a small change to a resource allocation module on a popular social media website and causes a memory leak. During a peak utilization period, several web servers crash, causing the website to go offline. Which of the following testing techniques is the most efficient way to prevent this from reoccurring?

Options :

A : Load

B : Smoke

C : Regression

D : Canary

Answer: C

Question 5

A subcontractor develops safety critical avionics software for a major aircraft manufacturer. After an incident, a third-party investigator recommends the company begin to employ formal methods in the development life cycle. Which of the following findings from the investigation most directly supports the investigator's recommendation?

Options :

A : The system's bill of materials failed to include commercial and open-source libraries.

B : The company lacks dynamic and Interactive application security testing standards.

C : The codebase lacks traceability to functional and non-functional requirements.

D : The implemented software inefficiently manages compute and memory resources.

Answer: C

Free CAS-005 Mock Exam – Practice Online Confidently

Buying Options: