Jun-2024 CompTIA CAS-004 Actual Questions and Braindumps [Q30-Q44]

QUESTION 30
A company’s product site recently had failed API calls, resulting in customers being unable to check out and purchase products. This type of failure could lead to the loss of customers and damage to the company’s reputation in the market.
Which of the following should the company implement to address the risk of system unavailability?

QUESTION 31
A security analyst is reviewing a new IOC in which data is injected into an online process. The IOC shows the data injection could happen in the following ways:
* Five numerical digits followed by a dash, followed by four numerical digits; or
* Five numerical digits
When one of these IOCs is identified, the online process stops working. Which of the following regular expressions should be implemented in the NIPS?

QUESTION 32
A cybersecurity analyst created the following tables to help determine the maximum budget amount the business can justify spending on an improved email filtering system:


Which of the following meets the budget needs of the business?

QUESTION 33
A security analyst is reviewing the following output:

Which of the following would BEST mitigate this type of attack?

QUESTION 34
A Chief Information Officer is considering migrating all company data to the cloud to save money on expensive SAN storage.
Which of the following is a security concern that will MOST likely need to be addressed during migration?

QUESTION 35
A security analyst discovered that a database administrator’s workstation was compromised by malware. After examining the Jogs. the compromised workstation was observed connecting to multiple databases through ODBC. The following query behavior was captured:

Assuming this query was used to acquire and exfiltrate data, which of the following types of data was compromised, and what steps should the incident response plan contain?
A) Personal health information: Inform the human resources department of the breach and review the DLP logs.
) Account history; Inform the relationship managers of the breach and create new accounts for the affected users.
C) Customer IDs: Inform the customer service department of the breach and work to change the account numbers.
D) PAN: Inform the legal department of the breach and look for this data in dark web monitoring.

QUESTION 36
An organization designs and develops safety-critical embedded firmware (inclusive of embedded OS and services) for the automotive industry.
The organization has taken great care to exercise secure software development practices for the firmware Of paramount importance is the ability to defeat attacks aimed at replacing or corrupting running firmware once the vehicle leaves production and is in the field Integrating, which of the following host and OS controls would BEST protect against this threat?

QUESTION 37
A security analyst needs to recommend a remediation to the following threat:

Which of the following actions should the security analyst propose to prevent this successful exploitation?

QUESTION 38
A security is assisting the marketing department with ensuring the security of the organization’s social media platforms. The two main concerns are:
The Chief marketing officer (CMO) email is being used department wide as the username The password has been shared within the department Which of the following controls would be BEST for the analyst to recommend?

QUESTION 39
A security engineer has implemented an internal user access review tool so service teams can baseline user accounts and group memberships. The tool is functional and popular among its initial set of onboarded teams. However, the tool has not been built to cater to a broader set of internal teams yet. The engineer has sought feedback from internal stakeholders, and a list of summarized requirements is as follows:
The tool needs to be responsive so service teams can query it, and

then perform an automated response action.
The tool needs to be resilient to outages so service teams can perform

the user access review at any point in time and meet their own SLAs.
The tool will become the system-of-record for approval, reapproval,

and removal life cycles of group memberships and must allow for data
retrieval after failure.
Which of the following need specific attention to meet the requirements listed above? (Choose three.)

QUESTION 40
A security engineer discovers a PC may have been breached and accessed by an outside agent.
The engineer wants to find out how this breach occurred before remediating the damage.
Which of the following should the security engineer do FIRST to begin this investigation?

QUESTION 41
An multinational organization was hacked, and the incident response team’s timely action prevented a major disaster Following the event, the team created an after action report. Which of the following is the primary goal of an after action review?

QUESTION 42
A security architect updated the security policy to require a proper way to verify that packets received between two parties have not been tampered with and the connection remains private. Which of the following cryptographic techniques can be used to ensure the security policy is being enforced properly?

QUESTION 43
A company is preparing to deploy a global service.
Which of the following must the company do to ensure GDPR compliance? (Choose two.)

QUESTION 44
Which of the following is record-level encryption commonly used to do?