Free CAS-004 Exam Braindumps
CompTIA Advanced Security Practitioner (CASP+) CAS-004 Questions 306–310 (page: 63)

Updated On: 10-Feb-2026

An employee's device was missing for 96 hours before being reported. The employee called the help desk to ask for another device. Which of the following phases of the incident response cycle needs improvement?

  1. Containment
  2. Preparation
  3. Resolution
  4. Investigation

Answer(s): B



A security consultant has been asked to recommend a secure network design that would:
• Permit an existing OPC server to communicate with a new Modbus server that is controlling electrical relays.
• Limit operational disruptions.
Due to the limitations within the Modbus protocol, which of the following configurations should the security engineer recommend as part of the solution?

  1. Restrict inbound traffic so that only the OPC server is permitted to reach the Modbus server on port 135.
  2. Restrict outbound traffic so that only the OPC server is permitted to reach the Modbus server on port 102.
  3. Restrict outbound traffic so that only the OPC server is permitted to reach the Modbus server on port 5000.
  4. Restrict inbound traffic so that only the OPC server is permitted to reach the Modbus server on port 502.

Answer(s): D



A forensic investigator started the process of gathering evidence on a laptop in response to an incident. The investigator took a snapshot of the hard drive, copied relevant log files, and then performed a memory dump. Which of the following steps in the process should have occurred FIRST?

  1. Preserve secure storage.
  2. Clone the disk.
  3. Collect the most volatile data.
  4. Copy the relevant log files.

Answer(s): C



A company is designing a new system that must have high security. This new system has the following requirements:
• Permissions must be assigned based on role.
• Fraud from a single person must be prevented.
• A single entity must not have full access control.
Which of the following can the company use to meet these requirements?

  1. Dual responsibility
  2. Separation of duties
  3. Need to know
  4. Least privilege

Answer(s): B



A Chief Security Officer (CSO) is concerned about the number of successful ransomware attacks that have hit the company. The data indicates most of the attacks came through a fake email. The company has added training, and the CSO now wants to evaluate whether the training has been successful. Which of the following should the CSO implement?

  1. Simulating a spam campaign
  2. Conducting a sanctioned vishing attack
  3. Performing a risk assessment
  4. Executing a penetration test

Answer(s): A



Viewing page 63 of 127
Viewing questions 311 - 315 out of 645 questions


Post your Comments and Discuss CompTIA CAS-004 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!