A security engineer is working for a service provider and analyzing logs and reports from a new EDR solution, which is installed on a small group of workstations. Later that day, another security engineer receives an email from two developers reporting the software being used for development activities is now blocked. The developers have not made any changes to the software being used. Which of the following is the EDR reporting?
Answer(s): C
An organization has just been breached, and the attacker is exfiltrating data from workstations. The security analyst validates this information with the firewall logs and must stop the activity immediately. Which of the following steps should the security analyst perform NEXT?
A security architect is analyzing an old application that is not covered for maintenance anymore because the software company is no longer in business. Which of the following techniques should have been implemented to prevent these types of risks?
Answer(s): D
A company has decided that only administrators are permitted to use PowerShell on their Windows computers. Which of the following is the BEST way for an administrator to implement this decision?
A recent security audit identified multiple endpoints have the following vulnerabilities:• Various unsecured open ports• Active accounts for terminated personnel• Endpoint protection software with legacy versions• Overly permissive access rulesWhich of the following would BEST mitigate these risks? (Choose three).
Answer(s): D,E,G
Post your Comments and Discuss CompTIA CAS-004 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-004 content, but please register or login to continue.