A security architect recommends replacing the company's monolithic software application with a containerized solution. Historically, secrets have been stored in the application's configuration files. Which of the following changes should the security architect make in the new system?
Answer(s): A
A secrets management tool is the most appropriate solution for securely managing and storing secrets (such as API keys, passwords, or tokens) in the new containerized environment. Secrets management tools, such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault, provide secure storage, access control, and audit logs for secrets. They are designed to manage secrets in a way that avoids hardcoding sensitive data in configuration files or Dockerfiles, which could be exposed or compromised.
A security engineer is assessing a new tool to segment data and communications between domains. The assessment must determine how data transmission controls can be bypassed without detection. Which of the following techniques should the security engineer use?
Answer(s): C
Covert channel analysis is the technique best suited for assessing how data transmission controls can be bypassed without detection. Covert channels involve using a system or communication protocol in unintended ways to transmit data secretly. This analysis helps identify potential hidden channels that might bypass security controls and allow unauthorized communication between domains.
During an adversarial simulation exercise, an external team was able to gain access to sensitive information and systems without the organization detecting this activity. Which of the following mitigation strategies should the organization use to best resolve the findings?
Answer(s): D
Utilizing decoy accounts and documents (often referred to as honeytokens) is the best mitigation strategy in this scenario. Decoy accounts and documents are designed to look like legitimate, sensitive data or systems, but they are actually trapping. If an adversary accesses these decoys, it can trigger alerts and give the organization an early warning of the intrusion. This helps the organization detect unauthorized access more quickly and provides the opportunity to respond before actual damage is done.
A help desk technician is troubleshooting an issue with an employee's laptop that will not boot into its operating system. The employee reported the laptop had been stolen but then found it one day later. The employee has asked the technician for help recovering important data. The technician has identified the following:The laptop operating system was not configured with BitLocker.The hard drive has no hardware failures.Data is present and readable on the hard drive, although it appears to be illegible.Which of the following is the most likely reason the technician is unable to retrieve legible data from the hard drive?
Crypto-shredding is the most likely reason the technician is unable to retrieve legible data from the hard drive.Crypto-shredding occurs when the encryption keys used to access data are deleted or destroyed, making the data unreadable. In this case, it is possible that the hard drive was encrypted (either through BitLocker or another encryption method) and the keys were deleted after the laptop was stolen, rendering the data inaccessible and illegible without the correct keys.
SIMULATIONYou are about to enter the virtual environment.DO NOT perform the following actions within the virtual environment. Making any of these changes will cause the virtual environment to fail and prevent proper scoring.1. Disable ssh2. Disable systemd3. Alter the network adapter 172.162.0.04. Change the password on the lab admin account5. Reboot the machineOnce you have completed the item in the virtual environment, you will NOT be allowed to return to this item.TEST QUESTIONThis system was recently patched following the exploitation of a vulnerability by an attacker to enable data exfiltration.Despite the vulnerability being patched, it is likely that a malicious TCP service is still running and the adversary has achieved persistence by creating a systemd service.Examples of commands to use:kill, killall lsof man, --help (use for assistance)netstat (useful flags: a, n, g, u)ps (useful flag: a)systemctl (to control systemd)Please Note: the list of commands shown above is not exhaustive. All native commands are available.INSTRUCTIONSUsing the following credentials:Username: labadminPassword: Passw0rd!Investigate to identify indicators of compromise and then remediate them. You will need to make at least two changes:1. End the compromised process that is using a malicious TCP service.2. Remove the malicious persistence agent by disabling the service's ability to start on boot.
STEP 1: Identify and Kill the Malicious TCP Process1. List listening TCP services with associated processes:sudo netstat -tulnpLook for suspicious services (e.g., uncommon ports like 4444, 1337, etc.)2. Verify the process details:ps aux | grep <PID>3. Terminate the suspicious process:sudo kill <PID>Or use sudo killall <process-name> if needed.STEP 2: Disable the Malicious systemd Service (Persistence)1. List all systemd services:systemctl list-units --type=service2. Look for any unusual or suspicious service (often not part of a typical system, e.g., revshell.service, malicious.service, backdoor.service, etc.)3. Check the service path and content (optional but helpful):systemctl status <suspicious-service>cat /etc/systemd/system/<suspicious-service>.service4. Disable the malicious service:sudo systemctl disable <suspicious-service>5. Stop the service (if still running):sudo systemctl stop <suspicious-service>Once these steps are done, you will have:Ended the malicious process.Disabled its persistence via systemd.Avoid: Disabling SSH or systemd, changing passwords, rebooting, or touching the 172.162.0.0 network adapter.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.