HOTSPOTYou are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements:The application does not need to know the users' credentials.An approval interaction between the users and the HTTP service must be orchestrated.The application must have limited access to users' data.INSTRUCTIONSUse the drop-down menus to select the action items for the appropriate locations. All placeholders must be filled.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.Hot Area:
Answer(s): A
Resource Server: Authorize access to other applicationsThe resource server verifies tokens and allows access to protected resources.Authorization Server: Access issued tokensThis server issues access tokens after successful authentication and user consent.B2B Client Application: Grant accessThe client uses the token to request access to resources. In the OAuth flow, this is the step where access is granted via token.
SIMULATIONAn IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.Complete the configuration files to meet the following requirements:The EAP method must use mutual certificate-based authentication (with issued client certificates).The IKEv2 cipher suite must be configured to the most secure authenticated mode of operation.The secret must contain at least one uppercase character, one lowercase character, one numeric character,and one special character, and it must meet a minimum length requirement of eight characters.INSTRUCTIONSClick on the AAA server and VPN concentrator to complete the configuration. Fill in the appropriate fields and make selections from the drop-down menus.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
VPN ConcentratorProposal: aes256gcm128Server IP: 10.1.0.10 (this is the AAA server)Secret: Str0ng@Key (example that meets all character requirements)AAA ServerDefault EAP type: tlsIP Address: 10.1.2.1 (this is the VPN concentrator)Secret: Str0ng@Key (must match the VPN concentrator)
SIMULATIONAn incident occurred at Site A when an attacker successfully caused water pressure to increase in the pump room.The organization is concerned about reoccurrence of this attack and that similar attacks might be successful on other cyber-physical systems within the network.All devices and components reside on a flat network within the 10.1.0.0/16 space.INSTRUCTIONSTake the appropriate actions to reduce the risk of reoccurrence of this and other environmental security vulnerabilities.Select the component(s) at Sites A and B that have environmental impact potential. Then, select the corrective action that will best reduce the risk of incident reoccurrence.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
At Site A:SCADA master controller Controls and monitors physical processes.PLC (both) Programmable Logic Controllers directly interface with pumps/valves.Pumps Direct environmental impact (increased water pressure in incident).At Site B:PLC As above, interfaces with physical systems.Pumps As above, environmental impact through pressure, flow, etc.Corrective Action Isolate from the networkThe devices reside on a flat network, increasing risk. Isolation (e.g., segmentation or VLANs) limits lateral movement and access to critical cyber-physical systems (CPS) like PLCs and pumps.
SIMULATIONDuring the course of normal SOC operations, three anomalous events occurred and were flagged as potential IoCs. Evidence for each of these potential IoCs is provided.INSTRUCTIONSReview each of the events and select the appropriate analysis and action options for each IoC.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
IoC 1Indicators:DNS queries for a suspicious subdomain (update.s.domain, *.s.domain)Responses include odd CNAME and A recordsActivity resembles contacting a malicious domainCorrect Selections:Analysis: The service is attempting to resolve a malicious domainAction: Implement a blocklist for known malicious portsIoC 2Indicators:ICMP Echo (ping) requests from 10.0.5.5 to multiple hostsAll packets are droppedSuggests a device is probing the networkCorrect Selections:Analysis: Someone is footprinting a network subnetAction: Block ping requests across the WAN interfaceIoC 3Indicators:BitTorrent traffic (/announce?info_hash, peer_id, application/x-bittorrent)Indicates P2P protocol activityCorrect Selections:Analysis: An employee is using P2P services to download filesAction: Enforce endpoint controls on third-party software installations
A security administrator needs to automate alerting. The server generates structured log files that need to be parsed to determine whether an alarm has been triggered. Given the following code function:Which of the following is most likely the log input that the code will parse?
The Python function uses json.load() to parse a structured log file in JSON format and directly accesses nested keys using dictionary syntax. Chosen option has valid JSON structure that matches this access pattern:parsed_log["error_log"]["system_1"]["InAlarmState"].
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.