An organization wants to create a threat model to identify vulnerabilities in its infrastructure. Which of the following should be prioritized first?
Answer(s): A
External-facing infrastructure with known exploited vulnerabilities poses the highest immediate risk, as it is directly accessible to attackers and already associated with active threats. This should be the top priority in any threat modeling effort.
A Chief Information Security Officer requests an action plan to remediate vulnerabilities. A security analyst reviews the output from a recent vulnerability scan and notices hundreds of unique vulnerabilities. The output includes the CVSS score, IP address, hostname, and the list of vulnerabilities. The analyst determines more information is needed in order to decide which vulnerabilities should be fixed immediately. Which of the following is the best source for this information?
Answer(s): B
A Business Impact Analysis (BIA) identifies the criticality of systems and the potential impact of their compromise. It helps prioritize which vulnerabilities to remediate first based on the business value and operational impact of the affected assets.
A security operations analyst is reviewing network traffic baselines for nightly database backups. Given the following information:Which of the following should the security analyst do next?
Answer(s): C
The unexpected 97GB data transfer to an external IP (85.34.17.98) at an unusual time (12:46 a.m.) is a strong indicator of potential data exfiltration. The appropriate next step is to follow the incident response playbook to ensure a structured and compliant response.
A company has a requirement in customer contracts that states applications must undergo external audits to identify vulnerabilities. Which of the following is the best action for the company to complete before hiring an external auditor?
Conducting an internal audit assessment before hiring an external auditor allows the company to identify any potential vulnerabilities or gaps internally. This ensures that the organization is well-prepared for the external audit and can address issues proactively.
During DAST scanning, applications are consistently reporting code defects in open-source libraries that were used to build web applications. Most of the code defects are from using libraries with known vulnerabilities. The code defects are causing product deployment delays. Which of the following is the best way to uncover these issues earlier in the life cycle?
Answer(s): D
Using a software dependency management solution helps track and manage open-source libraries and their vulnerabilities. This solution can identify vulnerable libraries early in the development process, allowing developers to replace or patch them before deployment and reducing delays caused by code defects.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.