A security engineer is reviewing the results of an annual penetration test. The report lists one of the results as "critical severity" on several domain-joined workstations:SSL/TLS Weak Protocols Supported TLS 1.0, TLS 1.1Which of the following should the security engineer implement to remediate this finding in the most centralized manner?
Answer(s): B
A Group Policy Object (GPO) is the most centralized and scalable way to implement this change across multiple domain-joined workstations. By configuring a GPO to disable weak protocols (TLS 1.0 and TLS 1.1) in the Schannel hive, the security engineer can ensure consistent enforcement across all affected systems in the domain without needing to manually configure each machine individually.
An analyst reviews a SIEM and generates the following report:Only HOST002 is authorized for internet traffic. Which of the following statements is accurate?
Answer(s): A
The report shows that VM002 is generating TCP connections and web navigation activity, which is unauthorized since only HOST002 is authorized for internet traffic. This suggests that VM002 is misconfigured and should be reviewed by the network team to ensure it complies with the security policies and does not make unauthorized internet connections.
A company wants to implement a three-tier approach to separate the web, database, and application servers. A security administrator must harden the environment. Which of the following is the best solution?
Answer(s): C
Microsegmentation is the best solution to separate and harden the environment. It involves creating granular security controls within the network to restrict communication between servers in different tiers (web, database, application) while allowing necessary communication. This limits the attack surface and improves security by preventing lateral movement within the network.
A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate. Which of the following is the best way to meet this objective?
Configuring an API integration is the best way to automate reporting from disparate security appliances. APIs allow for the integration of data from different sources, enabling automated aggregation and reporting without the need to invest in new tools or migrate data manually. This solution leverages existing resources and allows the systems to communicate effectively.
A vulnerability scan on a web server identified the following:Which of the following actions would most likely eliminate on-path decryption attacks? (Choose two.)
Answer(s): B,C
Removing support for CBC-based key exchange and signing algorithms: Cipher suites using CBC (Cipher Block Chaining) are vulnerable to attacks like BEAST. Removing these weak cipher suites eliminates this potential for on-path decryption attacks.Adding TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA256: This cipher suite uses ECDHE (Elliptic Curve Diffie-Hellman Ephemeral) for key exchange, providing forward secrecy and better protection against on-path decryption attacks compared to static RSA-based cipher suites.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.