A company's help desk is experiencing a large number of calls from the finance department stating access issues to www.bank.com. The security operations center reviewed the following security logs:Which of the following is most likely the cause of the issue?
Answer(s): B
The HTTP status code 495 typically indicates a certificate error or SSL/TLS issue in a web connection, but in this case, it's unusual that only users from the finance department are affected. Given the DNS resolved IP address (65.146.76.34) for multiple users in the Finance department and the matching status code, this suggests a possible DNS poisoning attack, where malicious DNS records are being served, causing some users to be redirected to an incorrect or malicious server. This can explain the access issues and status code 495 errors for the finance users specifically.
A financial services organization is using AI to fully automate the process of deciding client loan rates. Which of the following should the organization be most concerned about from a regulatory perspective?
Answer(s): A
Model explainability is a major concern from a regulatory perspective, particularly when AI is used to make critical decisions like loan rates. Regulatory bodies require that organizations be able to explain how decisions are made by AI models, especially when they impact financial outcomes. Without transparency into how the model arrives at its decisions, the organization could face regulatory scrutiny for potential biases, fairness issues, and lack of accountability.
A security analyst is reviewing the following log:Which of the following possible events should the security analyst investigate further?
Answer(s): C
The dll file with a 10 MB size is allowed to be executed in the c:\temp directory. Since DLL (Dynamic Link Library) files are often associated with executable code and can be used for malicious purposes, this should be investigated further. The fact that it is allowed to run raises suspicion, and the location of the file (temp directory) is commonly used by malware for executing unauthorized processes.
A security operations engineer needs to prevent inadvertent data disclosure when encrypted SSDs are reused within an enterprise. Which of the following is the most secure way to achieve this goal?
The most secure method to prevent inadvertent data disclosure when reusing encrypted SSDs is to securely delete the encryption keys used by the SSD. Once the encryption keys are deleted, the data becomes inaccessible, as the encrypted information cannot be decrypted without the key. This method is more reliable and efficient than overwriting or degaussing the drive, especially considering that modern SSDs can be challenging to fully overwrite.
A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems. Given the following output:Which of the following actions would address the root cause of this issue?
The output shows that multiple systems are running outdated versions of OpenSSL and Java 11 runtime environment, which are identified as vulnerabilities. The best way to address this issue would be to automate the patching system to regularly update base images, ensuring that newly deployed systems are using the most current, secure versions of software. This will prevent the recurrence of vulnerabilities on future deployments.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.