A security engineer performed a code scan that resulted in many false positives. The security engineer must find a solution that improves the quality of scanning results before application deployment. Which of the following is the best solution?
Answer(s): A
Limiting the tool to a specific coding language and tuning the rule set is the best solution for improving the quality of scanning results. By focusing the scan on the specific language used in the application and customizing the rule set, the security engineer can significantly reduce false positives and improve the accuracy of the scan results before deployment.
A global company with a remote workforce implemented a new VPN solution. After deploying the VPN solution to several hundred users, the help desk starts receiving reports of slow access to both internally and externally available applications. A security analyst reviews the following:VPN client routing:0.0.0.0/0 eth1Which of the following solutions should the analyst use to fix this issue?
Answer(s): B
Enable split tunneling to resolve the issue of slow access. The current VPN client routing (0.0.0.0/0 routing through the VPN) forces all traffic, both internal and external, through the VPN, leading to slow performance for external applications. Split tunneling allows only internal traffic to go through the VPN, while external traffic bypasses the VPN, improving performance for external applications.
A security analyst is reviewing suspicious log-in activity and sees the following data in the SIEM:Which of the following is the most appropriate action for the analyst to take?
Answer(s): D
The ADMIN account is showing a failure to authenticate on LDAP-US and a high-risk level, which is a cause for concern. The most appropriate action would be to implement automation to disable accounts that have been associated with high-risk activity (like this one). This helps prevent further misuse or potential attacks using compromised credentials.
An organization determined its preparedness for a ransomware attack is inadequate. A security administrator is working on ways to improve and monitor the organization's response to ransomware attacks. Which of the following is the best action for the administrator to take?
Conducting backup testing is the best action to take in order to improve preparedness for a ransomware attack. Ensuring that backups are regularly tested and can be restored is crucial to recovering from a ransomware attack. Without reliable backups, a successful recovery from an attack could be delayed or impossible.
A security engineer receives an alert from the SIEM platform indicating a possible malicious action on the internal network. The engineer generates a report that outputs the logs associated with the incident:Which of the following actions best enables the engineer to investigate further?
Answer(s): C
The logs show that JohnS has been logging into different virtual machines (VM001 and SV002), which could indicate suspicious activity, especially if these are sensitive systems. Reviewing audit logs from privileged actions would help the engineer determine whether the logins are associated with unauthorized actions, changes to critical systems, or other suspicious behavior that might indicate a potential malicious action.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.