A security engineer must integrate device attestation into user authentication and authorization workflows for mobile devices. Which of the following best meets the requirements?
Answer(s): D
Configuring device profiling for patch level and jailbreak status ensures that the mobile device is compliant with security requirements before granting access. Device attestation checks the integrity of the device (such as whether it is jailbroken or up to date with security patches) to ensure that only trusted devices are allowed to authenticate and access resources. This solution directly addresses the requirement to integrate device attestation into user authentication workflows.
An organization is developing an AI-enabled digital worker to help employees complete common tasks, such as template development, editing, research, and scheduling. As part of the AI workload, the organization wants to implement guardrails within the platform. Which of the following should the company do to secure the AI environment?
Answer(s): A
Limiting the platform's abilities to only non-sensitive functions is the best way to secure the AI environment. By restricting the AI's scope to tasks that do not involve sensitive or critical information, the company can mitigate the risk of accidental data exposure or misuse while still allowing the AI to assist employees in non-sensitive activities. This approach helps implement guardrails that align with security best practices.
A security analyst discovered requests associated with IP addresses known for both legitimate and bot-related traffic. Which of the following should the analyst use to determine whether the requests are malicious?
User-agent string is the best option for determining whether requests are malicious. The user-agent string provides information about the client making the request, including the browser or bot in use. By analyzing the user-agent, the security analyst can differentiate between legitimate traffic (such as from a recognized browser) and bot-related traffic (which often uses generic or suspicious user-agent strings).
A security analyst received a report that an internal web page is down after a company-wide update to the web browser. Given the following error message:Your connection is not private.Attackers might be trying to steal your information for www.internalwebsite.company.com.NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHMWhich of the following is the best way to fix this issue?
Answer(s): B
The error message indicates that the web browser is rejecting the connection due to a weak signature algorithm in the SSL/TLS certificate. The most appropriate fix is to disable all deprecated ciphers and ensure the server is using strong, modern encryption algorithms. This will resolve the issue of weak certificate signatures and improve overall security.
A company receives reports about misconfigurations and vulnerabilities in a third-party hardware device that is part of its released products. Which of the following solutions is the best way for the company to identify possible issues at an earlier stage?
Implementing a proper supply chain risk management program is the best way to identify potential issues earlier in the process. This program involves assessing the risks and vulnerabilities of third-party hardware and software during the procurement process and throughout the lifecycle of the product. By establishing a strong risk management framework, the company can proactively detect and address misconfigurations and vulnerabilities before the products are released or deployed.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.