A company implemented a new NAC solution based on 802.1X. However, the IT support team notices that some devices are not being enrolled in the new policies, causing access disruptions for key users. Which of the following solutions will most likely solve this issue and prevent reoccurrence?
Answer(s): A
The best solution is to include the monitoring agent and digital certificate as part of the patching/ updating program. This will ensure that all corporate devices are kept up-to-date and automatically enrolled in the NAC solution. By integrating this into the patching process, the company can ensure proper device enrollment and reduce access disruptions for key users, preventing the issue from recurring.
While performing threat-hunting functions, an analyst is using the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target. Which of the following must the threat hunter document to use the model effectively?
Answer(s): B
The Diamond Model of Intrusion Analysis requires the documentation of capabilities, as this refers to the adversary's tools, techniques, and procedures (TTPs) used during the attack. Identifying and documenting the adversary's capabilities is essential for effective threat-hunting, as it helps understand how the adversary operates and can guide the detection of similar future attacks.
A systems administrator needs to improve the security assurance in a company's cloud storage environment. The administrator determines that the best approach is to identify whether any data has been maliciously or inadvertently modified. Which of the following techniques should the systems administrator periodically use?
Answer(s): C
Hashing is the best technique for identifying whether data has been maliciously or inadvertently modified. By generating and storing hash values for files or data, the administrator can periodically recheck the hashes to ensure that the data has not been altered. If the hash value changes, it indicates that the data has been modified. This technique provides an efficient and secure way to ensure data integrity.
A security engineer wants to enhance the security posture of end-user systems in a zero trust environment.Given the following requirements:- Reduce the ability for potentially compromised endpoints to contact C2 infrastructure.- Track the requests that the malware makes to the IPs.- Avoid the download of additional payloads.Which of the following should the engineer deploy to meet these requirements?
DNS sinkholing is the best solution to meet these requirements. By redirecting malicious DNS requests (such as those from compromised endpoints attempting to contact command and control (C2) infrastructure) to a "sinkhole" server, the security engineer can prevent communication between the malware and the attacker's infrastructure. Additionally, DNS sinkholing allows for tracking and logging of the requests that the malware attempts to make, while also preventing the malware from downloading additional payloads by blocking these connections.
Developers have been creating and managing cryptographic material on their personal laptops for use in the production environment. A security engineer needs to initiate a more secure process. Which of the following is the best strategy for the engineer to use?
Answer(s): D
Managing key material on a Hardware Security Module (HSM) is the best strategy to secure cryptographic material. HSMs are specialized devices designed to generate, store, and manage cryptographic keys securely.By using an HSM, the security engineer can ensure that cryptographic keys are protected in a secure, tamper- resistant environment, rather than being stored on developers' personal laptops where they are more vulnerable to theft or mishandling.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.