A nation-state actor is exposed for attacking large corporations by establishing persistence in smaller companies that are likely to be acquired by these large corporations. The actor then provisions user accounts in the companies for use post-acquisition. Before an upcoming acquisition, a security officer conducts threat modeling with this attack vector. Which of the following practices is the best way to investigate this threat?
Answer(s): B
Comparing all existing credentials to personnel and services is the best practice to investigate this threat.By reviewing and comparing the credentials used by employees and services within the company, the security officer can identify any unauthorized or suspicious accounts, including those provisioned by the nation-state actor for post-acquisition persistence. This step helps identify and mitigate the risk of malicious accounts being established before the acquisition takes place.
After an incident response exercise, a security administrator reviews the following table:Which of the following should the administrator do to best support rapid incident response in the future?
Enabling dashboards for service status monitoring is the best action to support rapid incident response.Dashboards provide real-time visibility into the status of critical systems, enabling quicker identification of issues and a more informed, proactive response during an incident. By having a centralized view of service status, the security administrator can respond more quickly and efficiently to any disruptions.
An organization is required to:- Respond to internal and external inquiries in a timely manner.- Provide transparency.- Comply with regulatory requirements.The organization has not experienced any reportable breaches but wants to be prepared if a breach occurs in the future. Which of the following is the best way for the organization to prepare?
Answer(s): C
Developing communication templates that have been vetted by internal and external counsel is the best preparation for the organization. These templates ensure that the organization can respond promptly and in compliance with regulatory requirements in the event of a breach. Having pre-approved communication templates also ensures transparency and timely responses to both internal and external inquiries while maintaining legal and regulatory compliance.
An incident response team is analyzing malware and observes the following:- Does not execute in a sandbox- No network IoCs- No publicly known hash match- No process injection method detectedWhich of the following should the team do next to proceed with further analysis?
The behavior of the malware not executing in a sandbox suggests it may have anti-virtualization techniques to detect and evade analysis in virtual environments. The next step should be to check for anti-virtualization code in the sample. This could reveal whether the malware is designed to avoid execution in virtualized environments, which is common in advanced malware to prevent detection and analysis.
Which of the following best explains the business requirement a healthcare provider fulfills by encrypting patient data at rest?
Answer(s): D
Encrypting patient data at rest helps a healthcare provider protect privacy while maintaining the ability to support portability. By encrypting the data, the healthcare provider ensures that sensitive information is kept secure, even if the storage medium is compromised, while still allowing it to be transferred or accessed as needed by authorized personnel. This is a key practice to meet privacy regulations and ensure secure access to patient data.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.