A security engineer is implementing security measures on new hardware in preparation for its launch. During the development phase, a risk related to protections at the UEFI level was found. Which of the following should the engineer recommend to reduce this risk?
Answer(s): B
Enabling Secure Boot at the UEFI level helps ensure that only trusted and signed operating system loaders and boot files can be executed on the hardware. This prevents unauthorized code, such as bootkits or rootkits, from loading during the boot process, significantly reducing risks at the UEFI level. Secure Boot is an essential measure to ensure the integrity of the system from the very start of the boot process.
A development team must create a website to share indicators of compromise. The team wants to use APIs between industry peers to aid in configuring SIEM and SOAR. The team needs to create a free tier of service, and the senior developer insists on configuring rate limiting. Which of the following best describes the senior developer's reasoning?
The senior developer wants to configure rate limiting to limit the likelihood of resource exhaustion on the API server. Rate limiting controls how many requests a client can make in a given time, helping prevent abuse or overload that could crash the service, especially important in a free-tier setup where excessive usage must be managed.
A hotel chain wants to use point-of-sale systems to allow customers to check in and out of their rooms without employee assistance. These systems should limit access to a specific set of programs approved to run, with all other programs blocked. Which of the following should the company configure to best support this goal?
Answer(s): A
Application control using a baseline image ensures only pre-approved programs are allowed to run, effectively blocking all others. This is the best approach for restricting point-of-sale systems to specific functions and maintaining system integrity in an unattended environment.
A user reports application access issues to the help desk. The help desk reviews the logs for the user:Which of the following is most likely the reason for the issue?
The logs show the same user accessing resources from two different geolocations (Toronto and Los Angeles) nearly simultaneously (8:47 p.m. and 8:48 p.m.). This is a strong indicator of impossible travel, suggesting that the user's account may have been compromised by a threat actor, triggering a security policy that denied access to the human resources system at 8:52 p.m. from Toronto.
A company's security team is notified about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries. Which of the following solutions best allows the company to identify third-party vulnerabilities in the future?
Answer(s): D
Software Composition Analysis (SCA) tools scan for known vulnerabilities in third-party libraries and dependencies. Integrating an SCA tool into the development pipeline enables automatic identification of such vulnerabilities early in the development lifecycle.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.