A company wants to modify its process to comply with privacy requirements after an incident involving PII data in a development environment. In order to perform functionality tests, the QA team still needs to use valid data in the specified format. Which of the following best addresses the risk without impacting the development life cycle?
Answer(s): D
Tokenization replaces sensitive fields (like PII) with non-sensitive equivalents (tokens) that preserve the format and structure of the original data. This allows the QA team to perform accurate functionality tests while mitigating privacy risks and maintaining compliance.
A global organization is reviewing potential vendors to outsource a critical payroll function. Each vendor's plan includes using local resources in multiple regions to ensure compliance with all regulations. The organization's Chief Information Security Officer is conducting a risk assessment on the potential outsourcing vendors' subprocessors. Which of the following best explains the need for this risk assessment?
Answer(s): C
The responsibility for protecting PII remains with the organization, even when outsourcing to third-party vendors or subprocessors. Conducting a risk assessment ensures that these subprocessors maintain adequate security controls to protect sensitive data and meet compliance obligations.
An organization plans to deploy new software. The project manager compiles a list of roles that will be involved in different phases of the deployment life cycle. Which of the following should the project manager use to track these roles?
A RACI matrix is used to define and track roles and responsibilities in a project by identifying who is Responsible, Accountable, Consulted, and Informed for each task or phase. It's the best tool for the project manager to manage role assignments throughout the deployment life cycle.
An organization decides to move to a distributed workforce model. Several legacy systems exist on premises and cannot be migrated because of existing compliance requirements. However, all new systems are required to be cloud-based. Which of the following would best ensure network access security?
Answer(s): A
Using a VPN for users who require access to legacy systems ensures secure, encrypted connectivity to the on- premises environment while maintaining compliance and supporting a distributed workforce. It's the most effective solution given the constraints on migrating legacy systems.
A web application server that provides services to hybrid modern and legacy financial applications recently underwent a scheduled upgrade to update common libraries, including OpenSSL. Multiple users are now reporting failed connection attempts to the server. The technician performing initial triage identified the following:Client applications more than five years old appear to be the most affectedWeb server logs show initial connection attempts by affected hosts.For the failed connections, logs indicate "cipher unavailable. "Which of the following is most likely to safely remediate this situation?
Answer(s): B
The error "cipher unavailable" suggests that the upgraded OpenSSL library on the server has dropped support for older, insecure cipher suites. To safely remediate this, client applications need to be updated to support modern, secure cipher modes such as AES in Galois/Counter Mode (GCM). This maintains security without reintroducing deprecated protocols.
Post your Comments and Discuss CompTIA CAS-005 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CAS-005 content, but please register or login to continue.