Free CompTIA CAS-005 Exam Dumps Questions & Answers

The Chief Information Security Officer must ensure that an organization's baseline workload is standardized prior to deployment and any modifications are immediately returned to the approved configuration. Which of the following are the best ways to assist with meeting these goals?
(Choose two.)

• A.CNAPP
• B.SIEM
• C.Code assist
• D.PowerShell scripts
• E.IaC
• F.Automated patching

A company's security team is notified about vulnerabilities in the company's application. The security team determined these vulnerabilities were previously disclosed in third-party libraries.
Which of the following solutions best allows the company to identify third-party vulnerabilities in the future?

• A.Creating a bug bounty program
• B.Using laC to include the newest dependencies
• C.Integrating a SASI tool as part of the pipeline
• D.Implementing a continuous security assessment program

Which of the following are the best ways to mitigate the threats that are the highest priority?
(Select two).

• A.Implement a cloud access security broker and place it in blocking mode to prevent information exfiltration.
• B.Isolate network systems using Zero Trust architecture with microsegmentation and SD-WAN
• C.Institute a technical approval process that requires multiple parties to sign off on mass payroll changes.
• D.Apply data labeling to all sensitive information within the environment with special attention to payroll information.
• E.Scan all systems and source code with access to sensitive data for vulnerabilities.

A nation-state actor is exposed for attacking large corporations by establishing persistence in smaller companies that are likely to be acquired by these large corporations. The actor then provisions user accounts in the companies for use post-acquisition. Before an upcoming acquisition, a security officer conducts threat modeling with this attack vector. Which of the following practices is the best way to investigate this threat?

• A.Restricting internet traffic originating from countries in which the nation-state actor is known to operate
• B.Comparing all existing credentials to personnel and services
• C.Placing a hold on all information about corporate interest in acquisitions
• D.Auditing vendors to mitigate supply chain risk during the acquisition

A security engineer receives an alert from the threat intelligence platform with the following information:

Which of the following actions should the security engineer do first?

• A.Reset John's and Joe's passwords and inform authorities about the leakage
• B.Reset John's, Ann's, and Joe's passwords and disconnect all users' active sessions
• C.Reset John's and Joe's passwords and investigate any potential unauthorized access
• D.Contact John, Ann, and Joe to inform them about the incident and schedule a password reset