CompTIA CAS-004 CompTIA Advanced Security Practitioner (CASP+) Exam Online Training
CompTIA CAS-004 Online Training
The questions for CAS-004 were last updated at Jan 28,2025.
- Exam Code: CAS-004
- Exam Name: CompTIA Advanced Security Practitioner (CASP+) Exam
- Certification Provider: CompTIA
- Latest update: Jan 28,2025
A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP connections using the command line.
Which of the following commands would be the BEST to run to view only active Internet connections?
- A . sudo netstat -antu | grep “LISTEN” | awk ‘{print$5}’
- B . sudo netstat -nlt -p | grep “ESTABLISHED”
- C . sudo netstat -plntu | grep -v “Foreign Address”
- D . sudo netstat -pnut -w | column -t -s $’w’
- E . sudo netstat -pnut | grep -P ^tcp
A shipping company that is trying to eliminate entire classes of threats is developing an SELinux policy to ensure its custom Android devices are used exclusively for package tracking.
After compiling and implementing the policy, in which of the following modes must the company ensure the devices are configured to run?
- A . Protecting
- B . Permissive
- C . Enforcing
- D . Mandatory
A security analyst receives an alert from the SIEM regarding unusual activity on an authorized public SSH jump server. To further investigate, the analyst pulls the event logs directly from /var/log/auth.log: graphic.ssh_auth_log.
Which of the following actions would BEST address the potential risks by the activity in the logs?
- A . Alerting the misconfigured service account password
- B . Modifying the AllowUsers configuration directive
- C . Restricting external port 22 access
- D . Implementing host-key preferences
A high-severity vulnerability was found on a web application and introduced to the enterprise. The vulnerability could allow an unauthorized user to utilize an open-source library to view privileged user information. The enterprise is unwilling to accept the risk, but the developers cannot fix the issue right away.
Which of the following should be implemented to reduce the risk to an acceptable level until the issue can be fixed?
- A . Scan the code with a static code analyzer, change privileged user passwords, and provide security training.
- B . Change privileged usernames, review the OS logs, and deploy hardware tokens.
- C . Implement MFA, review the application logs, and deploy a WAF.
- D . Deploy a VPN, configure an official open-source library repository, and perform a full application review for vulnerabilities.
A security analyst discovered that the company’s WAF was not properly configured.
The main web server was breached, and the following payload was found in one of the malicious requests:
Which of the following would BEST mitigate this vulnerability?
- A . CAPTCHA
- B . Input validation
- C . Data encoding
- D . Network intrusion prevention
A university issues badges through a homegrown identity management system to all staff and students. Each week during the summer, temporary summer school students arrive and need to be issued a badge to access minimal campus resources. The security team received a report from an outside auditor indicating the homegrown system is not consistent with best practices in the security field and leaves the institution vulnerable.
Which of the following should the security team recommend FIRST?
- A . Investigating a potential threat identified in logs related to the identity management system
- B . Updating the identity management system to use discretionary access control
- C . Beginning research on two-factor authentication to later introduce into the identity management
system - D . Working with procurement and creating a requirements document to select a new IAM system/vendor
A customer reports being unable to connect to a website at www.test.com to consume services.
The customer notices the web application has the following published cipher suite:
Which of the following is the MOST likely cause of the customer’s inability to connect?
- A . Weak ciphers are being used.
- B . The public key should be using ECDSA.
- C . The default should be on port 80.
- D . The server name should be test.com.
An IT administrator is reviewing all the servers in an organization and notices that a server is missing crucial practice against a recent exploit that could gain root access.
Which of the following describes the administrator’s discovery?
- A . A vulnerability
- B . A threat
- C . A breach
- D . A risk
A security analyst is performing a vulnerability assessment on behalf of a client. The analyst must define what constitutes a risk to the organization.
Which of the following should be the analyst’s FIRST action?
- A . Create a full inventory of information and data assets.
- B . Ascertain the impact of an attack on the availability of crucial resources.
- C . Determine which security compliance standards should be followed.
- D . Perform a full system penetration test to determine the vulnerabilities.
While investigating a security event, an analyst finds evidence that a user opened an email attachment from an unknown source. Shortly after the user opened the attachment, a group of servers experienced a large amount of network and resource activity. Upon investigating the servers, the analyst discovers the servers were encrypted by ransomware that is demanding payment within 48 hours or all data will be destroyed. The company has no response plans for ransomware.
Which of the following is the NEXT step the analyst should take after reporting the incident to the management team?
- A . Pay the ransom within 48 hours.
- B . Isolate the servers to prevent the spread.
- C . Notify law enforcement.
- D . Request that the affected servers be restored immediately.
Latest CAS-004 Dumps Valid Version with 128 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund
