Latest [Jan 04, 2025] 100% Passing Guarantee - Brilliant CAS-005 Exam Questions PDF
CAS-005 Certification – Valid Exam Dumps Questions Study Guide! (Updated 120 Questions)
NEW QUESTION # 48
A security engineer needs 10 secure the OT environment based on me following requirements
* Isolate the OT network segment
* Restrict Internet access.
* Apply security updates two workstations
* Provide remote access to third-party vendors
Which of the following design strategies should the engineer implement to best meet these requirements?
- A. Implement a bastion host in the OT network with security tools in place to monitor access and use a dedicated update server for the workstations.
- B. Create a staging environment on the OT network for the third-party vendor to access and enable automatic updates on the workstations.
- C. Deploy a jump box on the third party network to access the OT environment and provide updates using a physical delivery method on the workstations
- D. Enable outbound internet access on the OT firewall to any destination IP address and use the centralized update server for the workstations
Answer: A
Explanation:
To secure the Operational Technology (OT) environment based on the given requirements, the best approach is to implement a bastion host in the OT network. The bastion host serves as a secure entry point for remote access, allowing third-party vendors to connect while being monitored by security tools. Using a dedicated update server for workstations ensures that security updates are applied in a controlled manner without direct internet access.
References:
* CompTIA SecurityX Study Guide: Recommends the use of bastion hosts and dedicated update servers for securing OT environments.
* NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security": Advises on isolating OT networks and using secure remote access methods.
* "Industrial Network Security" by Eric D. Knapp and Joel Thomas Langill: Discusses strategies for securing OT networks, including the use of bastion hosts and update servers.
NEW QUESTION # 49 
An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.
Answer:
Explanation:
Explanation:
A computer screen shot of a diagram Description automatically generated
A screenshot of a computer error Description automatically generated
NEW QUESTION # 50
A systems administrator wants to introduce a newly released feature for an internal application. The administrate docs not want to test the feature in the production environment. Which of the following locations is the best place to test the new feature?
- A. CI/CO pipeline
- B. Development environment
- C. Staging environment
- D. Testing environment
Answer: C
NEW QUESTION # 51
A network engineer must ensure that always-on VPN access is enabled Curt restricted to company assets Which of the following best describes what the engineer needs to do''
- A. Generate device certificates using the specific template settings needed
- B. Create a wildcard certificate for connections from public networks
- C. Add the VPN hostname as a SAN entry on the root certificate
- D. Modify signing certificates in order to support IKE version 2
Answer: A
Explanation:
To ensure always-on VPN access is enabled and restricted to company assets, the network engineer needs to generate device certificates using the specific template settings required for the company's VPN solution.
These certificates ensure that only authorized devices can establish a VPN connection.
Why Device Certificates are Necessary:
* Authentication: Device certificates authenticate company assets, ensuring that only authorized devices can access the VPN.
* Security: Certificates provide a higher level of security compared to username and password combinations, reducing the risk of unauthorized access.
* Compliance: Certificates help in meeting security policies and compliance requirements by ensuring that only managed devices can connect to the corporate network.
Other options do not provide the same level of control and security for always-on VPN access:
* B. Modify signing certificates for IKE version 2: While important for VPN protocols, it does not address device-specific authentication.
* C. Create a wildcard certificate: This is not suitable for device-specific authentication and could introduce security risks.
* D. Add the VPN hostname as a SAN entry: This is more related to certificate management and does not ensure device-specific authentication.
References:
* CompTIA SecurityX Study Guide
* "Device Certificates for VPN Access," Cisco Documentation
* NIST Special Publication 800-77, "Guide to IPsec VPNs"
NEW QUESTION # 52
A systems engineer is configuring a system baseline for servers that will provide email services. As part of the architecture design, the engineer needs to improve performance of the systems by using an access vector cache, facilitating mandatory access control and protecting against:
* Unauthorized reading and modification of data and programs
* Bypassing application security mechanisms
* Privilege escalation
* interference with other processes
Which of the following is the most appropriate for the engineer to deploy?
- A. NIPS
- B. Self-encrypting disks
- C. SELinux
- D. Privileged access management
Answer: C
Explanation:
The most appropriate solution for the systems engineer to deploy is SELinux (Security-Enhanced Linux).
Here's why:
* Mandatory Access Control (MAC): SELinux enforces MAC policies, ensuring that only authorized users and processes can access specific resources. This helps in preventing unauthorized reading and modification of data and programs.
* Access Vector Cache: SELinux utilizes an access vector cache (AVC) to improve performance. The AVC caches access decisions, reducing the need for repetitive policy lookups and thus improving system efficiency.
* Security Mechanisms: SELinux provides a robust framework to enforce security policies and prevent bypassing of application security mechanisms. It controls access based on defined policies, ensuring that security measures are consistently applied.
* Privilege Escalation and Process Interference: SELinux limits the ability of processes to escalate privileges and interfere with each other by enforcing strict access controls. This containment helps in isolating processes and minimizing the risk of privilege escalation attacks.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NSA's Guide to the Secure Configuration of Red Hat Enterprise Linux 5 (SELinux)
* NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NEW QUESTION # 53
A security analyst Detected unusual network traffic related to program updating processes The analyst collected artifacts from compromised user workstations. The discovered artifacts were binary files with the same name as existing, valid binaries but. with different hashes which of the following solutions would most likely prevent this situation from reoccurring?
- A. Implementing digital signature
- B. Performing manual updates via USB ports
- C. Improving patching processes
- D. Allowing only dies from internal sources
Answer: A
Explanation:
Implementing digital signatures ensures the integrity and authenticity of software binaries. When a binary is digitally signed, any tampering with the file (e.g., replacing it with a malicious version) would invalidate the signature. This allows systems to verify the origin and integrity of binaries before execution, preventing the execution of unauthorized or compromised binaries.
* A. Improving patching processes: While important, this does not directly address the issue of verifying the integrity of binaries.
* B. Implementing digital signatures: This ensures that only valid, untampered binaries are executed, preventing attackers from substituting legitimate binaries with malicious ones.
* C. Performing manual updates via USB ports: This is not practical and does not scale well, especially in large environments.
* D. Allowing only files from internal sources: This reduces the risk but does not provide a mechanism to verify the integrity of binaries.
References:
* CompTIA Security+ Study Guide
* NIST SP 800-57, "Recommendation for Key Management"
* OWASP (Open Web Application Security Project) guidelines on code signing
NEW QUESTION # 54
A company wants to use loT devices to manage and monitor thermostats at all facilities The thermostats must receive vendor security updates and limit access to other devices within the organization Which of the following best addresses the company's requirements''
- A. Operating lot devices on a separate network with no access to other devices internally
- B. Only allowing Internet access to a set of specific domains
- C. Only allowing operation for loT devices during a specified time window
- D. Configuring IoT devices to always allow automatic updates
Answer: A
Explanation:
The best approach for managing and monitoring IoT devices, such as thermostats, is to operate them on a separate network with no access to other internal devices. This segmentation ensures that the IoT devices are isolated from the main network, reducing the risk of potential security breaches affecting other critical systems. Additionally, this setup allows for secure vendor updates without exposing the broader network to potential vulnerabilities inherent in IoT devices.
References:
* CompTIA SecurityX Study Guide: Recommends network segmentation for IoT devices to minimize security risks.
* NIST Special Publication 800-183, "Network of Things": Advises on the isolation of IoT devices to enhance security.
* "Practical IoT Security" by Brian Russell and Drew Van Duren: Discusses best practices for securing IoT devices, including network segmentation.
NEW QUESTION # 55
The material finding from a recent compliance audit indicate a company has an issue with excessive permissions. The findings show that employees changing roles or departments results in privilege creep.
Which of the following solutions are the best ways to mitigate this issue? (Select two).
Setting different access controls defined by business area
- A. Implementing a role-based access policy
- B. Requiring periodic job rotation
- C. Performing periodic access reviews
- D. Establishing a mandatory vacation policy
- E. Designing a least-needed privilege policy
Answer: A,C
Explanation:
To mitigate the issue of excessive permissions and privilege creep, the best solutions are:
* Implementing a Role-Based Access Policy:
* Role-Based Access Control (RBAC): This policy ensures that access permissions are granted based on the user's role within the organization, aligning with the principle of least privilege.
Users are only granted access necessary for their role, reducing the risk of excessive permissions.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
* Performing Periodic Access Reviews:
* Regular Audits: Periodic access reviews help identify and rectify instances of privilege creep by ensuring that users' access permissions are appropriate for their current roles. These reviews can highlight unnecessary or outdated permissions, allowing for timely adjustments.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* ISO/IEC 27001:2013 - Information Security Management
NEW QUESTION # 56
An organization wants to manage specialized endpoints and needs a solution that provides the ability to
* Centrally manage configurations
* Push policies.
* Remotely wipe devices
* Maintain asset inventory
Which of the following should the organization do to best meet these requirements?
- A. Use a configuration management database
- B. Implement a mobile device management solution.
- C. Configure contextual policy management
- D. Deploy a software asset manager
Answer: B
Explanation:
To meet the requirements of centrally managing configurations, pushing policies, remotely wiping devices, and maintaining an asset inventory, the best solution is to implement a Mobile Device Management (MDM) solution.
MDM Capabilities:
* Central Management: MDM allows administrators to manage the configurations of all devices from a central console.
* Policy Enforcement: MDM solutions enable the push of security policies and updates to ensure compliance across all managed devices.
* Remote Wipe: In case a device is lost or stolen, MDM provides the capability to remotely wipe the device to protect sensitive data.
* Asset Inventory: MDM maintains an up-to-date inventory of all managed devices, including their configurations and installed applications.
Other options do not provide the same comprehensive capabilities required for managing specialized endpoints.
References:
* CompTIA SecurityX Study Guide
* NIST Special Publication 800-124 Revision 1, "Guidelines for Managing the Security of Mobile Devices in the Enterprise"
* "Mobile Device Management Overview," Gartner Research
NEW QUESTION # 57
An organization is planning for disaster recovery and continuity of operations, and has noted the following relevant findings:
1. A natural disaster may disrupt operations at Site A, which would then cause an evacuation. Users are unable to log into the domain from-their workstations after relocating to Site B.
2. A natural disaster may disrupt operations at Site A, which would then cause the pump room at Site B to become inoperable.
3. A natural disaster may disrupt operations at Site A, which would then cause unreliable internet connectivity at Site B due to route flapping.
INSTRUCTIONS
Match each relevant finding to the affected host by clicking on the host name and selecting the appropriate number.
For findings 1 and 2, select the items that should be replicated to Site B. For finding 3, select the item requiring configuration changes, then select the appropriate corrective action from the drop-down menu.
Answer:
Explanation:
See the complete solution below in Explanation:
Explanation:
Matching Relevant Findings to the Affected Hosts:
* Finding 1:
* Affected Host: DNS
* Reason: Users are unable to log into the domain from their workstations after relocating to Site B, which implies a failure in domain name services that are critical for user authentication and domain login.
* Finding 2:
* Affected Host: Pumps
* Reason: The pump room at Site B becoming inoperable directly points to the critical infrastructure components associated with pumping operations.
* Finding 3:
* Affected Host: VPN Concentrator
* Reason: Unreliable internet connectivity at Site B due to route flapping indicates issues with network routing, which is often managed by VPN concentrators that handle site-to-site
* connectivity.
Corrective Actions for Finding 3:
* Finding 3 Corrective Action:
* Action: Modify the BGP configuration
* Reason: Route flapping is often related to issues with Border Gateway Protocol (BGP) configurations. Adjusting BGP settings can stabilize routes and improve internet connectivity reliability.
* Replication to Site B for Finding 1:
* Affected Host: DNS
* Explanation: Domain Name System (DNS) services are essential for translating domain names into IP addresses, allowing users to log into the network. Replicating DNS services ensures that even if Site A is disrupted, users at Site B can still authenticate and access necessary resources.
* Replication to Site B for Finding 2:
* Affected Host: Pumps
* Explanation: The operation of the pump room is crucial for maintaining various functions within the infrastructure. Replicating the control systems and configurations for the pumps at Site B ensures that operations can continue smoothly even if Site A is affected.
* Configuration Changes for Finding 3:
* Affected Host: VPN Concentrator
* Explanation: Route flapping is a situation where routes become unstable, causing frequent changes in the best path for data to travel. This instability can be mitigated by modifying BGP configurations to ensure more stable routing. VPN concentrators, which manage connections between sites, are typically configured with BGP for optimal routing.
References:
* CompTIA Security+ Study Guide: This guide provides detailed information on disaster recovery and continuity of operations, emphasizing the importance of replicating critical services and making necessary configuration changes to ensure seamless operation during disruptions.
* CompTIA Security+ Exam Objectives: These objectives highlight key areas in disaster recovery planning, including the replication of critical services and network configuration adjustments.
* Disaster Recovery and Business Continuity Planning (DRBCP): This resource outlines best practices for ensuring that operations can continue at an alternate site during a disaster, including the replication of essential services and network stability measures.
By ensuring that critical services like DNS and control systems for pumps are replicated at the alternate site, and by addressing network routing issues through proper BGP configuration, the organization can maintain operational continuity and minimize the impact of natural disasters on their operations.
NEW QUESTION # 58
A central bank implements strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin. Which of the following best describes the cyberthreat to the bank?
- A. Physical Implants and tampering
- B. Ability to obtain components during wartime
- C. Fragility and other availability attacks
- D. Non-conformance to accepted manufacturing standards
Answer: A
Explanation:
The best description of the cyber threat to a central bank implementing strict risk mitigations for the hardware supply chain, including an allow list for specific countries of origin, is the risk of physical implants and tampering. Here's why:
* Supply Chain Security: The supply chain is a critical vector for hardware tampering and physical implants, which can compromise the integrity and security of hardware components before they reach the organization.
* Targeted Attacks: Banks and financial institutions are high-value targets, making them susceptible to sophisticated attacks, including those involving physical implants that can be introduced during manufacturing or shipping processes.
* Strict Mitigations: Implementing an allow list for specific countries aims to mitigate the risk of supply chain attacks by limiting the sources of hardware. However, the primary concern remains the introduction of malicious components through tampering.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-161: Supply Chain Risk Management Practices for Federal Information Systems and Organizations
* ISO/IEC 20243:2018 - Information Technology - Open Trusted Technology Provider Standard
NEW QUESTION # 59
Which of the following best explains the business requirement a healthcare provider fulfills by encrypting patient data at rest?
- A. Securing data transfer between hospitals
- B. Reducing liability from identity theft
- C. Providing for non-repudiation data
- D. Protecting privacy while supporting portability.
Answer: D
Explanation:
Encrypting patient data at rest is a critical requirement for healthcare providers to ensure compliance with regulations such as the Health Insurance Portability and Accountability Act (HIPAA). The primary business requirement fulfilled by this practice is the protection of patient privacy while supporting the portability of medical information. By encrypting data at rest, healthcare providers safeguard sensitive patient information from unauthorized access, ensuring that privacy is maintained even if the storage media are compromised.
Additionally, encryption supports the portability of patient records, allowing for secure transfer and access across different systems and locations while ensuring that privacy controls are in place.
References:
* CompTIA SecurityX Study Guide: Emphasizes the importance of data encryption for protecting sensitive information and ensuring compliance with regulatory requirements.
* HIPAA Security Rule: Requires healthcare providers to implement safeguards, including encryption, to protect patient data.
* "Health Informatics: Practical Guide for Healthcare and Information Technology Professionals" by Robert E. Hoyt: Discusses encryption as a key measure for protecting patient data privacy and supporting data portability.
NEW QUESTION # 60
A security engineer wants to reduce the attack surface of a public-facing containerized application Which of the following will best reduce the application's privilege escalation attack surface?
- A. Running the container in an isolated network and placing a load balancer in a public-facing network.Adding the following ACL to the load balancer:PZRKZI HTTES from 0-0.0.0.0/0 pert 443
- B. Implementing the following commands in the Dockerfile:
RUN echo user:x:1000:1000iuser:/home/user:/dew/null > /ete/passwd - C. Installing an EDR on the container's host with reporting configured to log to a centralized SIFM and Implementing the following alerting rules TF PBOCESS_USEB=rooC ALERT_TYPE=critical
- D. Designing a muiticontainer solution, with one set of containers that runs the mam application, and another set oi containers that perform automatic remediation by replacing compromised containers or disabling compromised accounts
Answer: B
Explanation:
Implementing the given commands in the Dockerfile ensures that the container runs with non-root user privileges. Running applications as a non-root user reduces the risk of privilege escalation attacks because even if an attacker compromises the application, they would have limited privileges and would not be able to perform actions that require root access.
* A. Implementing the following commands in the Dockerfile: This directly addresses the privilege escalation attack surface by ensuring the application does not run with elevated privileges.
* B. Installing an EDR on the container's host: While useful for detecting threats, this does not reduce the privilege escalation attack surface within the containerized application.
* C. Designing a multi-container solution: While beneficial for modularity and remediation, it does not specifically address privilege escalation.
* D. Running the container in an isolated network: This improves network security but does not directly reduce the privilege escalation attack surface.
References:
* CompTIA Security+ Study Guide
* Docker documentation on security best practices
* NIST SP 800-190, "Application Container Security Guide"
NEW QUESTION # 61
A news organization wants to implement workflows that allow users to request that untruthful data be retraced and scrubbed from online publications to comply with the right to be forgotten Which of the following regulations is the organization most likely trying to address'
- A. GDPR
- B. COPPA
- C. CCPA
- D. DORA
Answer: A
Explanation:
The General Data Protection Regulation (GDPR) is the regulation most likely being addressed by the news organization. GDPR includes provisions for the "right to be forgotten," which allows individuals to request the deletion of personal data that is no longer necessary for the purposes for which it was collected. This regulation aims to protect the privacy and personal data of individuals within the European Union.
References:
* CompTIA SecurityX Study Guide: Covers GDPR and its requirements, including the right to be forgotten.
* GDPR official documentation: Details the rights of individuals, including data erasure and the right to be forgotten.
* "GDPR: A Practical Guide to the General Data Protection Regulation" by IT Governance Privacy Team:
Provides a comprehensive overview of GDPR compliance, including workflows for data deletion requests.
NEW QUESTION # 62
A company that relies on an COL system must keep it operating until a new solution is available Which of the following is the most secure way to meet this goal?
- A. Isolating the system and enforcing firewall rules to allow access to only required endpoints
- B. Restricting system access to perform necessary maintenance by the IT team
- C. Enforcing strong credentials and improving monitoring capabilities
- D. Placing the system in a screened subnet and blocking access from internal resources
Answer: A
Explanation:
To ensure the most secure way of keeping a legacy system (COL) operating until a new solution is available, isolating the system and enforcing strict firewall rules is the best approach. This method minimizes the attack surface by restricting access to only the necessary endpoints, thereby reducing the risk of unauthorized access and potential security breaches. Isolating the system ensures that it is not exposed to the broader network, while firewall rules control the traffic that can reach the system, providing a secure environment until a replacement is implemented.
References:
* CompTIA SecurityX Study Guide: Recommends network isolation and firewall rules as effective measures for securing legacy systems.
* NIST Special Publication 800-82, "Guide to Industrial Control Systems (ICS) Security": Advises on isolating critical systems and using firewalls to control access.
* "Network Security Assessment" by Chris McNab: Discusses techniques for isolating systems and enforcing firewall rules to protect vulnerable or legacy systems.
By isolating the system and implementing strict firewall controls, the organization can maintain the necessary operations securely while working on deploying a new solution.
NEW QUESTION # 63
An organization wants to implement a platform to better identify which specific assets are affected by a given vulnerability. Which of the following components provides the best foundation to achieve this goal?
- A. CMDB
- B. SBoM
- C. SASE
- D. SLM
Answer: A
Explanation:
A Configuration Management Database (CMDB) provides the best foundation for identifying which specific assets are affected by a given vulnerability. A CMDB maintains detailed information about the IT environment, including hardware, software, configurations, and relationships between assets. This comprehensive view allows organizations to quickly identify and address vulnerabilities affecting specific assets.
References:
* CompTIA SecurityX Study Guide: Discusses the role of CMDBs in asset management and vulnerability identification.
* ITIL (Information Technology Infrastructure Library) Framework: Recommends the use of CMDBs for effective configuration and asset management.
* "Configuration Management Best Practices" by Bob Aiello and Leslie Sachs: Covers the importance of
* CMDBs in managing IT assets and addressing vulnerabilities.
NEW QUESTION # 64
A compliance officer is reviewing the data sovereignty laws in several countries where the organization has no presence Which of the following is the most likely reason for reviewing these laws?
- A. The organization has been subject to legal proceedings in countries where it has a presence.
- B. The organization is concerned with new regulatory enforcement in other countries
- C. The organization is performing due diligence of potential tax issues.
- D. The organization has suffered brand reputation damage from incorrect media coverage
Answer: B
Explanation:
Reviewing data sovereignty laws in countries where the organization has no presence is likely due to concerns about regulatory enforcement. Data sovereignty laws dictate how data can be stored, processed, and transferred across borders. Understanding these laws is crucial for compliance, especially if the organization handles data that may be subject to foreign regulations.
* A. The organization is performing due diligence of potential tax issues: This is less likely as tax issues are generally not directly related to data sovereignty laws.
* B. The organization has been subject to legal proceedings in countries where it has a presence:
While possible, this does not explain the focus on countries where the organization has no presence.
* C. The organization is concerned with new regulatory enforcement in other countries: This is the
* most likely reason. New regulations could impact the organization's operations, especially if they involve data transfers or processing data from these countries.
* D. The organization has suffered brand reputation damage from incorrect media coverage: This is less relevant to the need for reviewing data sovereignty laws.
References:
* CompTIA Security+ Study Guide
* GDPR and other global data protection regulations
* "Data Sovereignty: The Future of Data Protection?" by Mark Burdon
NEW QUESTION # 65
A company receives reports about misconfigurations and vulnerabilities in a third-party hardware device that is part of its released products. Which of the following solutions is the best way for the company to identify possible issues at an earlier stage?
- A. Implementing a proper supply chain risk management program
- B. Performing vulnerability tests on each device delivered by the providers
- C. Implementing a monitoring process for the integration between the application and the vendor appliance
- D. Performing regular red-team exercises on the vendor production line
Answer: A
Explanation:
Addressing misconfigurations and vulnerabilities in third-party hardware requires a comprehensive approach to manage risks throughout the supply chain. Implementing a proper supply chain risk management (SCRM) program is the most effective solution as it encompasses the following:
* Holistic Approach: SCRM considers the entire lifecycle of the product, from initial design through to delivery and deployment. This ensures that risks are identified and managed at every stage.
* Vendor Management: It includes thorough vetting of suppliers and ongoing assessments of their security practices, which can identify and mitigate vulnerabilities early.
* Regular Audits and Assessments: A robust SCRM program involves regular audits and assessments, both internally and with suppliers, to ensure compliance with security standards and best practices.
* Collaboration and Communication: Ensures that there is effective communication and collaboration between the company and its suppliers, leading to faster identification and resolution of issues.
Other options, while beneficial, do not provide the same comprehensive risk management:
* A. Performing vulnerability tests on each device delivered by the providers: While useful, this is reactive and only addresses issues after they have been delivered.
* B. Performing regular red-team exercises on the vendor production line: This can identify vulnerabilities but is not as comprehensive as a full SCRM program.
* C. Implementing a monitoring process for the integration between the application and the vendor appliance: This is important but only covers the integration phase, not the entire supply chain.
References:
* CompTIA SecurityX Study Guide
* NIST Special Publication 800-161, "Supply Chain Risk Management Practices for Federal Information Systems and Organizations"
* ISO/IEC 27036-1:2014, "Information technology - Security techniques - Information security for supplier relationships"
NEW QUESTION # 66
An organization wants to create a threat model to identity vulnerabilities in its infrastructure. Which of the following, should be prioritized first?
- A. External-facing Infrastructure with known exploited vulnerabilities
- B. Internal infrastructure with high-seventy and Known exploited vulnerabilities
- C. External facing Infrastructure with a low risk score and no known exploited vulnerabilities
- D. External-facing infrastructure with a high risk score that can only be exploited with local access to the resource
Answer: A
Explanation:
When creating a threat model to identify vulnerabilities in an organization's infrastructure, prioritizing external-facing infrastructure with known exploited vulnerabilities is critical. Here's why:
* Exposure to Attack: External-facing infrastructure is directly exposed to the internet, making it a primary target for attackers. Any vulnerabilities in this layer pose an immediate risk to the organization's security.
* Known Exploited Vulnerabilities: Vulnerabilities that are already known and exploited in the wild are of higher concern because they are actively being used by attackers. Addressing these vulnerabilities reduces the risk of exploitation significantly.
* Risk Mitigation: By prioritizing external-facing infrastructure with known exploited vulnerabilities, the organization can mitigate the most immediate and impactful threats, thereby improving overall security posture.
* References:
* CompTIA Security+ SY0-601 Study Guide by Mike Chapple and David Seidl
* NIST Special Publication 800-30: Guide for Conducting Risk Assessments
* OWASP Threat Modeling Cheat Sheet
NEW QUESTION # 67
......
CAS-005 are Available for Instant Access: https://www.prepawayexam.com/CompTIA/braindumps.CAS-005.ete.file.html
CAS-005 Dumps 2025 - New CompTIA CAS-005 Exam Questions: https://drive.google.com/open?id=1rqbCpFfCBMVOxlphgif5SWhG_BE-4Mk8