Download CAS-005 Dumps (2026) – Free PDF Exam Demo [Q206-Q227]

QUESTION 206
A company’s help desk is experiencing a large number of calls from the finance department slating access issues to www bank com The security operations center reviewed the following security logs:

Which of the following is most likely the cause of the issue?

QUESTION 207
A security architect is mitigating a vulnerability that previously led to a web application data breach. An analysis into the root cause of the issue finds the following:
– An administrator’s account was hijacked and used on several
Autonomous System Numbers within 30 minutes.
– All administrators use named accounts that require multifactor
authentication.
– Single sign-on is used for all company applications.
Which of the following should the security architect do to mitigate the issue?

QUESTION 208
A company finds logs with modified time stamps when compared to other systems. The security team decides to improve logging and auditing for incident response. Which of the following should the team do to best accomplish this goal?

QUESTION 209
After some employees are caught uploading data to online personal storage accounts, a company becomes concerned about data leaks related to sensitive, internal documentation.
Which of the following would the company most likely do to decrease this type of risk?

QUESTION 210
A social media company wants to change encryption ciphers after identifying weaknesses in the implementation of the existing ciphers. The company needs the new ciphers to meet the following requirements:
* Utilize less RAM than competing ciphers.
* Be more CPU-efficient than previous ciphers.
* Require customers to use TLS 1.3 while broadcasting video or audio.
Which of the following is the best choice for the social media company?

QUESTION 211
After an incident response exercise, a security administrator reviews the following table:

Which of the following should the administrator do to beat support rapid incident response in the future?

QUESTION 212
A subcontractor develops safety critical avionics software for a major aircraft manufacturer. After an incident, a third-party investigator recommends the company begin to employ formal methods in the development life cycle. Which of the following findings from the investigation most directly supports the investigator’s recommendation?

QUESTION 213
An analyst needs to evaluate all images and documents that are publicly shared on a website.
Which of the following would be the best tool to evaluate the metadata of these files?

QUESTION 214
A company’s help desk is experiencing a large number of calls from the finance department stating access issues to www.bank.com. The security operations center reviewed the following security logs:

Which of the following is most likely the cause of the issue?

QUESTION 215
A software development team requires valid data for internal tests. Company regulations, however do not allow the use of this data in cleartext. Which of the following solutions best meet these requirements?

QUESTION 216
A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes. The following email headers are being reviewed:

Which of the following is the best action for the security analyst to take?

QUESTION 217
A subcontractor develops safety critical avionics software for a major aircraft manufacturer. After an incident, a third-party investigator recommends the company begin to employ formal methods in the development life cycle. Which of the following findings from the investigation most directly supports the investigator’s recommendation?

QUESTION 218
A security engineer must integrate device attestation into user authentication and authorization workflows for mobile devices. Which of the following best meets the requirements?

QUESTION 219
A malicious actor exploited firmware vulnerabilities and used rootkits in an attack on an organization. After the organization recovered from the incident, an engineer needs to recommend a solution that reduces the likelihood of the same type of attack in the future. Which of the following is the most relevant solution?

QUESTION 220
An organization must provide access to its internal system data. The organization requires that this access complies with the following:
– Access must be automated.
– Data confidentiality must be preserved.
– Access must be authenticated.
– Data must be preprocessed before it is retrieved.
Which of the following actions should the organization take to meet these requirements?

QUESTION 221
Recent repents indicate that a software tool is being exploited Attackers were able to bypass user access controls and load a database. A security analyst needs to find the vulnerability and recommend a mitigation. The analyst generates the following output:

Which of the following would the analyst most likely recommend?

QUESTION 222
SIMULATION
[Security Engineering and Cryptography]
An IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.
Complete the configuration files to meet the following requirements:
* The EAP method must use mutual certificate-based authentication (With issued client certificates).
* The IKEv2 Cipher suite must be configured to the MOST secure
authenticated mode of operation,
* The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimumlength requirement of eight characters, INSTRUCTIONS Click on the AAA server and VPN concentrator to complete the configuration.
Fill in the appropriate fields and make selections from the drop-down menus.

VPN Concentrator:

AAA Server:

QUESTION 223
A company designs policies and procedures for hardening containers deployed in the production environment. However, a security assessment reveals that deployed containers are not complying with the security baseline. Which of the following solutions best addresses this issue throughout early life-cycle stages?

QUESTION 224
During a recent audit, a company’s systems were assessed. Given the following information:

Which of the following is the best way to reduce the attack surface?

QUESTION 225
An endpoint security engineer finds that a newly acquired company has a variety of non-standard applications running and no defined ownership for those applications. The engineer needs to find a solution thatrestricts malicious programs and software from running in that environment, while allowing the non-standard applications to function without interruption. Which of the following application control configurations should the engineer apply?

QUESTION 226
A hospital provides tablets to its medical staff to enable them to more quickly access and edit patients’ charts. The hospital wants to ensure that if a tablet is identified as lost or stolen and a remote command is issued, the risk of data loss can be mitigated within seconds. The tablets are configured as follows to meet hospital policy:
– Full disk encryption is enabled.
– “Always On” corporate VPN is enabled.
– eFuse-backed keystore is enabled/ready.
– Wi-Fi 6 is configured with SAE.
– Location services is disabled.
– Application allow list is unconfigured.
Assuming the hospital policy cannot be changed, which of the following is the best way to meet the hospital’s objective?

QUESTION 227
A security architect is investigating instances of employees who had their phones stolen in public places through seemingly targeted attacks. Devices are able to access company resources such as email and internal documentation, some of which can persist in application storage. Which of the following would best protect the company from information exposure? (Select two).