2026 Easily pass CAS-005 Exam with our Dumps & PDF Test Engine [Q240-Q254]

Rate this post

2026 Easily pass CAS-005 Exam with our Dumps & PDF Test Engine

CAS-005 PDF Pass Leader, CAS-005 Latest Real Test

Q240. An organization has deployed a cloud-based application that provides virtual event services globally to clients. During a typical event, thousands of users access various entry pages within a short period of time. The entry pages include sponsor-related content that is relatively static and is pulled from a database. When the first major event occurs, users report poor response time on the entry pages. Which of the following features is the most appropriate for the company to implement?

Horizontal scalability

Vertical scalability

Containerization

Static code analysis

Caching

Q241. A senior security engineer flags the following log file snippet as having likely facilitated an attacker’s lateral movement in a recent breach:
qry_source: 19.27.214.22 TCP/53
qry_dest: 199.105.22.13 TCP/53
qry_type: AXFR
| in comptia.org
———— directoryserver1 A 10.80.8.10
———— directoryserver2 A 10.80.8.11
———— directoryserver3 A 10.80.8.12
———— internal-dns A 10.80.9.1
———– www-int A 10.80.9.3
———— fshare A 10.80.9.4
———— sip A 10.80.9.5
———— msn-crit-apcs A 10.81.22.33
Which of the following solutions, if implemented, would mitigate the risk of this issue reoccurring?

Disabling DNS zone transfers

Restricting DNS traffic to UDP/53

Implementing DNS masking on internal servers

Permitting only clients from internal networks to query DNS

Q242. A security team determines that the most significant risks within the pipeline are:
– Unauthorized code changes
– The current inability to perform independent verification of software modules Which of the following best addresses these concerns?

Code signing

Digital signatures

Non-repudiation

Lightweight cryptography

Q243. Consultants for a company learn that customs agents at foreign border crossings are demanding device inspections. The company wants to:
* Minimize the risk to its data by storing its most sensitive data inside of a security container.
* Obfuscate containerized data on command.
Which of the following technologies is the best way to accomplish this goal?

SED

eFuse

UEFI

vTPM

MicroSD HSM

Q244. A security analyst is reviewing the following log:

Which of the following possible events should the security analyst investigate further?

A macro that was prevented from running

A text file containing passwords that were leaked

A malicious file that was run in this environment

A PDF that exposed sensitive information improperly

Q245. A security analyst needs to ensure email domains that send phishing attempts without previous communications are not delivered to mailboxes The following email headers are being reviewed

Which of thefollowing is the best action for the security analyst to take?

Block messages from hr-saas.com because it is not a recognized domain.

Reroute all messages with unusual security warning notices to the IT administrator

Quarantine all messages with sales-mail.com in the email header

Block vendor com for repeated attempts to send suspicious messages

In reviewing email headers and determining actions to mitigate phishing attempts, the security analyst should focus on patterns of suspicious behavior and the reputation of the sending domains. Here’s the analysis of the options provided:
A . Block messages from hr-saas.com because it is not a recognized domain: Blocking a domain solely because it is not recognized can lead to legitimate emails being missed. Recognition alone should not be the criterion for blocking.
B . Reroute all messages with unusual security warning notices to the IT administrator: While rerouting suspicious messages can be a good practice, it is not specific to the domain sending repeated suspicious messages.
C . Quarantine all messages with sales-mail.com in the email header: Quarantining messages based on the presence of a specific domain in the email header can be too broad and may capture legitimate emails.
D . Block vendor com for repeated attempts to send suspicious messages: This option is the most appropriate because it targets a domain that has shown a pattern of sending suspicious messages. Blocking a domain that repeatedly sends phishing attempts without previous communications helps in preventing future attempts from the same source and aligns with the goal of mitigating phishing risks.
Reference:
CompTIA SecurityX Study Guide: Details best practices for handling phishing attempts, including blocking domains with repeated suspicious activity.
NIST Special Publication 800-45 Version 2, “Guidelines on Electronic Mail Security”: Provides guidelines on email security, including the management of suspicious email domains.
“Phishing and Countermeasures: Understanding the Increasing Problem of Electronic Identity Theft” by Markus Jakobsson and Steven Myers: Discusses effective measures to counter phishing attempts, including blocking persistent offenders.
By blocking the domain that has consistently attempted to send suspicious messages, the security analyst can effectively reduce the risk of phishing attacks.

Q246. A hospital provides tablets to its medical staff to enable them to more quickly access and edit patients’ charts.
The hospital wants to ensure that if a tablet is Identified as lost or stolen and a remote command is issued, the risk of data loss can be mitigated within seconds. The tablets are configured as follows to meet hospital policy
* Full disk encryption is enabled
* “Always On” corporate VPN is enabled
* ef-use-backed keystore is enabled’ready.
* Wi-Fi 6 is configured with SAE.
* Location services is disabled.
*Application allow list is configured

Revoking the user certificates used for VPN and Wi-Fi access

Performing cryptographic obfuscation

Using geolocation to find the device

Configuring the application allow list to only per mil emergency calls

Returning on the device’s solid-state media to zero

Q247. A security officer performs due diligence activities before implementing a third-party solution into the enterprise environment. The security officer needs evidence from the third party that a data subject access request handling process is in place. Which of the following is the security officer most likely seeking to maintain compliance?

Information security standards

E-discovery requirements

Privacy regulations

Certification requirements

Reporting frameworks

Q248. A user reports application access issues to the help desk. The help desk reviews the logs for the user:

Which of the following is most likely the reason for the issue?

The user inadvertently tripped the geoblock rule in NGFW.

A threat actor has compromised the user’s account and attempted to log in.

The user is not allowed to access the human resources system outside of business hours.

The user did not attempt to connect from an approved subnet.

Q249. A company is concerned about the security of customer data. The IT department has configured all web applications with appropriate access controls to restrict to only authorized users. Which of the following solutions addresses this concern?

SIEM

Vulnerability scanner

DLP

Threat intelligence platform

Q250. An organization is prioritizing efforts to remediate or mitigate risks identified during the latest assessment.
For one of the risks, a full remediation was not possible, but the organization was able to successfully apply mitigations to reduce the likelihood of the impact. Which of the following should the organization perform next?

Assess the residual risk.

Update the organization’s threat model.

Move to the next risk in the register.

Recalculate the magnitude of the impact.

Q251. A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears:
Error Message in Database Connection
Connection to host USA-WebApp-Database failed
Database “Prod-DB01” not found
Table “CustomerInfo” not found
Please retry your request later
Which of the following best describes the analyst’s findings and a potential mitigation technique?

The findingsindicate unsecure Reference. All potential user input needs to be properly sanitized.

The findings indicate unsecure protocols. All cookies should be marked as HttpOnly.

The findings indicate information disclosure. The displayed error message should be modified.

The findings indicate a SQL injection. The database needs to be upgraded.

Q252. A company migrating to aremote work model requires that company-owned devices connect to a VPN before logging in to the device itself. The VPN gateway requires that a specific key extension is deployed to the machine certificates in the internal PKI. Which of the following best explains this requirement?

The certificate is an additional factor to meet regulatory MFA requirements for VPN access.

The VPN client selected the certificate with the correct key usage without user interaction.

The internal PKI certificate deployment allows for Wi-Fi connectivity before logging in to other systems.

The server connection uses SSL VPN, which uses certificates for secure communication.

Q253. An IPSec solution is being deployed. The configuration files for both the VPN concentrator and the AAA server are shown in the diagram.
Complete the configuration files to meet the following requirements:
* The EAP method must use mutual certificate-based authentication (With issued client certificates).
* The IKEv2 Cipher suite must be configured to the MOST secure
authenticated mode of operation,
* The secret must contain at least one uppercase character, one lowercase character, one numeric character, and one special character, and it must meet a minimum length requirement of eight characters, INSTRUCTIONS Click on the AAA server and VPN concentrator to complete the configuration.
Fill in the appropriate fields and make selections from the drop-down menus.

VPN Concentrator:

AAA Server:

Q254. A security professional is investigating a trend in vulnerability findings for newly deployed cloud systems Given the following output:

Which of the following actions would address the root cause of this issue?