Get CompTIA CAS-005 Exam Dumps

Answer : D

To meet the requirements of only allowing internally signed applications, preventing unauthorized software installations, and logging attempts to run unauthorized software, configuring application control with blocked hashes and enterprise-trusted root certificates is the best solution. This approach ensures that only applications signed by trusted certificates are allowed to execute, while all other attempts are blocked and logged. It effectively prevents unauthorized software installations by restricting execution to pre-approved applications.

CompTIA SecurityX Study Guide: Describes application control mechanisms and the use of trusted certificates to enforce security policies.

NIST Special Publication 800-53, 'Security and Privacy Controls for Information Systems and Organizations': Recommends application whitelisting and execution control for securing endpoints.

'The Application Security Handbook' by Mark Dowd, John McDonald, and Justin Schuh: Covers best practices for implementing application control and managing trusted certificates

Answer : C

The most secure way to prevent inadvertent data disclosure when encrypted SSDs are reused is to securely delete the encryption keys used by the SSD. Without the encryption keys, the data on the SSD remains encrypted and is effectively unreadable, rendering any residual data useless. This method is more reliable and efficient than overwriting data multiple times or using other physical destruction methods.

CompTIA SecurityX Study Guide: Highlights the importance of managing encryption keys and securely deleting them to protect data.

NIST Special Publication 800-88, 'Guidelines for Media Sanitization': Recommends cryptographic erasure as a secure method for sanitizing encrypted storage devices.

Answer : A

The log snippet indicates a DNS AXFR (zone transfer) request, which can be exploited by attackers to gather detailed information about an internal network's infrastructure. Disabling DNS zone transfers is the best solution to mitigate this risk. Zone transfers should generally be restricted to authorized secondary DNS servers and not be publicly accessible, as they can reveal sensitive network information that facilitates lateral movement during an attack.

CompTIA SecurityX Study Guide: Discusses the importance of securing DNS configurations, including restricting zone transfers.

NIST Special Publication 800-81, 'Secure Domain Name System (DNS) Deployment Guide': Recommends restricting or disabling DNS zone transfers to prevent information leakage.

Answer : B

The most likely cause of the anti-malware alerts on customer workstations is unsecure bundled libraries. When developing and deploying new applications, it is common for developers to use third-party libraries. If these libraries are not properly vetted for security, they can introduce vulnerabilities or malicious code.

Why Unsecure Bundled Libraries?

Third-Party Risks: Using libraries that are not secure can lead to malware infections if the libraries contain malicious code or vulnerabilities.

Code Dependencies: Libraries may have dependencies that are not secure, leading to potential security risks.

Common Issue: This is a frequent issue in software development where libraries are used for convenience but not properly vetted for security.

Other options, while relevant, are less likely to cause widespread anti-malware alerts:

A . Misconfigured code commit: Could lead to issues but less likely to trigger anti-malware alerts.

C . Invalid code signing certificate: Would lead to trust issues but not typically anti-malware alerts.

D . Data leakage: Relevant for privacy concerns but not directly related to anti-malware alerts.

CompTIA SecurityX Study Guide

'Securing Open Source Libraries,' OWASP

'Managing Third-Party Software Security Risks,' Gartner Research

Answer : D

Creating a separate network for users who need access to the application is the best action to secure an internal application that is critical to the production area and cannot be updated.

Why Separate Network?

Network Segmentation: Isolates the critical application from the rest of the network, reducing the risk of compromise and limiting the potential impact of any security incidents.

Controlled Access: Ensures that only authorized users have access to the application, enhancing security and reducing the attack surface.

Minimized Risk: Segmentation helps in protecting the application from vulnerabilities that could be exploited from other parts of the network.

Other options, while beneficial, do not provide the same level of security for a critical application:

A . Disallow wireless access: Useful but does not provide comprehensive protection.

B . Deploy intrusion detection capabilities using a network tap: Enhances monitoring but does not provide the same level of isolation and control.

C . Create an acceptable use policy: Important for governance but does not provide technical security controls.

CompTIA SecurityX Study Guide

NIST Special Publication 800-125, 'Guide to Security for Full Virtualization Technologies'

'Network Segmentation Best Practices,' Cisco Documentation