CA1-005 Practice Test

CA1-005 Practice Test practice questions, page 3 of 5, with answer review and explanations.

Question 11

SIMULATION - You are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements: • The application does not need to know the users' credentials. • An approval interaction between the users and the HTTP service must be orchestrated. • The application must have limited access to users' data. INSTRUCTIONS - Use the drop-down menus to select the action items for the appropriate locations. All placeholders must be filled. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Question 12

A security analyst wants to use lessons learned from a prior incident response to reduce dwell time in the future. The analyst is using the following data points: Which of the following would the analyst most likely recommend?

  1. Adjusting the SIEM to alert on attempts to visit phishing sites
  2. Allowing TRACE method traffic to enable better log correlation
  3. Enabling alerting on all suspicious administrator behavior
  4. Utilizing allow lists on the WAF for all users using GET methods

Question 13

An organization recently implemented a policy that requires all passwords to be rotated every 90 days. An administrator sees a large volume of failed sign-on logs from multiple servers that are often accessed by users. The administrator determines users are disconnecting from the RDP session but not logging off. Which of the following should the administrator do to prevent account lockouts?

  1. Increase the account lockout threshold.
  2. Enforce password complexity.
  3. Force daily reboots.
  4. Extend the allowed session length.

Question 14

A security analyst is reviewing the following code in the public repository for potential risk concerns: Which of the following should the security analyst recommend first to remediate the vulnerability?

  1. Developing role-based security awareness training
  2. Revoking the secret used in the solution
  3. Purging code from public view
  4. Scanning the application with SAST

Question 15

During a recent assessment, a security analyst observed the following: Which of the following should the analyst use to address the vulnerabilities in the future?

  1. System image hardening
  2. Least privilege
  3. Defense in depth
  4. OS update