CAS-004 practice questions, page 25 of 26, with answer review and explanations.
Question 121
A security analyst discovered that the company's WAF was not properly configured. The main web server was breached, and the following payload was found in one of the malicious requests: (&(objectClass=*)(objectClass=*))(&(objectClass=void)(type=admin)) Which of the following would BEST mitigate this vulnerability?
Network intrusion prevention
Data encoding
Input validation
CAPTCHA
Question 122
A security consultant needs to protect a network of electrical relays that are used for monitoring and controlling the energy used in a manufacturing facility. Which of the following systems should the consultant review before making a recommendation?
CAN
ASIC
FPGA
SCADA
Question 123
Company A acquired Company ׀’. During an audit, a security engineer found Company B's environment was inadequately patched. In response, Company A placed a firewall between the two environments until Company B's infrastructure could be integrated into Company A's security program. Which of the following risk-handling techniques was used?
Accept
Avoid
Transfer
Mitigate
Question 124
An organization is prioritizing efforts to remediate or mitigate risks identified during the latest assessment. For one of the risks, a full remediation was not possible, but the organization was able to successfully apply mitigations to reduce the likelihood of impact. Which of the following should the organization perform NEXT?
Assess the residual risk.
Update the organization's threat model.
Move to the next risk in the register.
Recalculate the magnitude of impact.
Question 125
A software house is developing a new application. The application has the following requirements: ✑ Reduce the number of credential requests as much as possible ✑ Integrate with social networks ✑ Authenticate users Which of the following is the BEST federation method to use for the application?