CAS-005 Practice Test

Question 71

A security architect recommends replacing the company's monolithic software application with a containerized solution. Historically, secrets have been stored in the application's configuration files. Which of the following changes should the security architect make in the new system?

1. Use a secrets management tool.
2. Save secrets in key escrow.
3. Store the secrets inside the Dockerfiles.
4. Run all Dockerfiles in a randomized namespace.

Question 72

A security engineer is assessing a new tool to segment data and communications between domains. The assessment must determine how data transmission controls can be bypassed without detection. Which of the following techniques should the security engineer use?

1. Machine-learning statistical analysis
2. Fuzz testing
3. Covert channel analysis
4. Protocol analysis

Question 73

During an adversarial simulation exercise, an external team was able to gain access to sensitive information and systems without the organization detecting this activity. Which of the following mitigation strategies should the organization use to best resolve the findings?

1. Configuring a honeypot for adversary characterization
2. Leveraging simulators for attackers
3. Setting up a honey network for attackers
4. Utilizing decoy accounts and documents

Question 74

A help desk technician is troubleshooting an issue with an employee's laptop that will not boot into its operating system. The employee reported the laptop had been stolen but then found it one day later. The employee has asked the technician for help recovering important data. The technician has identified the following: The laptop operating system was not configured with BitLocker. The hard drive has no hardware failures. Data is present and readable on the hard drive, although it appears to be illegible. Which of the following is the most likely reason the technician is unable to retrieve legible data from the hard drive?

1. The employee's password was changed, and the new password needs to be used.
2. The PKI certificate was revoked, and a new one must be installed.
3. The hard drive experienced crypto-shredding.
4. The technician is using the incorrect cipher to read the data.

Question 75

SIMULATION - You are about to enter the virtual environment. DO NOT perform the following actions within the virtual environment. Making any of these changes will cause the virtual environment to fail and prevent proper scoring. 1. Disable ssh 2. Disable systemd 3. Alter the network adapter 172.162.0.0 4. Change the password on the lab admin account 5. Reboot the machine Once you have completed the item in the virtual environment, you will NOT be allowed to return to this item. TEST QUESTION - This system was recently patched following the exploitation of a vulnerability by an attacker to enable data exfiltration. Despite the vulnerability being patched, it is likely that a malicious TCP service is still running and the adversary has achieved persistence by creating a systemd service. Examples of commands to use: kill, killall lsof man, --help (use for assistance) netstat (useful flags: a, n, g, u) ps (useful flag: a) systemctl (to control systemd) Please note: the list of commands shown above is not exhaustive. All native commands are available. INSTRUCTIONS - Using the following credentials: • Username: labadmin • Password: Passw0rd! Investigate to identify indicators of compromise and then remediate them. You will need to make at least two changes: 1. End the compromised process that is using a malicious TCP service. 2. Remove the malicious persistence agent by disabling the service's ability to start on boot.