CAS-005 Practice Test

CAS-005 Practice Test practice questions, page 4 of 20, with answer review and explanations.

Question 16

Which of the following best explain why organizations prefer to utilize code that is digitally signed? (Choose two.)

  1. It provides origin assurance.
  2. It verifies integrity.
  3. It provides increased confidentiality.
  4. It integrates with DRMs.
  5. It verifies the recipient's identity.
  6. It ensures the code is free of malware.

Question 17

A security engineer receives reports through the organization's bug bounty program about remote code execution in a specific component in a custom application. Management wants to properly secure the component and proactively avoid similar issues. Which of the following is the best approach to uncover additional vulnerable paths in the application?

  1. Leverage an exploitation framework to uncover vulnerabilities.
  2. Use fuzz testing to uncover potential vulnerabilities in the application.
  3. Utilize a software composition analysis tool to report known vulnerabilities.
  4. Reverse engineer the application to look for vulnerable code paths.
  5. Analyze the use of an HTTP intercepting proxy to dynamically uncover issues.

Question 18

A security technician is investigating a system that tracks inventory via a batch update each night. The technician is concerned that the system poses a risk to the business, as errors are occasionally generated and reported inventory appears incorrect. The following output log is provided: The technician reviews the output of the batch job and discovers that the inventory was never less than zero, and the final inventory was 100 rather than 60. Which of the following should the technician do to resolve this issue?

  1. Ensure that the application is using memory-safe functions to prevent integer overflows.
  2. Recommend thread-safe processes in the code to eliminate race conditions.
  3. Require the developers to include exception handlers to accommodate out-of-bounds results.
  4. Move the batch processing from client side to server side to remove client processing inconsistencies.

Question 19

A programmer is reviewing the following proprietary piece of code that was identified as a vulnerability due to users being authenticated when they provide incorrect credentials: Which of the following should the programmer implement to remediate the code vulnerability?

  1. Salted hashing via the proprietary SHASH function
  2. Input validation in the first two lines of code
  3. Atomic execution of subroutines
  4. TOCTOU remediation in SET USERACL
  5. Database connection over encrypted channels

Question 20

A senior cybersecurity engineer is solving a digital certificate issue in which the CA denied certificate issuance due to failed subject identity validation. At which of the following steps within the PKI enrollment process would the denial have occurred?

  1. RAB. OCSP
  2. CA
  3. IdP