CAS-005 Practice Test

CAS-005 Practice Test practice questions, page 6 of 20, with answer review and explanations.

Question 26

A retail organization wants to properly test and verify its capabilities to detect and/or prevent specific TTPs as mapped to the MITRE ATTACK framework specific to APTs. Which of the following should be used by the organization to accomplish this goal?

  1. Tabletop exercise
  2. Penetration test
  3. Sandbox detonation
  4. Honeypot

Question 27

IoCs were missed during a recent security incident due to the reliance on a signature-based detection platform. A security engineer must recommend a solution that can be implemented to address this shortcoming. Which of the following would be the most appropriate recommendation?

  1. FIM
  2. SASEC. UEBA
  3. CSPM
  4. EAP

Question 28

A company that provides services to clients who work with highly sensitive data would like to provide assurance that the data's confidentiality is maintained in a dynamic, low-risk environment. Which of the following would best achieve this goal? (Choose two.)

  1. Install a SOAR on all endpoints.
  2. Hash all files.
  3. Install SIEM within a SOC.
  4. Encrypt all data and files at rest, in transit, and in use.
  5. Configure SOAR to monitor and intercept files and data leaving the network.
  6. Implement file integrity monitoring.

Question 29

An organization wants to implement an access control system based on its data classification policy that includes the following data types: Confidential - Restricted - Internal - Public Flag for Review - The access control system should support SSO federation to map users into groups. Each group should only access systems that process and store data at the classification assigned to the group. Which of the following should the organization implement to enforce its requirements with a minimal impact to systems and resources?

  1. A tagging strategy in which all resources are assigned a tag based on the data classification type, and a system that enforces attribute-based access control
  2. Role-based access control that maps data types to internal roles, which are defined in the human resources department's source of truth system
  3. Network microsegmentation based on data types, and a network access control system enforcing mandatory access control based on the user principal
  4. A rule-based access control strategy enforced by the SSO system with rules managed by the internal LDAP and applied on a per-system basis

Question 30

A security analyst was monitoring the networks of a group of companies. The analyst identified several periods of concentrated, coordinated activity by unknown actors. The activity repeated at regular intervals and affected all the companies. Minor hardware outages that correlated with the same times as the discovered activity escalated in severity. Which of the following threat actors was most likely involved?

  1. An organized crime collective running a ransomware campaign
  2. A group of politically motivated hackers
  3. Disgruntled employees who were recently terminated
  4. An advanced persistent threat financed by a nation-state