Online Access Free CAS-004 Practice Test

An enterprise is undergoing an audit to review change management activities when promoting code to production. The audit reveals the following:
* Some developers can directly publish code to the production environment.
* Static code reviews are performed adequately.
* Vulnerability scanning occurs on a regularly scheduled basis per policy.
Which of the following should be noted as a recommendation within the audit report?

• A.Perform periodic account reviews.
• B.Implement short maintenance windows.
• C.Implement job rotation.
• D.Improve separation of duties.

The Chief information Officer (CIO) asks the system administrator to improve email security at the company based on the following requirements:
* Transaction being requested by unauthorized individuals.
* Complete discretion regarding client names, account numbers, and investment information.
* Malicious attackers using email to malware and ransomeware.
* Exfiltration of sensitive company information.
The cloud-based email solution will provide anti-malware reputation-based scanning, signature-based scanning, and sandboxing. Which of the following is the BEST option to resolve the boar's concerns for this email migration?

• A.SSL VPN
• B.Data loss prevention
• C.Endpoint detection response
• D.Application whitelisting

A technology company developed an in-house chat application that is used only by developers. An open- source library within the application has been deprecated. The facts below are provided:
The cost of replacing this system is nominal.
The system provides no revenue to the business.
The system is not a critical part of the business.
Which of the following is the best risk mitigation strategy?

• A.Avoid the risk by shutting down this application and migrating to another chat platform.
• B.Mitigate the risk by purchasing an EDR and configuring network ACLs.
• C.Accept the risk, since any system disruption will only impact developers.
• D.Transfer the risk, since developers prefer using this chat application over alternatives.

The information security manager at a 24-hour manufacturing facility is reviewing a contract for potential risks to the organization. The contract pertains to the support of printers and multifunction devices during non- standard business hours. Which of the following will the security manager most likely identify as a risk?

• A.The lack of an MSA to govern other services provided by the service provider
• B.The lack of chain of custody for devices prior to deployment at the company
• C.The lack of an NDA with the company that supports its devices
• D.Print configurations settings for locked print jobs

The security team is looking into aggressive bot behavior that is resulting in performance issues on the web server After further investigation, the security engineer determines that the bot traffic is legitimate. Which of the following is the best course of action to reduce performance issues without allocating additional resources to the server?

• A.Monitor legitimate SEO bot traffic for abnormalities.
• B.Block all bot traffic using the IPS.
• C.Update robots.txt to slow down the crawling speed.
• D.Configure the WAF to rate-limit bot traffic.