Online Access Free CAS-004 Practice Test

Which of the following is the reason why security engineers often cannot upgrade the security of embedded facility automation systems?

• A.They are constrained by available compute.
• B.They lack X86-64 processors.
• C.They are not logic-bearing devices.
• D.They lack EEPROM.

A security analyst observes the following while looking through network traffic in a company's cloud log:

Which of the following steps should the security analyst take FIRST?

• A.Isolate 10.0.50.6 via security groups.
• B.Quarantine 10.0.5.52 and run a malware scan against the host.
• C.Investigate web logs on 10.0.50.6 to determine if this is normal traffic.
• D.Access 10.0.5.52 via EDR and identify processes that have network connections.

The findings from a recent penetration test report indicate a systematic issue related to cross-site scripting (XSS). A security engineer would like to prevent this type of issue for future reports. Which of the following mitigation strategies should the engineer use to best resolve the issue?

• A.Implement static analysis with blocking capabilities in the CI/CD system.
• B.Configure a DAST tool for all applications.
• C.Request resources to develop a secure library to address encoding issues.
• D.Require all developers to take secure coding training that focuses on OWASP principles.
• E.Leverage an API management system to filter information.

A security engineer needs to implement a cost-effective authentication scheme for a new web-based application that requires:
*Rapid authentication
*Flexible authorization
*Ease of deployment
*Low cost but high functionality
Which of the following approaches best meets these objectives?

• A.OAuth
• B.EAP
• C.SAML
• D.Kerberos
• E.TACACS+

The Chief Information Security Officer of a large multinational organization has asked the security risk manager to use risk scenarios during a risk analysis. Which of the following is the most likely reason for this approach?

• A.To present a comprehensive view of risk
• B.To connect risks to business objectives
• C.To ensure a consistent approach to risk
• D.To provide context to the relevancy of risk