Online Access Free CAS-005 Practice Test

A company was recently infected by malware. During the root cause analysis, the company determined that several users were installing their own applications. To prevent further compromises, the company has decided it will onlyallow authorized applications to run on its systems. Which of the following should the company implement?

• A.Signing
• B.Access control
• C.HIPS
• D.Permit listing

A security engineer is implementing a code signing requirement for all code developed by the organization.
Currently, the PKI only generates website certificates. Which of the following steps should the engineer perform first?

• A.Generate a wildcard certificate for the internal domain.
• B.Implement a SAN for all internal web applications.
• C.Recalculate a public/private key pair for the root CA.
• D.Add a new template on the internal CA with the correct attributes.

An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment's notice. Which of the following should the organization consider first to address this requirement?

• A.Design an appropriate warm site for business continuity.
• B.Hire additional on-call staff to be deployed if an event occurs.
• C.Implement a change management plan to ensure systems are using the appropriate versions.
• D.Identify critical business processes and determine associated software and hardware requirements.

An administrator needs to craft a single certificate-signing request for a web-server certificate. The server should be able to use the following identities to mutually authenticate other resources over TLS:
* wwwJnt.comptia.org
* webserver01.int.comptia.org
*10.5.100.10
Which of the following certificate fields must be set properly to support this objective?

• A.Extended key usage
• B.Organizational unit
• C.Subject alternative name
• D.Certificate extension

An attacker infiltrated the code base of a hardware manufacturer and inserted malware before the code was compiled. The malicious code is now running at the hardware level across a number of industries and sectors.
Which of the following categories best describes this type of vendor risk?

• A.SDLC attack
• B.Supply chain attack
• C.Side-load attack
• D.Remote code signing