Updated May-2026 CAS-004 Exam Practice Test Questions
Verified CAS-004 dumps Q&As 100% Pass in First Attempt Guaranteed Updated Dump
NEW QUESTION # 128
A managed security provider (MSP) is engaging with a customer who was working through a complete digital transformation. Part of this transformation involves a move to cloud servers to ensure a scalable, high-performance, online user experience. The current architecture includes:
- Directory servers
- Web servers
- Database servers
- Load balancers
- Cloud-native VPN concentrator
- Remote access server
The MSP must secure this environment similarly to the infrastructure on premises. Which of the following should the MSP put in place to BEST meet this objective? (Choose three.)
- A. External vulnerability scans
- B. Software-defined WAN
- C. Containers
- D. Content delivery network
- E. Virtual next-generation firewall
- F. Web application firewall
Answer: A,E,F
NEW QUESTION # 129
A company wants to protect its intellectual property from theft. The company has already applied ACLs and DACs.
Which of the following should the company use to prevent data theft?
- A. Access logging
- B. Watermarking
- C. NDA
- D. DRM
Answer: D
Explanation:
DRM prevents theft of IP either done deliberately or unintentionally.
NEW QUESTION # 130
A company wants to quantify and communicate the effectiveness of its security controls but must establish measures. Which of the following is MOST likely to be included in an effective assessment roadmap for these controls?
- A. Perform a security control assessment.
- B. Create a change management process.
- C. Create an integrated master schedule.
- D. Establish key performance indicators.
- E. Develop a communication plan.
Answer: C
NEW QUESTION # 131
A security analyst notices a number of SIEM events that show the following activity:
Which of the following response actions should the analyst take FIRST?
- A. Disable local administrator privileges on the endpoints.
- B. Configure the forward proxy to block 40.90.23.154.
- C. Disable powershell.exe on all Microsoft Windows endpoints.
- D. Restart Microsoft Windows Defender.
Answer: B
Explanation:
Stop the data exfiltration and sever all malicious traffic first, and then clean up the internal mess.
NEW QUESTION # 132
A networking team was asked to provide secure remote access to all company employees. The team decided to use client-to-site VPN as a solution. During a discussion, the Chief Information Security Officer raised a security concern and asked the networking team to route the Internet traffic of remote users through the main office infrastructure. Doing this would prevent remote users from accessing the Internet through their local networks while connected to the VPN.
Which of the following solutions does this describe?
- A. Full tunneling
- B. Split tunneling
- C. Asymmetric routing
- D. SSH tunneling
Answer: A
Explanation:
The concern is users operating in a spit tunnel config which is what is being described. Using a Full Tunnel would route traffic from all applications through a single tunnel. https://cybernews.com/what-is-vpn/split-tunneling/
NEW QUESTION # 133
After a security incident, a network security engineer discovers that a portion of the company's sensitive external traffic has been redirected through a secondary ISP that is not normally used.
Which of the following would BEST secure the routes while allowing the network to function in the event of a single provider failure?
- A. Implement an inbound BGP prefix list.
- B. Disable BGP and implement OSPF.
- C. Implement a BGP route reflector.
- D. Disable BGP and implement a single static route for each internal network.
Answer: A
Explanation:
Defenses against BGP hijacks include IP prefix filtering, meaning IP address announcements are sent and accepted only from a small set of well-defined autonomous systems, and monitoring Internet traffic to identify signs of abnormal traffic flows.
NEW QUESTION # 134
A large number of emails have been reported, and a security analyst is reviewing the following information from the emails:
As part of the image process, which of the following is the FIRST step the analyst should take?
- A. Block the email address carl b@comptia1 com, as it is sending spam to subject matter experts
- B. Compare the 'Return-Path" and "Received" fields.
- C. Validate the final "Received" header against the DNS entry of the domain.
- D. Ignore the emails, as SPF validation is successful, and it is a false positive
Answer: B
NEW QUESTION # 135
A company hosts a large amount of data in blob storage for its customers. The company recently had a number of issues with this data being prematurely deleted before the scheduled backup processes could be completed.
The management team has asked the security architect for a recommendation that allows blobs to be deleted occasionally, but only after a successful backup. Which of the following solutions will BEST meet this requirement?
- A. Mirror the blobs at a local data center.
- B. Make the blob immutable.
- C. Enable fast recovery on the storage account.
- D. Implement soft delete for blobs.
Answer: D
Explanation:
Explanation
Soft delete allows blobs to be deleted, but the data remains accessible for a period of time before it is permanently deleted. This allows the company to delete blobs as needed, while still affording enough time for the backup process to complete. After the backup process is complete, the blobs can be permanently deleted.
NEW QUESTION # 136
A security auditor needs to review the manner in which an entertainment device operates. The auditor is analyzing the output of a port scanning tool to determine the next steps in the security review. Given the following log output.
The best option for the auditor to use NEXT is:
- A. Network interception.
- B. Reverse engineering
- C. A SCAP assessment.
- D. Fuzzing
Answer: C
NEW QUESTION # 137
A security analyst notices a number of SIEM events that show the following activity:
Which of the following response actions should the analyst take FIRST?
- A. Configure the forward proxy to block 40.90.23.154.
- B. Disable local administrator privileges on the endpoints.
- C. Disable powershell.exe on all Microsoft Windows endpoints.
- D. Restart Microsoft Windows Defender.
Answer: C
NEW QUESTION # 138
A security engineer wants to introduce key stretching techniques to the account database to make password guessing attacks more difficult.
Which of the following should be considered to achieve this? (Choose two)
- A. P-384
- B. Perfect forward secrecy
- C. Digital signature
- D. PBKDF2
- E. bcrypt
- F. SHA-256
- G. Record-level encryption
Answer: D,E
NEW QUESTION # 139
A security consultant needs to protect a network of electrical relays that are used for monitoring and controlling the energy used in a manufacturing facility.
Which of the following systems should the consultant review before making a recommendation?
- A. CAN
- B. SCADA
- C. FPGA
- D. ASIC
Answer: B
Explanation:
Reference: https://www.sciencedirect.com/topics/computer-science/protective-relay
NEW QUESTION # 140
Due to a recent acquisition, the security team must find a way to secure several legacy applications. During a review of the applications, the following issues are documented:
- The applications are considered mission-critical.
- The applications are written in code languages not currently
supported by the development staff.
- Security updates and patches will not be made available for the
applications.
- Username and passwords do not meet corporate standards.
- The data contained within the applications includes both PII and PHI.
- The applications communicate using TLS 1.0.
- Only internal users access the applications.
Which of the following should be utilized to reduce the risk associated with these applications and their current architecture?
- A. Use network segmentation to isolate the applications and control access.
- B. Create a group policy to enforce password complexity and username requirements.
- C. Update the company policies to reflect the current state of the applications so they are not out of compliance.
- D. Move the applications to virtual servers that meet the password and account standards.
Answer: D
NEW QUESTION # 141
A security engineer discovers a PC may have been breached and accessed by an outside agent.
The engineer wants to find out how this breach occurred before remediating the damage.
Which of the following should the security engineer do FIRST to begin this investigation?
- A. Create an image of the hard drive
- B. Parse the PC logs for information on the attacker.
- C. Dump the contents of the RAM
- D. Capture the incoming and outgoing network traffic
Answer: A
NEW QUESTION # 142
A security team is concerned with attacks that are taking advantage of return-oriented programming against the company's public-facing applications. Which of the following should the company implement on the public-facing servers?
- A. HSM
- B. ASLR
- C. TPM
- D. IDS
Answer: B
Explanation:
Address Space Layout Randomization (ASLR) is a security feature that randomizes the memory addresses used by system and application processes, making return-oriented programming (ROP) attacks more difficult to exploit. ROP relies on predictable memory locations, and ASLR disrupts this predictability by randomizing memory locations at runtime. Implementing ASLR on public-facing servers helps mitigate this attack vector.
NEW QUESTION # 143
A junior developer is informed about the impact of new malware on an Advanced RISC Machine (ARM) CPU, and the code must be fixed accordingly. Based on the debug, the malware is able to insert itself in another process memory location.
Which of the following technologies can the developer enable on the ARM architecture to prevent this type of malware?
- A. Execute never
- B. Total memory encryption
- C. No-execute
- D. Virtual memory encryption
Answer: A
Explanation:
Execute never is a technology that can be enabled on the ARM architecture to prevent malware from inserting itself in another process memory location and executing code. Execute never is a feature that allows each memory region to be tagged as not containing executable code by setting the execute never (XN) bit in the translation table entry. If the XN bit is set to 1, then any attempt to execute an instruction in that region results in a permission fault. If the XN bit is cleared to 0, then code can execute from that memory region.
Execute never also prevents speculative instruction fetches from memory regions that are marked as non- executable, which can avoid undesirable side-effects or vulnerabilities. By enabling execute never, the developer can protect the process memory from being hijacked by malware. Verified References:
* https://developer.arm.com/documentation/ddi0360/f/memory-management-unit/memory-access-control
/execute-never-bits
* https://developer.arm.com/documentation/den0013/d/The-Memory-Management-Unit/Memory- attributes/Execute-Never
* https://developer.arm.com/documentation/ddi0406/c/System-Level-Architecture/Virtual-Memory- System-Architecture-VMSA-/Memory-access-control/Execute-never-restrictions-on-instruction- fetching
NEW QUESTION # 144
SIMULATION
You are a security analyst tasked with interpreting an Nmap scan output from company's privileged network.
The company's hardening guidelines indicate the following:
There should be one primary server or service per device.
Only default ports should be used.
Non-secure protocols should be disabled.
INSTRUCTIONS
Using the Nmap output, identify the devices on the network and their roles, and any open ports that should be closed.
For each device found by Nmap, add a device entry to the Devices Discovered list, with the following information:
The IP address of the device
The primary server or service of the device (Note that each IP should by associated with one service/port only) The protocol(s) that should be disabled based on the hardening guidelines (Note that multiple ports may need to be closed to comply with the hardening guidelines) If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Answer:
Explanation:
10.1.45.65 SFTP Server Disable 8080
10.1.45.66 Email Server Disable 415 and 443
10.1.45.67 Web Server Disable 21, 80
10.1.45.68 UTM Appliance Disable 21
NEW QUESTION # 145
In a cloud environment, the provider offers relief to an organization's teams by sharing in many of the operational duties. In a shared responsibility model, which of the following responsibilities belongs to the provider in a Paas implementation?
- A. Application-specific data assets
- B. Application-specific logic and code
- C. Application user access management
- D. Application/platform software
Answer: D
Explanation:
A) Application-specific data assets are the responsibility of the organization in a PaaS implementation. The organization owns and controls its own data and must ensure its confidentiality, integrity, and availability. The organization must also comply with any applicable data protection laws and regulations.
B) Application user access management is the responsibility of the organization in a PaaS implementation. The organization must define and enforce its own policies and procedures for granting, revoking, and monitoring access to its applications and data. The organization must also ensure that its users follow security best practices such as strong passwords and multifactor authentication.
C) Application-specific logic and code are the responsibility of the organization in a PaaS implementation. The organization must develop, test, deploy, and manage its own applications using the tools and services provided by the platform. The organization must also ensure that its applications are secure, reliable, and performant.
https://www.techtarget.com/searchcloudcomputing/feature/The-cloud-shared-responsibility-model-for-IaaS-PaaS-and-SaaS Explanation:
In a PaaS implementation, the provider offers relief to the organization's teams by sharing in many of the operational duties related to the application/platform software. The provider is responsible for securing and maintaining the underlying infrastructure, operating systems, middleware, runtime environments, and other software components that support the platform and the applications running on it. The provider also handles tasks such as patching, updating, scaling, and backing up the platform software.
NEW QUESTION # 146
A security architect is analyzing an old application that is not covered for maintenance anymore because the software company is no longer in business. Which of the following techniques should have been implemented to prevent these types of risks?
- A. Supply chain visibility
- B. Code reviews
- C. Source code escrows
- D. Software audits
Answer: C
Explanation:
A source code escrow is a legal agreement that involves a third party holding the source code of a software application on behalf of the software vendor and the software licensee. The source code escrow ensures that the licensee can access the source code in case the vendor goes out of business, fails to provide maintenance or support, or breaches the contract terms. A source code escrow would have prevented the risk of having an old application that is not covered for maintenance anymore because the software company is no longer in business, because it would:
Allow the licensee to obtain the source code and continue to update, fix, or modify the application according to their needs.
Protect the vendor's intellectual property rights and prevent unauthorized disclosure or use of the source code.
Provide a legal framework and a trusted mediator for resolving any disputes or issues between the vendor and the licensee.
NEW QUESTION # 147
An architect is designing security scheme for an organization that is concerned about APTs. Any proposed architecture must meet the following requirements:
- Services must be able to be reconstituted quickly from a known-good
state.
- Network services must be designed to ensure multiple diverse layers
of redundancy.
- Defensive and responsive actions must be automated to reduce human
operator demands.
Which of the following designs must be considered to ensure the architect meets these requirements? (Choose three.)
- A. Increased efficiency by embracing advanced caching capabilities
- B. Hardened and verified container usage
- C. Implementation and configuration of a SOAR
- D. Establishment of warm and hot sites for continuity of operations
- E. Geographic distribution of critical data and services
- F. Emulated hardware architecture usage
- G. Deployment of IPS services that can identify and block malicious traffic
- H. Heterogeneous architecture
Answer: B,C,E
Explanation:
B: Geographic distribution of critical data and services will ensure that multiple sites are available to restore data and services in the event of an APT attack. This will also reduce the impact of DDoS attacks by ensuring that traffic is spread across multiple sites.
C: Hardened and verified container usage can help to isolate services from one another and protect them from APT attacks. Containerization can provide a secure and scalable platform for deploying services, which can be reconstituted quickly from a known-good state.
H: Implementation and configuration of a SOAR platform will automate the process of responding to and mitigating APT attacks. The SOAR platform will allow the organization to create a set of automated actions that can be executed in response to security events, reducing the human operator demands.
NEW QUESTION # 148 
Answer:
Explanation:
An organization is planning for disaster recovery and continuity of operations.
INSTRUCTIONS
Review the following scenarios and instructions. Match each relevant finding to the affected host.
After associating scenario 3 with the appropriate host(s), click the host to select the appropriate corrective action for that finding.
Each finding may be used more than once.
If at any time you would like to bring back the initial state of the simul-ation, please click the Reset All button.
NEW QUESTION # 149
Which of the following is the most effective approach to prevent the reoccurrence of unexpected systems in an organization's environment?
- A. Reduce the costs associated with performing risk assessments.
- B. Update the company's risk profile.
- C. Continuously monitor key risk indicators.
- D. Minimize errors in the risk assessment metrics.
Answer: C
Explanation:
* Option C (Continuously monitor key risk indicators): Continuously monitoring key risk indicators (KRIs) ensures real-time visibility of changes in the attack surface, allowing for prompt identification of unexpected systems and minimizing risk.
* Option A (Update the risk profile): Updating the risk profile reflects current risks but does not actively prevent the reoccurrence of unexpected systems.
* Option B (Minimize errors in metrics): Reducing errors in metrics is useful for accuracy but does not directly address attack surface management.
* Option D (Reduce assessment costs): Reducing costs does not mitigate or prevent the reoccurrence of external-facing systems.
References:
* CompTIA CASP+ Exam Objective 1.4: Conduct ongoing monitoring of the attack surface and risk indicators.
* CASP+ Study Guide, 5th Edition, Chapter 2, Risk Management and Continuous Monitoring.
NEW QUESTION # 150
A company just released a new video card. Due to limited supply and nigh demand, attackers are employing automated systems to purchase the device through the company's web store so they can resell it on the secondary market. The company's Intended customers are frustrated. A security engineer suggests implementing a CAPTCHA system on the web store to help reduce the number of video cards purchased through automated systems. Which of the following now describes the level of risk?
- A. Transferred
- B. Inherent
Low - C. Residual
- D. Mitigated
Answer: B
NEW QUESTION # 151
A security auditor needs to review the manner in which an entertainment device operates. The auditor is analyzing the output of a port scanning tool to determine the next steps in the security review. Given the following log output.
The best option for the auditor to use NEXT is:
- A. Reverse engineering
- B. A SCAP assessment.
- C. Network interception.
- D. Fuzzing
Answer: C
NEW QUESTION # 152
An attack team performed a penetration test on a new smart card system. The team demonstrated that by subjecting the smart card to high temperatures, the secret key could be revealed.
Which of the following side-channel attacks did the team use?
- A. Differential fault analysis
- B. Differential timing analysis
- C. Differential power analysis
- D. Differential temperature analysis
Answer: A
Explanation:
"Differential fault analysis (DFA) is a type of active side-channel attack in the field of cryptography, specifically cryptanalysis. The principle is to induce faults-unexpected environmental conditions-into cryptographic operations, to reveal their internal states."
NEW QUESTION # 153
......
Ultimate Guide to Prepare Free CAS-004 Exam Questions and Answer: https://drive.google.com/open?id=1UcKyM2bYAhLlgKZlLq-LG55cdA65SmrX
Pass CompTIA CASP CAS-004 Exam With 620 Questions: https://www.validvce.com/CAS-004-exam-collection.html
