CAS-004-Set1(1of2)

Starting with the computing environment, which of the following should a security engineer recommend to BEST meet the requirements?

• Implementing server clusters

• Employing bare-metal loading of applications

• Installing a firewall at corporate headquarters

• Deploying a content delivery network

Which of the following should the security analyst do FIRST?

• Disable Administrator on abc-uaa-fsl, the local account is compromised

• Shut down the abc-usa-fsl server, a plaintext credential is being used

• Shut down abc-usa-fw01; the remote access VPN vulnerability is exploited

• Disable the jdoe account, it is likely compromised

A managed security provider (MSP) is engaging with a customer who was working through a complete digital transformation. Part of this transformation involves a move to cloud servers to ensure a scalable, high-performance, online user experience. Which of the following should the MSP put in place to BEST meet this objective? (Select THREE)

• Software-defined WAN

• Microsegmentation

• Virtual next-generation firewall

• Web application firewall

A bank hired a security architect to improve its security measures against the latest threats The solution must meet the following requirements * Recognize and block fake websites

* Decrypt and scan encrypted traffic on standard and non-standard ports

* Use multiple engines for detection and prevention

* Have central reporting. Which of the following is the BEST solution the security architect can propose?

• Web filtering

• CASB

• NGFW

• EDR

A company wants to improve the security of its web applications that are running on in-house servers A riskassessment has been performed and the following capabilities are desired:

* Terminate SSL connections at a central location

* Manage both authentication and authorization for incoming and outgoing web service calls

* Advertise the web service API

* Implement DLP and anti-malware features Which of the following technologies will be the BEST option?

• XML gateway

• WAF

• ESB gateway

• API gateway

A major broadcasting company that requires continuous availability to streaming content needs to be resilient against DDoS attacks Which of the following is the MOST important infrastructure security design element to prevent an outage. Which of the following is the MOST important infrastructure security design element to prevent an outage?

• Leveraging content delivery network across multiple regions

• Scaling horizontally to handle increases in traffic

• Ensuring cloud autoscaling is in place

• Supporting heterogeneous architecture

A SaaS startup is maturing its DevSecOps program and wants to identify weaknesses earlier in the developmen tprocess in order to reduce the average time to identify serverless application vulnerabilities and the costs associated with remediation The startup began its early security testing efforts with DAST to cover public-facing application components and recently implemented a bug bounty program Which of the following will BEST accomplish the company's objectives?

• WAF

• SAST

• RASP

• CMS

A new requirement for legislators has forced a government security team to develop a validation process to verify the integrity of a downloaded file and the sender of the file Which of the following is the BEST way for the security team to comply with this requirement?

• Message authentication code

• Digital signature

• Message hash

• Message digest

A mobile application developer is creating a global, highly scalable, secure chat application. The developer wouldlike to ensure the application is not susceptible to on-path attacks while the user is traveling in potentially hostileregions. Which of the following would BEST achieve that goal?

• Utilize the SAN certificate to enable a single certificate for all regions

• Deploy client certificates to all devices in the network

• Enable HSTS on the application's server side for all communication

• Configure certificate pinning inside the application

A network administrator who manages a Linux web server notices the following traffic:

http://corr.ptia.org/.../.../.../... /etc./shadow

Which of the following Is the BEST action for the network administrator to take to defend against this type of web attack?

• Validate that multifactor authentication is enabled on the server for all user accounts

• Validate that the server is not deployed with default account credentials

• Validate the server input and append the input to the base directory path

• Validate the server certificate and trust chain