CAS004: Set 1

What should a security engineer recommend to meet the requirements of achieving 99.99% uptime, load time in 3 seconds, and response time <10 seconds?

• Employing bare-metal loading of applications

• Implementing server clusters

• Deploying a content delivery network

• Installing a firewall at corporate headquarters

What should a security analyst do FIRST upon receiving SIEM alerts about compromised accounts and exploited vulnerabilities?

• Disable Administrator on abc-uaa-fsl, the local account is compromised

• Shut down the abc-usa-fsl server, a plaintext credential is being used

• Disable the jdoe account, it is likely compromised

• Shut down abc-usa-fw01; the remote access VPN vulnerability is exploited

Which of the following should a managed security provider put in place to secure a cloud server environment similar to on-premises infrastructure?

• Microsegmentation

• Virtual next-generation firewall

• Web application firewall

• External vulnerability scans

What is the BEST solution a security architect can propose to improve security measures against the latest threats, including recognizing and blocking fake websites?

• Web filtering

• CASB

• EDR

• NGFW

Which technology would be the BEST option to improve the security of web applications running on in-house servers, including terminating SSL connections at a central location?

• API gateway

• ESB gateway

• XML gateway

• WAF

To prevent an outage due to DDoS attacks, what is the MOST important infrastructure security design element for a major broadcasting company requiring continuous availability to streaming content?

• Supporting heterogeneous architecture

• Leveraging content delivery network across multiple regions

• Ensuring cloud autoscaling is in place

• Scaling horizontally to handle increases in traffic

To identify weaknesses earlier in the development process and reduce the time to identify serverless application vulnerabilities, what would BEST accomplish the objectives of a SaaS startup maturing its DevSecOps program?

• RASP

• SAST

• WAF

• CMS

What is the BEST way for a government security team to comply with a new requirement for validating the integrity of downloaded files and the sender of the file?

• Message hash

• Message authentication code

• Message digest

• Digital signature

To ensure a secure chat application is not susceptible to on-path attacks while users are traveling in potentially hostile regions, what would BEST achieve that goal for a mobile application developer?

• Enable HSTS on the application's server side for all communication

• Deploy client certificates to all devices in the network

• Utilize the SAN certificate to enable a single certificate for all regions

• Configure certificate pinning inside the application

What is the BEST action for a network administrator to take to defend against a web attack targeting the server's file system?

• Validate that multifactor authentication is enabled on the server for all user accounts

• Validate that the server is not deployed with default account credentials

• Validate the server input and append the input to the base directory path

• Validate the server certificate and trust chain