Free CompTIA CAS-003 Exam Dumps Questions & Answers

Which of the following BEST sets expectation between the security team and business units within an organization?

• A.  Memorandum of understanding
• B.  Risk assessment
• C.  Business impact analysis
• D.  Services level agreement
• E.  Business partnership agreement

An internal penetration tester was assessing a recruiting page for potential issues before it was pushed to the production website. The penetration tester discovers an issue that must be corrected before the page goes live. The web host administrator collects the log files below and gives them to the development team so improvements can be made to the security design of the website.

Which of the following types of attack vector did the penetration tester use?

• A.  Brute force
• B.  TOC/TOU
• C.  CSRF
• D.  SQL injection
• E.  XSS

A project manager is working with system owners to develop maintenance windows for system pathing and upgrades in a cloud-based PaaS environment. Management has indicated one maintenance windows will be authorized per month, but clients have stated they require quarterly maintenance windows to meet their obligations. Which of the following documents should the project manager review?

• A.  SOW
• B.  MOU
• C.  SRTM
• D.  SLA

A system engineer is reviewing output from a web application vulnerability scan. The engineer has determined data is entering the application from an untrusted source and is being used to construct a query dynamically. Which of the following code snippets would BEST protect the application against an SQL injection attack?
A)

B)

C)

D)

• A.  Option A
• B.  Option D
• C.  Option C
• D.  Option B

A security incident responder discovers an attacker has gained access to a network and has overwritten key system files with backdoor software. The server was reimaged and patched offline.
Which of the following tools should be implemented to detect similar attacks?

• A.  Vulnerability scanner
• B.  TPM
• C.  File integrity monitor
• D.  NIPS
• E.  Host-based firewall