Free CompTIA CAS-005 Exam Dumps Questions & Answers

During a security review for the CI/CD process, a security engineer discovers the following information in a testing repository from the company:

Which of the following options is the best countermeasure to prevent this issue in the future?

• A.  Automating the upload process of code to the repository and improving the software development life cycle
• B.  Using a secrets management platform to share and manage confidential information
• C.  Performing an application penetration test over the testing environment before moving to production
• D.  Changing the repository technology to avoid inclusion of confidential information

Company A and Company D ate merging Company A ' s compliance reports indicate branchprotections are not in place A security analyst needs to ensure that potential threats to the software development life cycle are addressed. Which of the following should me analyst cons < der when completing this basic?

• A.  If role-based training is deployed
• B.  If DAST scans are routinely scheduled
• C.  If developers are unable to promote to production
• D.  If DAST code is being stored to a single code repository

A company updates itscloud-based services by saving infrastructure code in a remote repository. The code is automatically deployed into the development environment every time the code is saved lo the repository The developers express concern that the deployment often fails, citing minor code issues and occasional security control check failures in the development environment Which of the following should a security engineer recommend to reduce the deployment failures? (Select two).

• A.  Automated regression testing
• B.  Pipeline compliance scanning
• C.  Pre-commit code linting
• D.  Software composition analysis
• E.  Code submit authorization workflow
• F.  Repository branch protection

An analyst must remediate vulnerabilities in IoT devices within 24 hours. These vulnerabilities:
* Have CVSS scores of less than 7.0
* Have updates available
* Will not significantly impact production systems if remediation is unsuccessful Which of the following practices is best for the analyst to use to resolve the issue?

• A.  Automated patching
• B.  Vulnerability prioritization
• C.  Forced restart of the device
• D.  SOAR playbook creation

An auditor is reviewing the logs from a web application to determine the source of an incident. The web application architecture includes an internet-accessible application load balancer, a number of web servers in a private subnet, application servers, and one database server in a tiered configuration. The application load balancer cannot store the logs. The following are sample log snippets:
Web server logs:
192.168.1.10 - - [24/Oct/2020 11:24:34 +05:00] " GET /bin/bash " HTTP/1.1 " 200 453 Safari/536.36
192.168.1.10 - - [24/Oct/2020 11:24:35 +05:00] " GET / HTTP/1.1 " 200 453 Safari/536.36 Application server logs:
24/Oct/2020 11:24:34 +05:00 - 192.168.2.11 - request does not match a known local user. Querying DB
24/Oct/2020 11:24:35 +05:00 - 192.168.2.12 - root path. Begin processing Database server logs:
24/Oct/2020 11:24:34 +05:00 [Warning] ' option read_buffer_size1 unassigned value 0 adjusted to 2048
24/Oct/2020 11:24:35 +05:00 [Warning] CA certificate ca.pem is self-signed.
Which of the following should the auditor recommend to ensure future incidents can be traced back to the sources?

• A.  Install a certificate signed by a trusted CA.
• B.  Install a software-based HIDS on the application servers.
• C.  Enable the X-Forwarded-For header at the load balancer.
• D.  Use stored procedures on the database server.
• E.  Store the value of the $_SERVER[ ' REMOTE_ADDR ' ] received by the web servers.