CAS-004 Analyst Practice Questions
The free CAS-004: CompTIA Advanced Security Practitioner (CASP ) CAS-004 questions that deal with analyst, with answers and explanations. The full bank and the timed practice test cover every topic the exam asks about.
Question #1
Due to budget constraints, an organization created a policy that only permits vulnerabilities rated high and critical according to CVSS to be fixed or mitigated. A security analyst notices that many vulnerabilities that were previously scored as medium are now breaching higher thresholds. Upon further investigation, the analyst notices certain ratings are not aligned with the approved system categorization. Which of the following can the analyst do to get a better picture of the risk while adhering to the organization's policy?
Correct answer: C
Explanation
Aligning the impact subscore requirements to the predetermined system categorization can help the analyst get a better picture of the risk while adhering to the organization’s policy. The impact subscore is one of the components of the CVSS base score, which reflects the severity of a vulnerability. The impact subscore is calculated based on three metrics: confidentiality, integrity, and availability. These metrics can be adjusted according to the system categorization, which defines the security objectives and requirements for a system based on its potential impact on an organization’s operations and assets. By aligning the impact subscore requirements to the system categorization, the analyst can ensure that the CVSS scores reflect the true impact of a vulnerability on a specific system and prioritize remediation accordingly.
Question #8
A security operations center analyst is investigating anomalous activity between a database server and an unknown external IP address and gathered the following data: • dbadmin last logged in at 7:30 a.m. and logged out at 8:05 a.m. • A persistent TCP/6667 connection to the external address was established at 7:55 a.m. The connection is still active. • Other than bytes transferred to keep the connection alive, only a few kilobytes of data transfer every hour since the start of the connection. • A sample outbound request payload from PCAP showed the ASCII content: "JOIN #community". Which of the following is the MOST likely root cause?
Correct answer: C
Explanation
The dbadmin user is consulting the community for help via Internet Relay Chat. The clues in the given information point to the dbadmin user having established an Internet Relay Chat (IRC) connection to an external address at 7:55 a.m. This connection is still active, and only a few kilobytes of data have been transferred since the start of the connection. The sample outbound request payload of "JOIN #community" also suggests that the user is trying to join an IRC chatroom. This suggests that the dbadmin user is using the IRC connection to consult the community for help with a problem. Therefore, the root cause of the anomalous activity is likely the dbadmin user consulting the community for help via IRC. References: CompTIA Advanced Security Practitioner (CASP+) Study Guide, Chapter 10, Investigating Intrusions and Suspicious Activity.
Continue with CAS-004: CompTIA Advanced Security Practitioner (CASP ) CAS-004
Unlock the full question bank
You have read the first 10 questions. A subscription opens every question in CAS-004: CompTIA Advanced Security Practitioner (CASP ) CAS-004, the full timed practice test, and your progress and weak-topic reporting.
Single exam
$19.99for 30 days
Full question bank and practice test for one exam, for 30 days.
Single exam
$49.99for 1 year
One exam for a full year. Nothing renews and nothing to cancel.
Full access
$39.99/mo
Every exam in the catalogue, month to month.
Full access
$199.99/yr
Every exam in the catalogue for a year.
Already subscribed? Sign in to pick up where you left off.
All CAS-004: CompTIA Advanced Security Practitioner (CASP ) CAS-004 practice questions →