CompTIA
Exam Questions CAS-005
CompTIA SecurityX Exam
Passing Certification Exams Made Easy visit - https://www.surepassexam.com
, NEW QUESTION 1
During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server Given
the following portion of the code:
Which of the following best describes this incident?
A. XSRF attack
B. Command injection
C. Stored XSS
D. SQL injection
Answer: C
Explanation:
The provided code snippet shows a script that captures the user's cookies and sends them to a remote server. This type of attack is characteristic of Cross-Site
Scripting (XSS), specifically stored XSS, where the malicious script is stored on the target server (e.g., in a database) and executed in the context of users who
visit the infected web page.
? A. XSRF (Cross-Site Request Forgery) attack: This involves tricking the user into performing actions on a different site without their knowledge but does not
involve stealing cookies via script injection.
? B. Command injection: This involves executing arbitrary commands on the host operating system, which is not relevant to the given JavaScript code. ? C.
Stored XSS: The provided code snippet matches the pattern of a stored XSS attack, where the script is injected into a web page, and when users visit the
page, the script executes and sends the user's cookies to the attacker's server.
? D. SQL injection: This involves injecting malicious SQL queries into the database and is unrelated to the given JavaScript code.
References:
? CompTIA Security+ Study Guide
? OWASP (Open Web Application Security Project) guidelines on XSS
? "The Web Application Hacker's Handbook" by Dafydd Stuttard and Marcus Pinto
NEW QUESTION 2
An audit finding reveals that a legacy platform has not retained loos for more than 30 days The platform has been segmented due to its interoperability with newer
technology. As a temporary solution, the IT department changed the log retention to 120 days. Which of the following should the security engineer do to ensure the
logs are being properly retained?
A. Configure a scheduled task nightly to save the logs
B. Configure event-based triggers to export the logs at a threshold.
C. Configure the SIEM to aggregate the logs
D. Configure a Python script to move the logs into a SQL database.
Answer: C
Explanation:
To ensure that logs from a legacy platform are properly retained beyond the default retention period, configuring the SIEM to aggregate the logs is the best
approach. SIEM solutions are designed to collect, aggregate, and store logs from various sources, providing centralized log management and retention. This setup
ensures that logs are retained according to policy and can be easily accessed for analysis and compliance purposes. References:
? CompTIA SecurityX Study Guide: Discusses the role of SIEM in log management and retention.
? NIST Special Publication 800-92, "Guide to Computer Security Log Management": Recommends the use of centralized log management solutions, such as
SIEM, for effective log retention and analysis.
? "Security Information and Event Management (SIEM) Implementation" by David Miller: Covers best practices for configuring SIEM systems to aggregate and
retain logs from various sources.
NEW QUESTION 3
A security analyst is reviewing the following authentication logs:
Passing Certification Exams Made Easy visit - https://www.surepassexam.com
Exam Questions CAS-005
CompTIA SecurityX Exam
Passing Certification Exams Made Easy visit - https://www.surepassexam.com
, NEW QUESTION 1
During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server Given
the following portion of the code:
Which of the following best describes this incident?
A. XSRF attack
B. Command injection
C. Stored XSS
D. SQL injection
Answer: C
Explanation:
The provided code snippet shows a script that captures the user's cookies and sends them to a remote server. This type of attack is characteristic of Cross-Site
Scripting (XSS), specifically stored XSS, where the malicious script is stored on the target server (e.g., in a database) and executed in the context of users who
visit the infected web page.
? A. XSRF (Cross-Site Request Forgery) attack: This involves tricking the user into performing actions on a different site without their knowledge but does not
involve stealing cookies via script injection.
? B. Command injection: This involves executing arbitrary commands on the host operating system, which is not relevant to the given JavaScript code. ? C.
Stored XSS: The provided code snippet matches the pattern of a stored XSS attack, where the script is injected into a web page, and when users visit the
page, the script executes and sends the user's cookies to the attacker's server.
? D. SQL injection: This involves injecting malicious SQL queries into the database and is unrelated to the given JavaScript code.
References:
? CompTIA Security+ Study Guide
? OWASP (Open Web Application Security Project) guidelines on XSS
? "The Web Application Hacker's Handbook" by Dafydd Stuttard and Marcus Pinto
NEW QUESTION 2
An audit finding reveals that a legacy platform has not retained loos for more than 30 days The platform has been segmented due to its interoperability with newer
technology. As a temporary solution, the IT department changed the log retention to 120 days. Which of the following should the security engineer do to ensure the
logs are being properly retained?
A. Configure a scheduled task nightly to save the logs
B. Configure event-based triggers to export the logs at a threshold.
C. Configure the SIEM to aggregate the logs
D. Configure a Python script to move the logs into a SQL database.
Answer: C
Explanation:
To ensure that logs from a legacy platform are properly retained beyond the default retention period, configuring the SIEM to aggregate the logs is the best
approach. SIEM solutions are designed to collect, aggregate, and store logs from various sources, providing centralized log management and retention. This setup
ensures that logs are retained according to policy and can be easily accessed for analysis and compliance purposes. References:
? CompTIA SecurityX Study Guide: Discusses the role of SIEM in log management and retention.
? NIST Special Publication 800-92, "Guide to Computer Security Log Management": Recommends the use of centralized log management solutions, such as
SIEM, for effective log retention and analysis.
? "Security Information and Event Management (SIEM) Implementation" by David Miller: Covers best practices for configuring SIEM systems to aggregate and
retain logs from various sources.
NEW QUESTION 3
A security analyst is reviewing the following authentication logs:
Passing Certification Exams Made Easy visit - https://www.surepassexam.com
