CAS-004 Exam Dumps - CompTIA CASP Questions and Answers

A tabletop exercise is a type of testing plan that is used to discuss disaster recovery scenarios with representatives from multiple departments within an incident response team but without taking any invasive actions. A tabletop exercise is a simulation of a potential disaster or incident that involves a verbal or written discussion of how each department would respond to it. The purpose of a tabletop exercise is to identify gaps, weaknesses, or conflicts in the disaster recovery plan, and to improve communication and coordination among the team members.

Remote access services deployed using vendor-diverse redundancy with event response driven by playbooks is the best solution to meet the requirements. Vendor-diverse redundancy means using different vendors or technologies to provide the same service or function, which can increase the availability and resilience of the service. For example, if one vendor’s VPN solution fails due to a zero-day vulnerability, another vendor’s VPN solution can take over without affecting the users. Event response driven by playbooks means using predefined workflows or scripts to automate the actions or decisions that need to be taken in response to certain events or triggers. For example, a playbook can define how to switch between different remote access solutions based on certain criteria or conditions, such as performance, availability, security, or manual input. Playbooks can also be integrated with SOAR platforms to leverage their capabilities for orchestration, automation, and response. Verified References:

https://cyware.com/security-guides/security-orchestration-automation-and-response/what-is-vendor-agnostic-security-orchestration-automation-and-response-soar-40e4

https://www.paloaltonetworks.com/cyberpedia/what-is-a-security-playbook

Reviewing video from IP cameras within the facility would be the most likely process to expose an attacker who has compromised an air-gapped system. Since air-gapped systems are isolated from external networks, an attacker would need physical access to the system or use some covert channel to communicate with it. Video surveillance could reveal any unauthorized or suspicious activity within the facility that could be related to the attack. Verified References:

https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf

https://en.wikipedia.org/wiki/Air-Gap_Malware

https://www.techtarget.com/searchsecurity/essentialguide/How-air-gap-attacks-challenge-the-notion-of-secure-networks

An immutable system is a system that does not change after it is deployed. Any changes or updates are done by creating a new system from a common image or template and replacing the old one. An immutable system meets the requirements of storing data outside of the VMs, preventing unauthorized modifications to the VMs, and deploying a new VM if a change needs to be done. An immutable system can improve the security, reliability, and consistency of the VMs by avoiding configuration drift, human errors, or malicious tampering. An immutable system can also simplify the deployment process and enable faster recovery from failures. Verified References:

https://cloudinfrastructureservices.co.uk/vm-types-for-devops-pets-vs-cattle-vs-immutable/

https://www.digitalocean.com/community/tutorials/what-is-immutable-infrastructure

An ISA, or interconnection security agreement, is a document that should be required to set up a dedicated VPN between two entities that provide specialized help desk services. An ISA defines the technical and security requirements for establishing, operating, and maintaining a secure connection between two or more organizations. An ISA also specifies the roles and responsibilities of each party, the security controls and policies to be implemented, the data types and classifications to be exchanged, and the incident response procedures to be followed.

Rules of engagement are legal documents that should be signed by all parties involved in an assessment to ensure they understand their roles and responsibilities. Rules of engagement define the scope, objectives, methods, deliverables, limitations, and expectations of an assessment project. They also specify the legal and ethical boundaries, communication channels, escalation procedures, and reporting formats for the assessment. Rules of engagement help to avoid misunderstandings, conflicts, or liabilities during or after an assessment.

Executing the files in the sandbox on the web proxy is the best solution to reduce the risk of employees downloading and opening malicious files from the internet. A sandbox is a secure and isolated environment that can run untrusted or potentially harmful code without affecting the rest of the system. By executing the files in the sandbox, the web proxy can analyze their behavior and detect any malicious activity before allowing them to reach the corporate workstations.

Execute never is a technology that can be enabled on the ARM architecture to prevent malware from inserting itself in another process’ memory location. Execute never (also known as XN or NX) is a feature that marks certain memory regions as non-executable, meaning that they cannot be used to run code. This prevents malware from exploiting buffer overflows or other memory corruption vulnerabilities to inject malicious code into another process’ memory space.

Threat emulation is the method that should be used to test an incident response playbook for insider attacks. Threat emulation is a technique that simulates real-world attacks using realistic scenarios, tactics, techniques, and procedures (TTPs) of threat actors. Threat emulation can help evaluate the effectiveness of an incident response plan by testing how well it can detect, respond to, contain, eradicate, recover from, and learn from an attack.

Static application security testing (SAST) is a method of analyzing the source code of an application for vulnerabilities and weaknesses before it is deployed. SAST can help identify security issues earlier in the development process, reducing the time and cost of remediation. Dynamic application security testing (DAST) is a method of testing the functionality and behavior of an application at runtime for vulnerabilities and weaknesses. DAST can cover public-facing application components, but it cannot detect issues in the source code or in serverless applications. Runtime application self-protection (RASP) is a technology that monitors and protects an application from attacks in real time by embedding security features into the application code or runtime environment. RASP can help prevent exploitation of vulnerabilities, but it cannot identify or fix them. A web application firewall (WAF) is a device or software that filters and blocks malicious web traffic from reaching an application. A WAF can help protect an application from common attacks, but it cannot detect or fix vulnerabilities in the application code or in serverless applications. References: [CompTIA Advanced Security Practitioner (CASP+) Certification Exam Objectives], Domain 3: Enterprise Security Operations, Objective 3.4: Conduct security assessments using appropriate tools

Comprehensive and Detailed in-Depth Explanation:

Understanding HTTPS Interception Attacks:

HTTPS interception attacks occur when aman-in-the-middle (MitM)interceptsHTTPS trafficbetween a client and a server.

Attackers can useproxy certificates, installmalicious root certificates, or use tools likeSSL strippingto compromise secure connections.

In mobile applications, attackers may exploittrusted root certificatesinstalled on devices to intercept and decrypt HTTPS traffic.

Why the Correct Answer is D (Certificate Pinning):

Certificate Pinningensures that the mobile applicationonly accepts a specific certificateorpublic keywhen communicating with the back-end server.

Even if an attacker installs amalicious root CA certificateon the device, the app willreject the intercepted or forged certificatebecause itdoes not match the pinned certificate.

Pinning effectivelyprevents HTTPS interceptionas it requires theexact certificate or keyrather than just any certificate signed by a trusted root.

How Certificate Pinning Works:

During development, the applicationstores a hash of the server’s certificateor public key.

Upon connection, the appcompares the received certificatewith the pinned hash.

If they do not match, the connection isterminated.

Example Implementation in Android (Java):

java

CopyEdit

HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();

connection.setSSLSocketFactory(getPinnedSSLSocketFactory());

The getPinnedSSLSocketFactory() method uses ahard-coded or dynamically updated certificateto validate the server.

Why the Other Options Are Incorrect:

A. Cookies:

Cookies are used forsession managementanduser authentication.

They do not preventcertificate spoofingorHTTPS interception.

B. Wildcard certificates:

Wildcard certificates allow multiplesubdomainsto be covered under one certificate.

They do notprotect against MitM attacksand can actuallyincrease riskif compromised.

C. HSTS (HTTP Strict Transport Security):

HSTS ensures that a browser always usesHTTPSwhen connecting to a server.

Itprotects against SSL strippingbutdoes not defend against HTTPS interceptionwhen a malicious root certificate is present.

It is more suited forweb applicationsthan mobile apps.

Real-World Scenario:

A banking app usingcertificate pinningcan detect andblock fake certificatesinstalled by malicious actors.

Without pinning, users in environments with compromisedroot CAscould unknowingly connect tomalicious proxy servers.

Notably, some public Wi-Fi networks that performHTTPS interceptionfor monitoring would also fail to work with such apps, indicatingadded security.

Extract from CompTIA SecurityX CAS-005 Study Guide:

TheCompTIA SecurityX CAS-005 Official Study Guidehighlights thatcertificate pinningis crucial formobile applicationsthat rely onREST APIs. It provides robust defense againstHTTPS interceptionby strictly validating the server’s certificate. This practice is recommended especially when dealing withsensitive data transmission.

The SAN (Subject Alternative Name) field in a certificate can include multiple types of entries, including DNS names and email addresses. These are explicit options within the SAN extension, allowing a single certificate to be valid for multiple domain names and email addresses. This is often used in multi-domain SSL certificates, where a single certificate needs to be valid for multiple subdomains or different domain names.