Free CAS-004 Exam Braindumps

A security analyst wants to keep track of alt outbound web connections from workstations. The analyst's company uses an on-premises web filtering solution that forwards the outbound traffic to a perimeter firewall. When the security analyst gets the connection events from the firewall, the source IP of the outbound web traffic is the translated IP of the web filtering solution. Considering this scenario involving source NAT. which of the following would be the BEST option to inject in the HTTP header to include the real source IP from workstations?

1. A. X-Forwarded-Proto
2. B. X-Forwarded-For
3. C. Cache-Control
4. D. Strict-Transport-Security
5. E. Content-Security-Policy

Correct Answer: D

An IT administrator is reviewing all the servers in an organization and notices that a server is missing crucial practice against a recent exploit that could gain root access.
Which of the following describes the administrator’s discovery?

1. A. A vulnerability
2. B. A threat
3. C. A breach
4. D. A risk

Correct Answer: A

An organization is assessing the security posture of a new SaaS CRM system that handles sensitive Pll and identity information, such as passport numbers. The SaaS CRM system does not meet the organization's current security standards. The assessment identifies the following:
* 1- There will be a $20,000 per day revenue loss for each day the system is delayed going into production. * 2- The inherent risk is high.
* 3- The residual risk is low.
* 4- There will be a staged deployment to the solution rollout to the contact center.
Which of the following risk-handling techniques will BEST meet the organization's requirements?

1. A. Apply for a security exemption, as the risk is too high to accept.
2. B. Transfer the risk to the SaaS CRM vendor, as the organization is using a cloud service.
3. C. Accept the risk, as compensating controls have been implemented to manage the risk.
4. D. Avoid the risk by accepting the shared responsibility model with the SaaS CRM provider.

Correct Answer: A

Which of the following allows computation and analysis of data within a ciphertext without knowledge of the plaintext?

1. A. Lattice-based cryptography
2. B. Quantum computing
3. C. Asymmetric cryptography
4. D. Homomorphic encryption

Correct Answer: D

An organization wants to perform a scan of all its systems against best practice security configurations. Which of the following SCAP standards, when combined, will enable the organization to view each of the
configuration checks in a machine-readable checklist format for fill automation? (Choose two.)

1. A. ARF
2. B. XCCDF
3. C. CPE
4. D. CVE
5. E. CVSS
6. F. OVAL

Correct Answer: BF