CompTIA CAS-003 dumps - 100% Pass Guarantee!

The Chief Information Officer (CIO) wants to increase security and accessibility among the organization's cloud SaaS applications. The applications are configured to use passwords, and two-factor authentication is not provided natively. Which of the following would BEST address the CIO's concerns?

A. Procure a password manager for the employees to use with the cloud applications.

B. Create a VPN tunnel between the on-premises environment and the cloud providers.

C. Deploy applications internally and migrate away from SaaS applications.

D. Implement an IdP that supports SAML and time-based, one-time passwords.

A security consultant is attempting to discover if the company is utilizing databases on client machines to store the customer data. The consultant reviews the following information:

Which of the following commands would have provided this output?

A. arp -s

B. netstat -a

C. ifconfig -arp

D. sqlmap -w

A request has been approved for a vendor to access a new internal server using only HTTPS and SSH to manage the back-end system for the portal. Internal users just need HTTP and HTTPS access to all internal web servers. All other external access to the new server and its subnet is not allowed. The security manager must ensure proper access is configured.

Below is a snippet from the firewall related to that server (access is provided in a top-down model):

Which of the following lines should be configured to allow the proper access? (Choose two.)

A. Move line 3 below line 4 and change port 80 to 443 on line 4.

B. Move line 3 below line 4 and add port 443 to line.

C. Move line 4 below line 5 and add port 80 to 8080 on line 2.

D. Add port 22 to line 2.

E. Add port 22 to line 5.

F. Add port 443 to line 2.

G. Add port 443 to line 5.

A penetration tester is trying to gain access to a remote system. The tester is able to see the secure login page and knows one user account and email address, but has not yet discovered a password.

Which of the following would be the EASIEST method of obtaining a password for the known account?

A. Man-in-the-middle

B. Reverse engineering

C. Social engineering

D. Hash cracking

While the code is still in the development environment, a security architect is testing the code stored in the code repository to ensure the top ten OWASP secure coding practices are being followed. Which of the following code analyzers will produce the desired results?

A. Static

B. Dynamic

C. Fuzzer

D. Peer review