Latest [Nov 06, 2025] CAS-005 Exam Questions – Valid CAS-005 Dumps Pdf [Q103-Q121]

NO.103 A security architect is designing Zero Trust enforcement policies for all end users. The majority of users work remotely and travel frequently for work. Which of the following controls should the security architect do first?

NO.104 A security analyst isreviewing the following event timeline from an COR solution:

Which of the following most likely has occurred and needs to be fixed?

NO.105 During a recent audit, a company’s systems were assessed- Given the following information:

Which of the following is the best way to reduce the attack surface?

NO.106 A company wants to use loT devices to manage and monitor thermostats at all facilities The thermostats must receive vendor security updates and limit access to other devices within the organization Which of the following best addresses the company’s requirements”

NO.107 A security administrator needs to automate alerting. The server generates structured log files that need to be parsed to determine whether an alarm has been triggered. Given the following code function:

Which of the following is most likely the log input that the code will parse?

NO.108 While performing threat-hunting functions, an analyst is using the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target.
Which of the following must the threat hunter document to use the model effectively?

NO.109 A security architect is mitigating a vulnerability that previously led to a web application data breach. An analysis into the root cause of the issue finds the following:
An administrator’s account was hijacked and used on several Autonomous System Numbers within 30 minutes.
All administrators use named accounts that require multifactor authentication.
Single sign-on is used for all company applications.
Which of the following should the security architect do to mitigate the issue?

NO.110 Due to locality and budget constraints, an organization’s satellite office has a lower bandwidth allocation than other offices. As a result, the local securityinfrastructure staff is assessing architectural options that will help preserve network bandwidth and increase speed to both internal and external resources while not sacrificing threat visibility. Which of the following would be the best option to implement?

NO.111 An organization would like to increase the effectiveness of its incident response process across its multiplatform environment. A security engineer needs to implement the improvements using the organization’s existing incident response tools. Which of the following should the security engineer use?

NO.112 A global organization wants to manage all endpoint and user telemetry. The organization also needs to differentiate this data based on which office it is correlated to. Which of the following strategies best aligns with this goal?

NO.113 An organization wants to manage specialized endpoints and needs a solution that provides the ability to
* Centrally manage configurations
* Push policies.
* Remotely wipe devices
* Maintain asset inventory
Which of the following should the organization do to best meet these requirements?

NO.114 Which of the following key management practices ensures that an encryption key is maintained within the organization?

NO.115 Which of the following best describes the reason PQC preparation is important?

NO.116

Which of the following is the security engineer most likely doing?

NO.117 During a forensic review of a cybersecurity incident, a security engineer collected a portion of the payload used by an attacker on a comprised web server Given the following portion of the code:

Which of the following best describes this incident?

NO.118 A security engineer is reviewing the following vulnerability scan report:

Which of the following should the engineer prioritize for remediation?

NO.119 A company lined an email service provider called my-email.com to deliver company emails. The company stalled having several issues during the migration. A security engineer is troubleshooting and observes the following configuration snippet:

Which of the following should the security engineer modify to fix the issue? (Select two).

NO.120 A company wants to prevent a partner company from denying agreement to a transaction. Which of the following is the best solution for the company?

NO.121 A security analyst is reviewing suspicious log-in activity and sees the following data in the SICM:

Which of the following is the most appropriate action for the analyst to take?