[Sep 20, 2026] Reliable CAS-005 Exam Tips Test Pdf Exam Material [Q155-Q172]

NO.155 An organization determines existing business continuity practices are inadequate to support critical internal process dependencies during a contingency event. A compliance analyst wants the Chief Information Officer (CIO) to identify the level of residual risk that is acceptable to guide remediation activities. Which of the following does the CIO need to clarify?

NO.156 A Chief Information Security Officer (CISO) is concerned that a company’s current data disposal procedures could result in data remanence. The company uses only SSDs. Which of the following would be the most secure way to dispose of the SSDs given the CISO’s concern?

NO.157 A senior security engineer flags me following log file snippet as hawing likely facilitated an attacker’s lateral movement in a recent breach:

Which of the following solutions, if implemented, would mitigate the nsk of this issue reoccurnnp?

NO.158 A security administrator needs to automate alerting. The server generates structured log files that need to be parsed to determine whether an alarm has been triggered Given the following code function:

Which of the following is most likely the log input that the code will parse?

NO.159 An attacker infiltrated the code base of a hardware manufacturer and inserted malware before the code was compiled. The malicious code is now running at the hardware level across a number of industries and sectors. Which of the following categories best describes this type of vendor risk?

NO.160 During a recent security event, access from the non-production environment to the production environment enabled unauthorized users to install unapproved software and make unplanned configuration changes. During an investigation, the following findings are identified:
– Several new users were added in bulk by the IAM team.
– Additional firewall and routers were recently added to the network
– Vulnerability assessments have been disabled for all devices for more than 30 days.
– The application allow list has not been modified in more than two
weeks.
– Logs were unavailable for various types of traffic
– Endpoints have not been patched in more than ten days.
Which of the following actions would most likely need to be taken to ensure proper monitoring is in place within the organization? (Choose two.)

NO.161 Which of the following includes best practices for validating perimeter firewall configurations?

NO.162 A systems administrator wants to use existing resources to automate reporting from disparate security appliances that do not currently communicate. Which of the following is the best way to meet this objective?

NO.163 A company plans to implement a research facility with Intellectual property data that should be protected The following is the security diagram proposed by the security architect

Which of the following security architect models is illustrated by the diagram?

NO.164 A network engineer must ensure that always-on VPN access is enabled Curt restricted to company assets Which of the following best describes what the engineer needs to do”

NO.165 A systems administrator wants to introduce a newly released feature for an internal application. The administrate docs not want to test the feature in the production environment. Which of the following locations is the best place to test the new feature?

NO.166 John Doe ‘ s email account was compromised. The attacker ‘ s access to John Doe ‘ s account was removed and MFA was implemented. The attacker convinced Joe Roe in the accounting department to pay a fraudulent invoice through email exchanges. A security analyst is reviewing the headers from the initial email that Joe Roe received:
Received: from 221.15.11.103 (221.15.11.103.mta.com [221.15.11.103])
by with esmtps (TLS 1.2)
Received-SPF: pass
Received: from 18.132.124.10 (18.132.124.10-internal.com [18.132.124.10]) by mx7sgwt-3S (Postfix) with ESMTPS id zRhQ22fmNnQCdys DKIM-Signature: v=1; c=relaxed/relaxed; d=example.com; s=default; t=1672873468; h=To: Message-ID: Date: Content-Type: Subject: From: From: To: Cc: Subject; To: [email protected] Message-ID: _73/A4-32616-C36L8ZbYC4p Date: Mon, 07 Apr 2025 +0000 Content-Type: multipart/alternative; boundary= MIME-Version: 1.0 Reply-To: [email protected] Subject: FW: Invoice From: [email protected] X-SpamProbability: 0.095349 Which of the following best explains how the attacker was able to get the invoice paid?

NO.167 A company wants to improve and automate the compliance of its cloud environments to meet industry standards. Which of the following resources should the company use to best achieve this goal?

NO.168 A systems administrator works with engineers to process and address vulnerabilities as a result of continuous scanning activities. The primary challenge faced by the administrator is differentiating between valid and invalid findings. Which of the following would the systems administrator most likely verify is properly configured?

NO.169 You are tasked with integrating a new B2B client application with an existing OAuth workflow that must meet the following requirements:
. The application does not need to know the users ‘ credentials.
. An approval interaction between the users and theHTTP service must be orchestrated.
. The application must have limited access to users ‘ data.
INSTRUCTIONS
Use the drop-down menus to select the action items for the appropriate locations. All placeholders must be filled.

NO.170 A company recentlyexperienced aransomware attack. Although the company performssystems and data backupon a schedule that aligns with itsRPO (Recovery Point Objective) requirements, thebackup administratorcould not recovercritical systems and datafrom its offline backups to meet the RPO. Eventually, the systems and data were restored with information that wassix months outside of RPO requirements.
Which of the following actions should the company take to reduce the risk of a similar attack?

NO.171 A company wants to perform threat modeling on an internally developed, business-critical application. The Chief Information Security Officer (CISO) is most concerned that the application should maintain 99.999% availability and authorized users should only be able to gain access to data they are explicitly authorized to view. Which of the following threat-modeling frameworks directly addresses the CISO’s concerns about this system?

NO.172 After an incident response exercise, a security administrator reviews the following table:

Which of the following should the administrator do to beat support rapid incident response in the future?