CompTIA CAS-005 Exam Questions

Question 6 of 408

Company A is merging with Company B. Company A is a small, local company. Company B has a large, global presence. The two companies have a lot of duplication in their IT systems, processes, and procedures. On the new Chief Information Officer's (CIO's) first day, a fire breaks out at Company B's main data center. Which of the following actions should the CIO take first?

Determine whether the incident response plan has been tested at both companies, and use it to respond.

Review the incident response plans, and engage the disaster recovery plan while relying on the IT leaders from both companies.

Ensure hot, warm, and mobile disaster recovery sites are available, and give an update to the companies' leadership teams.

Initiate Company A's IT systems processes and procedures, assess the damage, and perform a BIA.

Correct Answer: B

Question 7 of 408

The results of an internal audit indicate several employees reused passwords that were previously included in a published list of compromised passwords.
The company has the following employee password policy:
Exam CAS-005: Question 7 - Image 1

Which of the following should be implemented to best address the password reuse issue? (Choose two.)

Increase the minimum age to two days.

Increase the history to 20.

Increase the character length to 12.

Add case-sensitive requirements to character class.

Decrease the maximum age to 30 days.

Remove the complexity requirements.

Increase the maximum age to 120 days.

Correct Answer: A, B

Question 8 of 408

A mobile administrator is reviewing the following mobile device DHCP logs to ensure the proper mobile settings are applied to managed devices:
Exam CAS-005: Question 8 - Image 1

Which of the following mobile configuration settings is the mobile administrator verifying?

Service set identifier authentication

Wireless network auto joining

802.1X with mutual authentication

Association MAC address randomization

Correct Answer: D

Question 9 of 408

A security analyst is investigating a possible insider threat incident that involves the use of an unauthorized USB from a shared account to exfiltrate data. The event did not create an alert. The analyst has confirmed the USB hardware ID is not on the device allow list, but has not yet confirmed the owner of the USB device. Which of the following actions should the analyst take next?

Classify the incident as a false positive.

Classify the incident as a false negative.

Classify the incident as a true positive.

Classify the incident as a true negative.

Correct Answer: B

Question 10 of 408

Which of the following security features do email signatures provide?