CASP+ (CASP+) CAS-004 5

Question 1

A security team discovers that an attacker maintained persistence in their environment for 9 months using a web shell. Which log source would MOST likely have revealed this activity earliest?

Accepted Answer

Web server access logs showing unusual POST requests to the web shell path

Answer

Web server access logs record every HTTP request including POST requests to web shells, making them the earliest and most direct indicator of web shell interaction.

Question 2

An organization uses a hybrid cloud architecture and needs to enforce consistent security policy across on-premises and cloud environments. Which solution BEST meets this requirement?

Accepted Answer

Using a cloud-agnostic security policy platform with unified policy enforcement

Answer

A cloud-agnostic security policy platform provides single-pane-of-glass policy management and consistent enforcement across heterogeneous on-premises and cloud environments.

Question 3

A penetration tester is assessing a target that uses certificate pinning in its mobile application. Which technique allows the tester to intercept the application's TLS traffic?

Accepted Answer

Using Frida or similar tools to hook and bypass the pinning validation logic at runtime

Answer

Certificate pinning ignores the device's trust store, so runtime instrumentation tools like Frida must hook the validation function directly to bypass it.

Question 4

A company experiences a DDoS attack that saturates its upstream ISP link. Which mitigation technique should be engaged at the EARLIEST stage?

Accepted Answer

Contacting the upstream ISP or a DDoS scrubbing service to filter traffic upstream

Answer

When the upstream link is saturated, on-premises controls cannot receive traffic to filter it; upstream scrubbing or ISP null-routing must be engaged to absorb the attack before it reaches the organization.

Question 5

An organization's security policy requires that all cryptographic keys be generated using a FIPS 140-2 Level 3 validated device. What distinguishes Level 3 from Level 2 validation?

Accepted Answer

Level 3 requires tamper-evident coatings and physical identity-based authentication for operators

Answer

FIPS 140-2 Level 3 adds tamper-responsive mechanisms (active zeroization on tamper detection) and identity-based authentication for operators, beyond Level 2's tamper-evident coatings.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ (CASP+) CAS-004 5