Mixed Deck — All CASP+ Topics Flashcards

Your business spent three months at its hot site following a natural disaster before moving back to the main location. Which processes at the main site ought to be reinstated first?

Answer: The least important aspect of the business

When describing the sequence of restoration between the hot site and the primary site in the context of business recovery from a natural disaster, it is inaccurate to argue that any part of the business is "least significant." Based on the importance and dependencies of various business operations and processes, the restoration priorities should be set. The restoration process often entails evaluating the effect of the natural disaster on various business aspects and allocating restoration activities according to priority. Although the primary site is crucial, it might not necessarily be restored first if other vital operations need to be attended to.

A CASP+ architect must design a zero-trust network for a financial institution. Which control is MOST critical to enforce zero-trust principles?

Answer: Continuous verification of identity and device posture for every request

Zero trust requires continuous verification of identity and device health for every access request, regardless of network location.

An organization requires a security architecture review of a new data warehouse. Which framework MOST comprehensively addresses data security requirements?

Answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls applicable to federal and enterprise information systems, including data warehouses.

Which employs the necessary keys and examines the trust paths and revocation status before enabling the certificate to be utilized when a browser views a website?

Answer: Browser

Vendors will build a PKI standard to enable the exchange of keys via certificates, which is a need for an application to use a digital certificate. Before enabling the application to utilize the certificate, the browser uses the necessary keys and verifies the trust paths and revocation status. The certificate is provided by the web server to the browser for verification. The PKI certificate's root of trust is the Root CA (certificate authority). Requests for digital certificates are verified by the RA (registration authority).

An organization encrypts cloud storage with customer-managed keys (CMK). Which action allows the cloud provider to render the data inaccessible without deleting it?

Answer: Disabling or scheduling deletion of the CMK in the KMS

Disabling or scheduling deletion of the CMK prevents the cloud provider's encryption service from decrypting data; the ciphertext remains but is cryptographically inaccessible without the key.

A CASP+ analyst needs to detect credential dumping on Windows endpoints. Which security control provides the MOST direct protection?

Answer: Configuring Credential Guard to isolate LSASS using virtualization-based security

Credential Guard uses VBS to store NTLM hashes and Kerberos tickets in an isolated environment inaccessible to the OS, preventing tools like Mimikatz from dumping credentials from LSASS.

Which playbook element is MOST critical for reducing mean time to respond (MTTR) during an incident?

Answer: Pre-defined decision trees with specific containment actions for each alert type

Pre-defined decision trees give responders clear, step-by-step actions for each alert, eliminating decision fatigue and enabling faster, consistent containment and remediation.

A certificate authority issues a wildcard certificate for *.example.com. Which domain is NOT covered by this certificate?

Answer: sub.mail.example.com

Wildcard certificates cover exactly one level of subdomain; sub.mail.example.com has two subdomain levels below example.com and is not covered by *.example.com.

An architect must ensure high availability for a critical authentication service. Which approach BEST balances resilience and security?

Answer: Geographically distributed active-active cluster with health checks and session replication

An active-active cluster across geographic regions provides automatic failover and load distribution while replicating session state for continuity.

Which MITRE ATT&CK tactic describes an adversary's attempts to steal credentials from the target environment?

Answer: Credential Access

The Credential Access tactic in MITRE ATT&CK covers techniques used to steal credentials such as account names and passwords, including credential dumping and keylogging.

An enterprise wants to implement deception technology to detect lateral movement. Which solution BEST fits this goal?

Answer: Placing honeytokens and honeypots throughout internal network segments

Honeytokens and honeypots distributed across internal segments attract and detect attackers engaged in lateral movement without alerting legitimate users.

A developer is choosing between hashing algorithms for password storage. Which option is MOST appropriate?

Answer: bcrypt with an appropriate work factor

bcrypt is a password-hashing function designed to be computationally expensive and includes built-in salting, making brute-force attacks impractical.

The database server is operated by Acme Inc. The server and its data are valued at $10,000. The operating system on the server is outdated and cannot be patched. According to your calculations, there is a 20% risk that the server would be compromised in the upcoming year, and that compromise would result in the loss of 50% of the server's value (i.e., all of the data). What is the SLE from the standpoint of a quantitative risk assessment?

Answer: $5,000

The quantity of loss anticipated in the event of a single loss is known as SLE. The SLE equation is: EF x AV = SLE The value of an asset is its AV (asset value). The answer informs us that AV is $10,000. The EF (exposure factor) measures the percentage likelihood that a specific threat will have an effect on a given asset. According to the question, a compromise would result in a 50% reduction in value. EF thus equals 50%. The question's SLE formula is as follows: SLE = $10,000 x 0.50 SLE = $5,000

What is credential stuffing, and which IAM control most effectively mitigates it?

Answer: Using stolen username/password pairs from data breaches to log into other services; multi-factor authentication

Credential stuffing uses breached credentials from other sites to exploit password reuse; MFA stops the attack even when valid credentials are submitted by the attacker.

A cloud storage company is Acme Cloud. A threat actor recently gained access to and successfully decrypted data from one of Acme Cloud's servers. However, the insufficient nature of the data prevented the threat actor from using it. Prior to the breach, Acme Cloud divided and re-encrypted the customer data among various servers. What phrase best defines the method Acme Cloud uses to divide the data in order to lessen the chance of data leakage?

Answer: Bit splitting

Data is divided into smaller chunks, encrypted, and distributed across various storage locations using the bit splitting process. The data is meaningless if a threat actor compromises just one place. Key escrow is the process of keeping an encryption key with a third party so that it can be produced when requests for decryption are made. Data is encrypted using a stream cipher using a byte-by-byte or bit-by-bit approach. Building a management layer to help implement control over an app without really changing it is called "application wrapping."

Which NIST publication defines Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), and Federation Assurance Levels (FAL)?

Answer: NIST SP 800-63

NIST SP 800-63 (Digital Identity Guidelines) establishes the assurance level framework covering identity proofing (IAL), authentication strength (AAL), and federation trust (FAL).

Which of the following is an improvement on Electronic Code Book (ECB) block cipher mode that connects each block together before being applied to the following block?

Answer: CBC

Blocks are chained together in cipher block chaining (CBC) because every resultant 64-bit ciphertext block is applied to the following block. CBC is thought to be an improvement to ECB, in part because it addresses the issues brought on by the ECB's requirement to individually encrypt each block of plaintext (which can leak information about the underlying data to eavesdroppers). CBC is one of the cipher modes that can be used with the Advanced Encryption Standard (AES), a sort of block cipher, however, AES is not a cipher mode in and of itself. Block ciphering and stream ciphering are both used in cipher feedback (CFB). Output feedback (OFB): Employs stream ciphering and block ciphering with 8-bit or smaller blocks, and uses the key from the previous keystream to construct the next keystream. Similar to OFB, counter mode (CTR) uses an incrementing IV counter to make sure that every block is encrypted with a different keystream.

What kinds of services are utilized to supply network resources like users, servers, printers, and other organizational information?

Answer: Directory

The purpose of directory services is to give organizational data on users, servers, printers, and other network resources. An illustration of a directory service protocol is LDAP. A federation is a collection of domains that have mutual trust. A method of directly linking two networks is peering. A command called STARTTLS is used to start using encrypted network communications.

Which artifact documents identified control deficiencies and tracks remediation activities with milestones and responsible parties?

Answer: Plan of Action and Milestones (POA&M)

A POA&M formally tracks each identified weakness, the corrective action planned, the responsible party, and the scheduled completion date.

What among the following DOES NOT constitute an open-source intelligence (OSINT) source?

Answer: Ping scan

Data used in open-source intelligence (OSINT) is obtained from open sources. Potential sources of OSINT data include social media, the deep web, WHOIS and DNS records, as well as other open data sources. A ping scan takes place exclusively within a local area network (LAN) and is not disclosed to the general public. Consequently, a ping scan is not an OSINT source.