[May-2026] CompTIA CAS-004 Official Cert Guide PDF
Exam CAS-004: CompTIA Advanced Security Practitioner (CASP+) Exam - Exam4Tests
CompTIA Advanced Security Practitioner (CASP+) is a certification exam that validates advanced-level security skills and knowledge in the IT industry. CompTIA Advanced Security Practitioner (CASP+) Exam certification is designed for experienced IT professionals who are looking to advance their careers in information security. CAS-004 exam is vendor-neutral, which means that candidates can demonstrate their skills across a wide range of technologies and platforms.
NEW QUESTION # 169
A cloud security architect has been tasked with selecting the appropriate solution given the following:
- The solution must allow the lowest RTO possible.
- The solution must have the least shared responsibility possible.
- Patching should be a responsibility of the CSP.
Which of the following solutions can BEST fulfil the requirements?
- A. SaaS
- B. PaaS
- C. IaaS
- D. Private
Answer: A
Explanation:
SaaS, or software as a service, is the solution that can best fulfill the requirements of having the lowest RTO possible, the least shared responsibility possible, and patching as a responsibility of the CSP. SaaS is a cloud service model that provides users with access to software applications hosted and managed by the CSP over the internet. SaaS has the lowest RTO (recovery time objective), which is the maximum acceptable time for restoring a system or service after a disruption, because it does not require any installation, configuration, or maintenance by the users. SaaS also has the least shared responsibility possible because most of the security aspects are handled by the CSP, such as patching, updating, backup, encryption, authentication, etc.
NEW QUESTION # 170
A financial services company wants to migrate its email services from on-premises servers to a cloud-based email solution. The Chief information Security Officer (CISO) must brief board of directors on the potential security concerns related to this migration. The board is concerned about the following.
* Transactions being required by unauthorized individual
* Complete discretion regarding client names, account numbers, and investment information.
* Malicious attacker using email to distribute malware and ransom ware.
* Exfiltration of sensitivity company information.
The cloud-based email solution will provide an6-malware, reputation-based scanning, signature-based scanning, and sandboxing. Which of the following is the BEST option to resolve the board's concerns for this email migration?
- A. SSL VPN
- B. Data loss prevention
- C. Endpoint detection response
- D. Application whitelisting
Answer: B
Explanation:
Explanation
Data loss prevention (DLP) is the best option to resolve the board's concerns for this email migration. DLP is a set of tools and policies that aim to prevent unauthorized access, disclosure, or exfiltration of sensitive data.
DLP can monitor, filter, encrypt, or block email messages based on predefined rules and criteria, such as content, sender, recipient, attachment, etc. DLP can help protect transactions, customer data, and company information from being compromised by malicious actors or accidental leaks. Verified References:
https://www.comptia.org/training/books/casp-cas-004-study-guide ,
https://www.csoonline.com/article/3245746/what-is-dlp-data-loss-prevention-and-how-does-it-work.html
NEW QUESTION # 171
Which of the following security features do email signatures provide? (Choose two.)
- A. Body encryption
- B. Code signing
- C. Non-repudiation
- D. Chain of custody
- E. Sender authentication
Answer: C
NEW QUESTION # 172
A financial services company wants to migrate its email services from on-premises servers to a cloud-based email solution. The Chief information Security Officer (CISO) must brief board of directors on the potential security concerns related to this migration. The board is concerned about the following.
* Transactions being required by unauthorized individual
* Complete discretion regarding client names, account numbers, and investment information.
* Malicious attacker using email to distribute malware and ransom ware.
* Exfiltration of sensitivity company information.
The cloud-based email solution will provide an6-malware, reputation-based scanning, signature-based scanning, and sandboxing. Which of the following is the BEST option to resolve the board's concerns for this email migration?
- A. SSL VPN
- B. Data loss prevention
- C. Endpoint detection response
- D. Application whitelisting
Answer: B
Explanation:
Data loss prevention (DLP) is the best option to resolve the board's concerns for this email migration. DLP is a set of tools and policies that aim to prevent unauthorized access, disclosure, or exfiltration of sensitive data.
DLP can monitor, filter, encrypt, or block email messages based on predefined rules and criteria, such as content, sender, recipient, attachment, etc. DLP can help protect transactions, customer data, and company information from being compromised by malicious actors or accidental leaks. Verified References:
https://www.comptia.org/training/books/casp-cas-004-study-guide , https://www.csoonline.com/article
/3245746/what-is-dlp-data-loss-prevention-and-how-does-it-work.html
NEW QUESTION # 173
A vulnerability assessment endpoint generated a report of the latest findings. A security analyst needs to review the report and create a priority list of items that must be addressed. Which of the following should the analyst use to create the list quickly?
- A. CVSS scores
- B. OVAL
- C. CVE dates
- D. Business impact rating
Answer: D
NEW QUESTION # 174
A company that uses AD is migrating services from LDAP to secure LDAP. During the pilot phase, services are not connecting properly to secure LDAP. Block is an except of output from the troubleshooting session:
openssl s_client -host ldapl.comptia.com -port 636
CONNECTED (00000003)
...
----- BEGIN CERTIFICATE -----
...
----- END CERTIFICATE -----
Subject =/CN=* Comptia.com / Issuer = / DC = com / DC = danville / CN = chicago Which of the following BEST explains why secure LDAP is not working? (Choose two.)
- A. The company is using the wrong port. It should be using port 389 for secure LDAP.
- B. The clients may not trust idapt by default.
- C. The clients may not trust Chicago by default.
- D. The secure LDAP service is not started, so no connections can be made.
- E. Secure LDAP should be running on UDP rather than TCP.
- F. Danvills.com is under a DDoS-inator attack and cannot respond to OCSP requests.
- G. Secure LDAP does not support wildcard certificates.
Answer: E,G
NEW QUESTION # 175
A company is outsourcing to an MSSP that performs managed detection and response services.
The MSSP requires a server to be placed inside the network as a log aggregate and allows remote access to MSSP analyst. Critical devices send logs to the log aggregator, where data is stored for 12 months locally before being archived to a multitenant cloud. The data is then sent from the log aggregate to a public IP address in the MSSP datacenter for analysis. A security engineer is concerned about the security of the solution and notes the following.
- The critical devise send cleartext logs to the aggregator.
- The log aggregator utilize full disk encryption.
- The log aggregator sends to the analysis server via port 80.
- MSSP analysis utilize an SSL VPN with MFA to access the log
aggregator remotely.
- The data is compressed and encrypted prior to being achieved in the
cloud.
Which of the following should be the engineer's GREATEST concern?
- A. Hardware vulnerabilities introduced by the log aggregate server
- B. Encryption of data in transit
- C. Multinancy and data remnants in the cloud
- D. Network bridging from a remote access VPN
Answer: B
Explanation:
Encryption of data in transit should be the engineer's greatest concern regarding the security of the solution. Data in transit refers to data that is being transferred over a network or between devices. If data in transit is not encrypted, it can be intercepted, modified, or stolen by attackers who can exploit vulnerabilities in the network protocols or devices. The solution in the question sends logs from the critical devices to the aggregator in cleartext and from the aggregator to the analysis server via port 80, which are both insecure methods that expose the data to potential attacks.
NEW QUESTION # 176
An IT administrator is reviewing all the servers in an organization and notices that a server is missing crucial practice against a recent exploit that could gain root access.
Which of the following describes the administrator's discovery?
- A. A vulnerability
- B. A threat
- C. A breach
- D. A risk
Answer: A
NEW QUESTION # 177
A security engineer needs to review the configurations of several devices on the network to meet the following requirements:
* The PostgreSQL server must only allow connectivity in the 10.1.2.0/24 subnet.
* The SSH daemon on the database server must be configured to listen
to port 4022.
* The SSH daemon must only accept connections from a Single
workstation.
* All host-based firewalls must be disabled on all workstations.
* All devices must have the latest updates from within the past eight
days.
* All HDDs must be configured to secure data at rest.
* Cleartext services are not allowed.
* All devices must be hardened when possible.
Instructions:
Click on the various workstations and network devices to review the posture assessment results. Remediate any possible issues or indicate that no issue is found.
Click on Server A to review output dat
a. Select commands in the appropriate tab to remediate connectivity problems to the pOSTGREsql DATABASE VIA ssh
WAP A
PC A
Laptop A
Switch A
Switch B:
Laptop B
PC B
PC C
Server A
Answer:
Explanation:
See the answer below in Explanation
Explanation:
WAP A: No issue found. The WAP A is configured correctly and meets the requirements.
PC A = Enable host-based firewall to block all traffic
This option will turn off the host-based firewall and allow all traffic to pass through. This will comply with the requirement and also improve the connectivity of PC A to other devices on the network. However, this option will also reduce the security of PC A and make it more vulnerable to attacks. Therefore, it is recommended to use other security measures, such as antivirus, encryption, and password complexity, to protect PC A from potential threats.
Laptop A: Patch management
This option will install the updates that are available for Laptop A and ensure that it has the most recent security patches and bug fixes. This will comply with the requirement and also improve the performance and stability of Laptop A. However, this option may also require a reboot of Laptop A and some downtime during the update process. Therefore, it is recommended to backup any important data and close any open applications before applying the updates.
Switch A: No issue found. The Switch A is configured correctly and meets the requirements.
Switch B: No issue found. The Switch B is configured correctly and meets the requirements.
Laptop B: Disable unneeded services
This option will stop and disable the telnet service that is using port 23 on Laptop B. Telnet is a cleartext service that transmits data in plain text over the network, which exposes it to eavesdropping, interception, and modification by attackers. By disabling the telnet service, you will comply with the requirement and also improve the security of Laptop B. However, this option may also affect the functionality of Laptop B if it needs to use telnet for remote administration or other purposes. Therefore, it is recommended to use a secure alternative to telnet, such as SSH or HTTPS, that encrypts the data in transit.
PC B: Enable disk encryption
This option will encrypt the HDD of PC B using a tool such as BitLocker or VeraCrypt. Disk encryption is a technique that protects data at rest by converting it into an unreadable format that can only be decrypted with a valid key or password. By enabling disk encryption, you will comply with the requirement and also improve the confidentiality and integrity of PC B's data. However, this option may also affect the performance and usability of PC B, as it requires additional processing time and user authentication to access the encrypted data. Therefore, it is recommended to backup any important data and choose a strong key or password before encrypting the disk.
PC C: Disable unneeded services
This option will stop and disable the SSH daemon that is using port 22 on PC C. SSH is a secure service that allows remote access and command execution over an encrypted channel. However, port 22 is the default and well-known port for SSH, which makes it a common target for brute-force attacks and port scanning. By disabling the SSH daemon on port 22, you will comply with the requirement and also improve the security of PC C. However, this option may also affect the functionality of PC C if it needs to use SSH for remote administration or other purposes. Therefore, it is recommended to enable the SSH daemon on a different port, such as 4022, by editing the configuration file using the following command:
sudo nano /etc/ssh/sshd_config
Server A. Need to select the following:
NEW QUESTION # 178
After investigating a recent security incident, a SOC analyst is charged with creating a reference guide for the entire team to use. Which of the following should the analyst create to address future incidents?
- A. Lessons learned
- B. Communication plan
- C. Root cause analysis
- D. Runbook
Answer: D
Explanation:
A runbook is a detailed guide that provides step-by-step instructions on how to respond to specific types of incidents. It is used by the SOC team to ensure a consistent, organized, and efficient response to incidents. In this case, after the incident investigation, creating a runbook would help standardize the response process for future security incidents, enabling the team to act quickly and effectively. CASP+ emphasizes the importance of having detailed runbooks for incident response as part of an organization's overall incident response strategy.
References:
CASP+ CAS-004 Exam Objectives: Domain 2.0 - Enterprise Security Operations (Incident Response and Runbooks) CompTIA CASP+ Study Guide: Incident Response Procedures and Runbooks
NEW QUESTION # 179
The principal security analyst for a global manufacturer is investigating a security incident related to abnormal behavior in the ICS network. A controller was restarted as part of the troubleshooting process, and the following issue was identified when the controller was restarted:
During the investigation, this modified firmware version was identified on several other controllers at the site.
The official vendor firmware versions do not have this checksum. Which of the following stages of the MITRE ATT&CK framework for ICS includes this technique?
- A. Lateral movement
- B. Evasion
- C. Collection
- D. Persistence
Answer: D
Explanation:
The MITRE ATT&CK framework for ICS (Industrial Control Systems) details various tactics and techniques that may be used by adversaries. In the scenario described, the presence of unexpected firmware versions with a checksum that does not match the official vendor firmware indicates that the firmware has been modified. In the MITRE ATT&CK framework for ICS, this falls under the "Persistence" tactic, as it demonstrates an adversary's ability to maintain their foothold within the environment through unauthorized modification of device firmware.
NEW QUESTION # 180
A customer reports being unable to connect to a website at www.test.com to consume services. The customer notices the web application has the following published cipher suite:
Which of the following is the MOST likely cause of the customer's inability to connect?
- A. The default should be on port 80.
- B. The public key should be using ECDSA.
- C. Weak ciphers are being used.
- D. The server name should be test.com.
Answer: C
Explanation:
Reference:
https://security.stackexchange.com/questions/23383/ssh-key-type-rsa-dsa-ecdsa-are-there-easy-answers-for-whic
NEW QUESTION # 181
ACSP, which wants to compete in the market, has been approaching companies in an attempt to gain business, The CSP is able to provide the same uptime as other CSPs at a markedly reduced cost. Which of the following would be the MOST significant business risk to a company that signs a contract with this CSP?
- A. Geographic location
- B. Control plane breach
- C. Vendor lock-in
- D. Resource exhaustion
Answer: D
Explanation:
Resource exhaustion is a condition that occurs when a system or service runs out of resources, such as memory, CPU, disk space, or bandwidth, and becomes unable to function properly or respond to requests. Resource exhaustion can be caused by high demand, poor design, misconfiguration, or malicious attacks, such as denial-of-service (DoS). Resource exhaustion would be the most significant business risk to a company that signs a contract with a cloud service provider (CSP) that is able to provide the same uptime as other CSPs at a markedly reduced cost, because this could:
Indicate that the CSP is oversubscribing or underprovisioning its resources, which could result in performance degradation, service disruption, or data loss for the company. Affect the company's availability, reliability, and scalability requirements, which could impact its operations, reputation, and customer satisfaction.
Expose the company to potential security breaches or compliance violations, if the CSP does not implement adequate security controls or measures to prevent or mitigate resource exhaustion.
NEW QUESTION # 182
A new requirement for legislators has forced a government security team to develop a validation process to verify the integrity of a downloaded file and the sender of the file Which of the following is the BEST way for the security team to comply with this requirement?
- A. Message digest
- B. Digital signature
- C. Message hash
- D. Message authentication code
Answer: B
Explanation:
Explanation
A digital signature is a cryptographic technique that allows the sender of a file to sign it with their private key and the receiver to verify it with the sender's public key. This ensures the integrity and authenticity of the file, as well as the non-repudiation of the sender. A message hash or a message digest is a one-way function that produces a fixed-length output from an input, but it does not provide any information about the sender. A message authentication code (MAC) is a symmetric-key technique that allows both the sender and the receiver to generate and verify a code using a shared secret key, but it does not provide non-repudiation. References:
[CompTIA Advanced Security Practitioner (CASP+) Certification Exam Objectives], Domain 2: Enterprise Security Architecture, Objective 2.1: Apply cryptographic techniques
NEW QUESTION # 183
A security analyst discovered that the company's WAF was not properly configured. The main web server was breached, and the following payload was found in one of the malicious requests:
Which of the following would BEST mitigate this vulnerability?
- A. CAPTCHA
- B. Network intrusion prevention
- C. Input validation
- D. Data encoding
Answer: C
Explanation:
Reference: https://hdivsecurity.com/owasp-xml-external-entities-xxe
NEW QUESTION # 184
Which of the following risks does expanding business into a foreign country carry?
- A. Export controls might decrease software costs
- B. Data sovereignty laws could result in unexpected liability
- C. Data ownership might revert to the regulatory entities in the new country
- D. Some security tools might be monitored by legal authorities
Answer: B
NEW QUESTION # 185
A security engineer has been asked to close all non-secure connections from the corporate network. The engineer is attempting to understand why the corporate UTM will not allow users to download email via IMAPS. The engineer formulates a theory and begins testing by creating the firewall ID 58, and users are able to download emails correctly by using IMAP instead. The network comprises three VLANs:
The security engineer looks at the UTM firewall rules and finds the following:
Which of the following should the security engineer do to ensure IMAPS functions properly on the corporate user network?
- A. Contact the email service provider and ask if the company IP is blocked.
- B. Make sure the UTM certificate is imported on the corporate computers.
- C. Create an IMAPS firewall rule to ensure email is allowed.
- D. Confirm the email server certificate is installed on the corporate computers.
Answer: B
NEW QUESTION # 186
......
Free CAS-004 Exam Dumps to Improve Exam Score: https://www.exam4tests.com/CAS-004-valid-braindumps.html
2026 Realistic CAS-004 Dumps Exam Tips Test Pdf Exam Materials: https://drive.google.com/open?id=1q6zxWR0ehMFMnsuCPg19mb1qZ47HH5SA