Pass the CompTIA CASP CAS-005 Questions and answers with Dumpstech

The situation where several employees were contacted by the same individual impersonating a recruiter best describes aspear-phishing campaign. Here’s why:

Targeted Approach: Spear-phishing involves targeting specific individuals within an organization with personalized and convincing messages to trick them into divulging sensitive information or performing actions that compromise security.

Impersonation: The use of impersonation, in this case, a recruiter, is a common tactic in spear-phishing to gain the trust of the targeted individuals and increase the likelihood of a successful attack.

Correlated Contacts: The fact that several employees were contacted by the same individual suggests a coordinated effort to breach the organization’s security by targeting multiple points of entry through social engineering.

The first action should be to reset access for John and Joe, who are corporate accounts belonging to the organization. Their credentials were exposed in recent leaks, including one from an initial access broker (Joe), which indicates an active exploitation risk. Immediate password resets and session invalidations prevent adversaries from using the compromised credentials to gain access.

Ann’s account (@hotmail.com) is personal and not under corporate management, so while her exposure is concerning, it does not pose a direct risk to organizational systems. Contacting her can follow later steps but should not delay urgent remediation for John and Joe.

Option B delays remediation. Option C overreaches by including Ann in corporate resets. Option D includes contacting authorities prematurely, which is important but secondary to immediate containment.

CAS-005 emphasizes rapid containment of credential leaks affecting corporate identities, making access resets for John and Joe the first step.

For SSDs,incinerationis considered the most secure method of physical destruction, ensuring no data remanence. SSDs store data differently compared to traditional spinning disks, making degaussing ineffective. Overwriting and formatting may not reliably erase all storage cells due to wear-leveling technologies. Shredding may work if the granularity is extremely fine, but incineration guarantees complete destruction beyond recovery.

Determining if attacks are from the same actor requires unique attribution. Let’s analyze:

A. Code stylometry:Analyzes coding style to identify authorship, the best method for linking malware to a specific actor per CAS-005’s threat intelligence focus.

B. Common IOCs:Indicates similar attacks but not necessarily the same actor.

C. IOCextractions:Similar to B, lacks specificity for attribution.

The best solution is to provide a hash of all data made available (D). Hashing ensures the integrity of the threat intelligence data provided to customers. Clients can verify that the data received via API matches the published hash, ensuring no tampering occurred in transit or at rest. This supports customer trust and aligns with the objective of protecting data integrity while maintaining availability.

Option A (API secret keys) improves authentication and reduces attack surface but does not address integrity or compute efficiency. Option B (publishing IoCs publicly) increases attack surface and reduces control over distribution, which conflicts with security objectives. Option C (rate limiting) helps availability and cost control but does not guarantee data integrity.

By providing hashes, the company ensures customers can validate authenticity regardless of delivery method, reducing the risk of manipulated IoCs. This approach also minimizes compute spend since hashing is lightweight compared to continuous verification processes.

Therefore, the strongest alignment with all stated objectives—availability, reduced spend, reduced attack surface, and integrity—is achieved by providing hashes of all threat intelligence data.

Unauthorized code changesand lack ofindependent verificationare directly mitigated bycode signing, which ensures that code is from a trusted source and has not been altered.

While digital signatures are part of code signing, the broader practice of code signing encompasses signature management, version integrity, and trusted sources.

Lightweight cryptography is irrelevant in this context; it ' s more about efficiency in constrained devices.

Non-repudiation is a benefit of digital signatures but doesn ' t directly solve the verification/integrity concerns alone.

FromCAS-005 Guide, Domain 4: Security Architecture, Tools, and Technologies:

“Code signing ensures that the code has not been tampered with and originates from a trusted developer.”

A computer screen shot of a diagram Description automatically generated

A screenshot of a computer error Description automatically generated

The scenario describes a prolonged, stealthy operation where files were exfiltrated over three months via secure channels (TLS-protected HTTP) from unexpected systems, then ceased. This aligns with anAdvanced Persistent Threat (APT), characterized by long-term, targeted attacks aimed at data theft or surveillance, often using sophisticated methods to remain undetected.

Option A:Decrypting RSA with weak encryption implies a cryptographic attack, but TLS suggests modern encryption was used, and there’s no evidence of decryption here.

Option B:A zero-day attack exploits unknown vulnerabilities, but the duration and cessation suggest a planned operation, not a single exploit.

Option C:APT fits perfectly—slow, persistent exfiltration fromunusual systems indicates a coordinated, stealthy threat actor.

Option D:An on-path (man-in-the-middle) attack intercepts traffic, but there’s no indication of interception; the focus is on unauthorized transfers.

Integrating IDS, firewall, and DLP to reduce response time requires orchestration and automation. Let’s evaluate:

A. SOAR(Security Orchestration, Automation, and Response):SOAR integrates security tools, automates workflows, and speeds up incident response. It’s the best fit for this scenario, as CAS-005 highlights SOAR for operational efficiency.

B. CWPP (CloudWorkload Protection Platform):Focused on securing cloud workloads, not integrating on-premises tools.

C. XCCDF (Extensible Configuration Checklist Description Format):A standard for compliance checklists, not a tool for integration or response.