CAS-004 Exam Dumps | A security engineer receives reports through the organization's bug bounty program about remote code

<< Prev Question Next Question >>

Question 261/274

A security engineer receives reports through the organization's bug bounty program about remote code execution in a specific component in a custom application. Management wants to properly secure the component and proactively avoid similar issues. Which of the following is the best approach to uncover additional vulnerable paths in the application?

A. Implement fuzz testing focused on the component and inputs uncovered by the bug bounty program.

B. Leverage a software composition analysis tool to find all known vulnerabilities in dependencies.

C. Use a vulnerability scanner to perform multiple types of network scans to look for vulnerabilities.

D. Utilize a network traffic analyzer to find malicious packet combinations that lead to remote code execution.

E. Run an exploit framework with all payloads against the application to see if it is able to gain access.

Question List (274q): Question 1: During a recent breach, an attacker was able to get a user's...; Question 2: An organization has severallegacy systemsthat are critical t...; Question 3: Device event logs sources from MDM software as follows: (Exh...; Question 4: A security engineer has learned that terminated employees' a...; Question 5: A system administrator at a medical imaging company discover...; Question 6: A small bank is evaluating different methods to address and ...; Question 7: A penetration tester inputs the following command: (Exhibit)...; Question 8: An organization has an operational requirement with a specif...; Question 9: While performing mandatory monthly patch updates on a produc...; Question 10: An organization requires a legacy system to incorporate refe...; Question 11: A company's Chief Information Security Officer is concerned ...; Question 12: A software development company is building a new mobile appl...; Question 13: An loT device implements an encryption module built within i...; Question 14: A cloud security architect has been tasked with finding a so...; Question 15: A security analyst is concerned that a malicious piece of co...; Question 16: A security review of the architecture for an application mig...; Question 17: A security architect discovers the following page while test...; Question 18: A security manager is creating a standard configuration acro...; Question 19: A retail organization wants to properly test and verify its ...; Question 20: A client is adding scope to a project. Which of the followin...; Question 21: A security engineer is reviewing a record of events after a ...; Question 22: A security analyst reviews network logs and notices a large ...; Question 23: In a cloud environment, the provider offers relief to an org...; Question 24: A company recently acquired a SaaS company and performed a g...; Question 25: A company wants to improve the security of its web applicati...; Question 26: A cybersecurity analyst discovered a private key that could ...; Question 27: A company created an external, PHP-based web application for...; Question 28: The general counsel at an organization has received written ...; Question 29: A security engineer needs to review the configurations of se...; Question 30: Users are reporting intermittent access issues with a new cl...; Question 31: As part of its risk strategy, a company is considering buyin...; Question 32: An organization is referencing NIST best practices for BCP c...; Question 33: A forensic investigator started the process of gathering evi...; Question 34: A company has a BYOD policy and has configured remote-wiping...; Question 35: An organization is considering a BYOD standard to support re...; Question 36: A cloud security engineer is setting up a cloud-hosted WAF. ...; Question 37: In support of disaster recovery objectives, a third party ag...; Question 38: A forensics investigator is analyzing an executable file ext...; Question 39: A company uses a CSP to provide a front end for its new paym...; Question 40: An organization handles sensitive information that must be d...; Question 41: An attack team performed a penetration test on a new smart c...; Question 42: A security architect is implementing a web application that ...; Question 43: A security administrator is setting up a virtualization solu...; Question 44: A Chief information Security Officer (CISO) has launched to ...; Question 45: A company suspects a web server may have been infiltrated by...; Question 46: A security analyst is examining a former employee's laptop f...; Question 47: An application engineer is using the Swagger framework to le...; Question 48: A security analyst for a managed service provider wants to i...; Question 49: A DevOps team has deployed databases, event-driven services,...; Question 50: After a server was compromised an incident responder looks a...; Question 51: An HVAC contractor requested network connectivity permission...; Question 52: In order to authenticate employees who, call in remotely, a ...; Question 53: A company wants to quantify and communicate the effectivenes...; Question 54: Immediately following the report of a potential breach, a se...; Question 55: An analyst is working to address a potential compromise of a...; Question 56: A security engineer has been informed by the firewall team t...; Question 57: A software developer needs to add an authentication method t...; Question 58: A software company wants to build a platform by integrating ...; Question 59: Which of the following processes involves searching and coll...; Question 60: A security architect Is analyzing an old application that is...; Question 61: A company just released a new video card. Due to limited sup...; Question 62: A company that provides services to clients who work with hi...; Question 63: A user experiences an HTTPS connection error when trying to ...; Question 64: A security engineer evaluates the overall security of a cust...; Question 65: Users are reporting intermittent access issues with & ne...; Question 66: An analyst has prepared several possible solutions to a succ...; Question 67: A company is developing an application that will be used to ...; Question 68: Given the following log snippet from a web server: (Exhibit)...; Question 69: A company wants to improve Its active protection capabilitie...; Question 70: A shipping company that is trying to eliminate entire classe...; Question 71: PKI can be used to support security requirements in the chan...; Question 72: A security engineer is assessing a legacy server and needs t...; Question 73: A new, online file hosting service is being offered. The ser...; Question 74: Due to locality and budget constraints, an organization's sa...; Question 75: A developer implement the following code snippet. (Exhibit) ...; Question 76: The Chief Information Security Officer (CISO) is working wit...; Question 77: A cybersecurity analyst created the following tables to help...; Question 78: A senior security analyst is helping the development team im...; Question 79: A software house is developing a new application. The applic...; Question 80: A CSP, which wants to compete in the market, has been approa...; Question 81: A security analyst is validating the MAC policy on a set of ...; Question 82: A software development company needs to mitigate third-party...; Question 83: A third-party organization has implemented a system that all...; Question 84: A security engineer is implementing DLP. Which of the follow...; Question 85: A company is rewriting a vulnerable application and adding t...; Question 86: A Chief Information Security Officer is concerned about the ...; Question 87: A small company recently developed prototype technology for ...; Question 88: A cybersecurity analyst receives a ticket that indicates a p...; Question 89: A new web server must comply with new secure-by-design princ...; Question 90: A security analyst identified a vulnerable and deprecated ru...; Question 91: A penetration tester discovers a condition that causes unexp...; Question 92: During a vendor assessment, an analyst reviews a listing of ...; Question 93: Recently, two large engineering companies in the same line o...; Question 94: An organization is moving its intellectual property data fro...; Question 95: city government's IT director was notified by the City counc...; Question 96: A company is looking for a solution to hide data stored in d...; Question 97: A security consultant is designing an infrastructure securit...; Question 98: A company has hired a security architect to address several ...; Question 99: A cybersecurity engineer analyst a system for vulnerabilitie...; Question 100: Which of the following best describes a risk associated with...; Question 101: An organization recently recovered from an attack that featu...; Question 102: An organization's finance system was recently attacked. A fo...; Question 103: A security architect recommends replacing the company's mono...; Question 104: A company's product site recently had failed API calls, resu...; Question 105: Which of the following testing plans is used to discuss disa...; Question 106: A company in the financial sector receives a substantial num...; Question 107: A pharmaceutical company recently experienced a security bre...; Question 108: A security engineer was auditing an organization's current s...; Question 109: Which of the following is the BEST disaster recovery solutio...; Question 110: A security engineer has been asked to close all non-secure c...; Question 111: A software developer has been tasked with creating a unique ...; Question 112: A technician accidentally deleted the secret key that was co...; Question 113: An organization is preparing to migrate its production envir...; Question 114: A web application server is running a legacy operating syste...; Question 115: Leveraging cryptographic solutions to protect data that is i...; Question 116: A Chief Information Security Officer (CISO) received a call ...; Question 117: An auditor Is reviewing the logs from a web application to d...; Question 118: A company recently deployed new servers to create an additio...; Question 119: A security auditor needs to review the manner in which an en...; Question 120: The management team at a company with a large, aging server ...; Question 121: A software development company makes Its software version av...; Question 122: A security engineer needs to recommend a solution that will ...; Question 123: An IT administrator is reviewing all the servers in an organ...; Question 124: A security administrator needs to recommend an encryption pr...; Question 125: A cloud security architect has been tasked with selecting th...; Question 126: A systems administrator is in the process of hardening the h...; Question 127: A company is looking to fortify its cybersecurity defenses a...; Question 128: Ann, a CIRT member, is conducting incident response activiti...; Question 129: A security analyst is designing a touch screen device so use...; Question 130: A company hired a third party to develop software as part of...; Question 131: A recent security assessment generated a recommendation to t...; Question 132: A user forwarded a suspicious email to a security analyst fo...; Question 133: An ASIC manufacturer wishing to best reduce downstream suppl...; Question 134: A security architect was asked to modify an existing interna...; Question 135: A security analyst discovered that the company's WAF was not...; Question 136: An organization performed a risk assessment and discovered t...; Question 137: A company Invested a total of $10 million lor a new storage ...; Question 138: Two companies that recently merged would like to unify appli...; Question 139: A small company needs to reduce its operating costs. vendors...; Question 140: The information security manager at a 24-hour manufacturing ...; Question 141: A security analyst is researching containerization concepts ...; Question 142: A regulated company is in the process of refreshing its enti...; Question 143: A company security engineer arrives at work to face the foll...; Question 144: A health company has reached the physical and computing capa...; Question 145: A security analyst has been provided the following partial S...; Question 146: A company publishes several APIs for customers and is requir...; Question 147: A Chief Security Officer (CSO) is concerned about the number...; Question 148: A network administrator who manages a Linux web server notic...; Question 149: A high-severity vulnerability was found on a web application...; Question 150: A large organization is planning to migrate from on premises...; Question 151: A developer needs to implement PKI in an autonomous vehicle'...; Question 152: A security architect is working with a new customer to find ...; Question 153: A security architect examines a section of code and discover...; Question 154: An organization is deploying a container-based application t...; Question 155: A company is preparing to deploy a global service. Which of ...; Question 156: A vulnerability scanner detected an obsolete version of an o...; Question 157: A security analyst has been tasked with providing key inform...; Question 158: A security team is concerned with attacks that are taking ad...; Question 159: A networking team was asked to provide secure remote access ...; Question 160: Which of the following best describes what happens if chain ...; Question 161: Which of the following is the primary reason that a risk pra...; Question 162: Which of the following technologies would benefit the most f...; Question 163: A security administrator configured the account policies per...; Question 164: An organization is assessing the security posture of a new S...; Question 165: A company recently acquired a SaaS provider and needs to int...; Question 166: A company has a website with a huge database. The company wa...; Question 167: In preparation for the holiday season, a company redesigned ...; Question 168: A company Is adopting a new artificial-intelligence-based an...; Question 169: A host on a company's network has been infected by a worm th...; Question 170: An organization wants to perform a scan of all its systems a...; Question 171: A security analyst is trying to identify the source of a rec...; Question 172: A security analyst detected a malicious PowerShell attack on...; Question 173: A security technician is investigating a system that tracks ...; Question 174: A developer is creating a new mobile application for a compa...; Question 175: Which of the following controls primarily detects abuse of p...; Question 176: A company has integrated source code from a subcontractor in...; Question 177: A security team receives alerts regarding impossible travel ...; Question 178: A security engineer is performing a threat modeling procedur...; Question 179: A security team received a regulatory notice asking for info...; Question 180: A SaaS startup is maturing its DevSecOps program and wants t...; Question 181: A company provides guest WiFi access to the internet and phy...; Question 182: loCs were missed during a recent security incident due to th...; Question 183: A company has been the target of LDAP injections, as well as...; Question 184: A security solution uses a sandbox environment to execute ze...; Question 185: A security administrator wants to detect a potential forged ...; Question 186: An organization is designing a MAC scheme (or critical serve...; Question 187: Which of the following is the best reason for obtaining file...; Question 188: A forensic investigator would use the foremost command for:...; Question 189: A security analyst runs a vulnerability scan on a network ad...; Question 190: A company's claims processed department has a mobile workfor...; Question 191: An investigator is attempting to determine if recent data br...; Question 192: An administrator at a software development company would lik...; Question 193: Clients are reporting slowness when attempting to access a s...; Question 194: The Chief information Security Officer (CISO) of a small loc...; Question 195: A security consultant needs to set up wireless security for ...; Question 196: A security architect is tasked with securing a new cloud-bas...; Question 197: An IPSec solution is being deployed. The configuration files...; Question 198: Which of the following represents the MOST significant benef...; Question 199: A company with customers in the United States and Europe wan...; Question 200: A security analyst has noticed a steady increase in the numb...; Question 201: A networking team asked a security administrator to enable F...; Question 202: An energy company is required to report the average pressure...; Question 203: The security analyst discovers a new device on the company's...; Question 204: A security administrator at a global organization wants to u...; Question 205: The CI/CD pipeline requires code to have close to zero defec...; Question 206: A security architect is reviewing the following organization...; Question 207: An internal security audit determines that Telnet is current...; Question 208: An application server was recently upgraded to prefer TLS 1....; Question 209: A security manager has written an incident response playbook...; Question 210: A small business requires a low-cost approach to theft detec...; Question 211: An organization's finance system was recently attacked. A fo...; Question 212: As part of the customer registration process to access a new...; Question 213: To save on device life-cycle costs, a company is transitioni...; Question 214: A user from the sales department opened a suspicious file at...; Question 215: Which of the following are risks associated with vendor lock...; Question 216: A security analyst is reviewing a new IOC in which data is i...; Question 217: Which of the following should an organization implement to p...; Question 218: A security architect updated the security policy to require ...; Question 219: A company reviews the regulatory requirements associated wit...; Question 220: A security consultant has been asked to recommend a secure n...; Question 221: An accounting team member received a voicemail message from ...; Question 222: A recentDASTscan indicates an application has multiple issue...; Question 223: Some end users of an e-commerce website are reporting a dela...; Question 224: A company's finance department acquired a new payment system...; Question 225: Ransomware encrypted the entire human resources fileshare fo...; Question 226: Clients are reporting slowness when attempting to access a s...; Question 227: A security analyst is investigating a possible buffer overfl...; Question 228: A local government that is investigating a data exfiltration...; Question 229: A company has moved its sensitive workloads lo the cloud and...; Question 230: During a system penetration test, a security engineer succes...; Question 231: The Chief Information Security Officer is concerned about th...; Question 232: A threat hunting team receives a report about possible APT a...; Question 233: A university issues badges through a homegrown identity mana...; Question 234: A PKI engineer is defining certificate templates for an orga...; Question 235: A security analyst is using data provided from a recent pene...; Question 236: Due to budget constraints, an organization created a policy ...; Question 237: A security engineer is troubleshooting an issue in which an ...; Question 238: A security administrator wants to enable a feature that woul...; Question 239: When implementing serverless computing an organization must ...; Question 240: A company's employees are not permitted to access company sy...; Question 241: Signed applications reduce risks by:...; Question 242: Which of the following is record-level encryption commonly u...; Question 243: An application security engineer is performing a vulnerabili...; Question 244: A company just released a new video card. Due to limited sup...; Question 245: During a remodel, a company's computer equipment was moved t...; Question 246: A security engineer is reviewing event logs because an emplo...; Question 247: A software developer must choose encryption algorithms to se...; Question 248: The primary advantage of an organization creating and mainta...; Question 249: A significant weather event caused all systems to fail over ...; Question 250: A security analyst discovered that a database administrator'...; Question 251: A network administrator for a completely air-gapped and clos...; Question 252: An IDS was unable to detect malicious network traffic during...; Question 253: A company recently migrated its critical web application to ...; Question 254: A company hired a third-party consultant to run a cybersecur...; Question 255: An organization recently started processing, transmitting, a...; Question 256: A security architect is implementing a SOAR solution in an o...; Question 257: A user logged in to a web application. Later, a SOC analyst ...; Question 258: A junior security researcher has identified a buffer overflo...; Question 259: You are an information security analyst tasked to provide fe...; Question 260: An organization requires a contractual document that include...; Question 261: A security engineer receives reports through the organizatio...; Question 262: A financial institution generates a list of newly created ac...; Question 263: A company is moving most of its customer-facing production s...; Question 264: A security engineer is hardening a company's multihomed SFTP...; Question 265: An organization wants to implement an access control system ...; Question 266: A security engineer thinks the development team has been har...; Question 267: A security analyst is investigating a series of suspicious e...; Question 268: A security engineer needs 10 implement a CASB to secure empl...; Question 269: A company undergoing digital transformation is reviewing the...; Question 270: An analyst reviews the following output collected during the...; Question 271: Which of the following terms refers to the delivery of encry...; Question 272: After installing an unapproved application on a personal dev...; Question 273: A company is decommissioning old servers and hard drives tha...; Question 274: A bank hired a security architect to improve its security me...

Question 261/274

LEAVE A REPLY

Download PDF File