CompTIA CAS-005 Exam Dumps

Step-by-Step

Runtime Application Self-Protection (RASP) (A)monitors and protects applications in real time by detecting and blocking attacks as they occur. Unlike traditional security solutions, RASP is integrated into the application itself, meaning it works regardless of the programming language used. It effectively mitigates common vulnerabilities such as SQL injection, XSS, and buffer overflows.

Dynamic Application Security Testing (DAST) (C) is a passive scanning approach that may not prevent attacks in real-time, while Network Intrusion PreventionSystems (NIPS) (D) focuses on network traffic, not application-layer security.

The best answer is B. Conducting an OSINT assessment. In the early phases of threat modeling, the analyst wants to understand the organization's exposed attack surface, public footprint, prior breaches, reputational visibility, externally visible infrastructure, and information that threat actors can readily gather. Because the scenario explicitly says prior security failures were publicly disclosed and the organization operates globally, OSINT is the most practical first step to inform the threat model. CompTIA's official SecurityX objectives include ''Given a scenario, perform threat-modeling activities'' as part of the GRC domain, and that early work centers on understanding attacker perspective, exposure, and context before applying more specialized controls.

Why the other options are less appropriate early on:

A . STIX and TAXII are threat intelligence sharing and automation mechanisms, but they are not the first action for defining the organization's own threat model. C. Reviewing user behavior analytics and identity logs is useful for monitoring and investigations, but threat modeling starts earlier and more broadly than just log review. D. Performing a supply chain analysis could become important because development occurs overseas, but the question asks for the best action in the early phases, and OSINT more directly captures public exposure, previous incidents, and likely attacker reconnaissance opportunities. That makes it the most practical starting point.

CompTIA SecurityX official exam objectives summary showing threat-modeling activities within GRC.

CompTIA SecurityX CAS-005 exam objectives PDF mirror including the threat-modeling objective.

===========

Disabling unneeded servicesreduces the attack surface by closing open ports.Patchingensures that endpoint protection software and operating systems are up-to-date, reducing vulnerability exposure.Removing unused accountseliminates access paths for malicious users exploiting dormant accounts. Secure boot, BIOS passwords, and drive encryption are important, but they address different layers of security than the vulnerabilities listed.

===========

The logs reviewed for the user indicate that access is being denied due to time-based access restrictions. These restrictions are commonly implemented to limit access to systems during specific hours to enhance security. If a user attempts to authenticate outside of the allowed time window, access will be denied. This measure helps prevent unauthorized access during non-business hours, reducing the risk of security incidents.

CompTIA SecurityX Study Guide: Covers various access control methods, including time-based restrictions, as a means of enhancing security.

NIST Special Publication 800-53, 'Security and Privacy Controls for Information Systems and Organizations': Recommends the use of time-based access restrictions as part of access control policies.

'Access Control and Identity Management' by Mike Chapple and Aaron French: Discusses the implementation and benefits of time-based access restrictions.

Building playbooks for different scenarios and performing regular table-top exercises directly addresses the issues identified in the lessons-learned review. Here's why:

Lost important information for further analysis: Playbooks outline step-by-step procedures for incident response, ensuring that team members know exactly what to document and how to preserve evidence.

Did not utilize the chain of communication: Playbooks include communication protocols, specifying who to notify and when. Regular table-top exercises reinforce these communication channels, ensuring they are followed during actual incidents.

Did not follow the right steps for a proper response: Playbooks provide a clear sequence of actions to be taken during various types of incidents, helping the team to respond in a structured and effective manner. Regular exercises allow the team to practice these steps, identifying and correcting any deviations from the plan.

Investing in better forensic tools (Option A) or requiring certifications (Option C) are also valuable, but they do not directly address the procedural and communication gaps identified. Publishing and enforcing the incident response policy (Option D) is important but not as practical and hands-on as playbooks and exercises in ensuring the team is prepared.

CompTIA Security+ Study Guide

NIST SP 800-61 Rev. 2, 'Computer Security Incident Handling Guide'

SANS Institute, 'Incident Handler's Handbook'