CompTIA Updated CAS-004 Exam Questions and Answers by eoin

In a PaaS implementation, the provider offers relief to the organization’s teams by sharing in many of the operational duties related to the application/platform software. The provider is responsible for securing and maintaining the underlying infrastructure, operating systems, middleware, runtime environments, and other software components that support the platform and the applications running on it. The provider also handles tasks such as patching, updating, scaling, and backing up the platform software.

A. Application-specific data assets are the responsibility of the organization in a PaaS implementation. The organization owns and controls its own data and must ensure its confidentiality, integrity, and availability. The organization must also comply with any applicable data protection laws and regulations.

B. Application user access management is the responsibility of the organization in a PaaS implementation. The organization must define and enforce its own policies and procedures for granting, revoking, and monitoring access to its applications and data. The organization must alsoensure that its users follow security best practices such as strong passwords and multifactor authentication.

C. Application-specific logic and code are the responsibility of the organization in a PaaS implementation. The organization must develop, test, deploy, and manage its own applications using the tools and services provided by the platform. The organization must also ensure that its applications are secure, reliable, and performant.

https://www.techtarget.com/searchcloudcomputing/feature/The-cloud-shared-responsibility-model-for-IaaS-PaaS-and-SaaS

An ISA, or interconnection security agreement, is a document that should be required to set up a dedicated VPN between two entities that provide specialized help desk services. An ISA defines the technical and security requirements for establishing, operating, and maintaining a secure connection between two or more organizations. An ISA also specifies the roles and responsibilities of each party, the security controls and policies to be implemented, the data types and classifications to be exchanged, and the incident response procedures to be followed.

The company should implement an EV certificate and HSTS on its new website. An EV certificate provides the highest level of web identity validation by requiring extensive verification of the organization’s identity and domain ownership. HSTS enforces encryption of all web transactions by redirecting HTTP requests to HTTPS and preventing users from accepting invalid certificates. These solutions would enhance the security and trustworthiness of the website without increasing complexity or expenditure significantly. Verified References:

https://www.entrust.com/digital-security/certificate-solutions/products/digital-certificates/tls-ssl-certificates

https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens

OS credential dumping is the process of obtaining account login and password information, normally in the form of a hash or a clear text password, from the operating system and software. System information discovery is the process of gathering information about the system, such as hostname, IP address, OS version, running processes, etc. Both of these techniques are commonly used by adversaries to gain access to sensitive data and resources on the target system. The command shown in the image is using Mimikatz, a tool that can dump credentials from memory, and also querying the system information using WMIC. Verified References:

https://attack.mitre.org/techniques/T1003/

https://attack.mitre.org/techniques/T1082/

https://github.com/gentilkiwi/mimikatz

https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic