Ace Your CAS-003 CompTIA CASP Exam

An incident response analyst is investigating a compromise on a application server within an organization. The analyst identifies an anomalous process that is executing and maintaining a persistent TCP connection to an external IP Which of the following actions should the analyst take NEXT?

A company s design team is increasingly concerned about intellectual property theft Members of the team often travel to suppliers' offices where they collaborate and share access to their sensitive data. Which of the following should be implemented?

An analyst is testing the security of a server and attempting to infiltrate the network. The analyst is able to obtain the following output after running some tools on the server.

Which of the following will the analyst most likely do NEXT?

An organization's email filler is an ineffective control and as a result employees have been constantly receiving phishing emails. As part of a security incident investigation a security analyst identifies the following:

1 An employee was working remotely when the security alert was triggered

2 An employee visited a number of uncategorized internet sites

3 A doc file was downloaded

4 A number of files were uploaded to an unknown collaboration site

Which of the following controls would provide the security analyst with more data to identify the root cause of the issue and protect the organization's information during future incidents?