CompTIA CAS-004 Questions Answers

A risk associated with SDN is the expanded attack surface that it introduces. SDN is a network architecture that decouples the control plane from the data plane, allowing centralized and programmable management of network devices and traffic. However, this also exposes new attack vectors and vulnerabilities that can compromise the security and performance of the network. For example, an attacker can target the SDN controller, which is the core component that communicates with and controls the network devices. A successful attack on the SDN controller can result in denial of service, unauthorized access, data leakage, or network hijacking. An attacker can also exploit the communication channels between the SDN controller and the network devices, such as the OpenFlow protocol, to intercept, modify, or inject malicious messages or commands. Additionally, an attacker can leverage malicious or compromised applications that run on top of the SDN controller to manipulate or disrupt the network behavior. Verified References:

When an EDR (Endpoint Detection and Response) system flags legitimate software as malicious, it is a false positive. This occurs when the EDR incorrectly identifies normal, non-malicious activity as a threat. The scenario described indicates that the development software was blocked even though there were no changes to the software, which suggests a false positive by the EDR system.

In the context of legal proceedings, "material" evidence refers to evidence that is relevant and has a significant impact on the case at hand. For digital evidence to be admissible in court, it must be material, meaning it must relate directly to the case and contribute to proving or disproving a key aspect of the case. Material evidence helps establish the facts and is crucial for the court's decision-making process.

The best way to reduce the risk of terminated employees’ accounts not being disabled is to automate the process by integrating Active Directory (AD) with the human resources information system (HRIS). By automating this integration, when an employee’s termination date is updated in the HRIS, the corresponding account in AD is automatically disabled, reducing the risk of accounts being left active after an employee leaves the organization. CASP+ highlights the importance of automating security processes, especially for user access management, to minimize human error and ensure timely action.

References:

CASP+ CAS-004 Exam Objectives: Domain 2.0 – Enterprise Security Operations (Automation of User Access Management)

CompTIA CASP+ Study Guide: Integration of HR Systems and Active Directory for Account Management