CompTIA CAS-001 Online Practice Questions and Exam Preparation

CompTIA CAS-001 Online Questions & Answers

• Question 1:

  An employee was terminated and promptly escorted to their exit interview, after which the employee left the building. It was later discovered that this employee had started a consulting business using screen shots of their work at the company which included live customer data. This information had been removed through the use of a USB device. After this incident, it was determined a process review must be conducted to ensure this issue does not recur.

  Which of the following business areas should primarily be involved in this discussion? (Select TWO).

  A. Database Administrator
  B. Human Resources
  C. Finance
  D. Network Administrator
  E. IT Management
  B. Human Resources
  E. IT Management

• Question 2:

  A manager who was attending an all-day training session was overdue entering bonus and payroll information for subordinates. The manager felt the best way to get the changes entered while in training was to log into the payroll system, and then activate desktop sharing with a trusted subordinate. The manager granted the subordinate control of the desktop thereby giving the subordinate full access to the payroll system. The subordinate did not have authorization to be in the payroll system. Another employee reported the incident to the security team.

  Which of the following would be the MOST appropriate method for dealing with this issue going forward?

  A. Provide targeted security awareness training and impose termination for repeat violators.
  B. Block desktop sharing and web conferencing applications and enable use only with approval.
  C. Actively monitor the data traffic for each employee using desktop sharing or web conferencing applications.
  D. Permanently block desktop sharing and web conferencing applications and do not allow its use at the company.
  A. Provide targeted security awareness training and impose termination for repeat violators.

• Question 3:

  An organization is selecting a SaaS provider to replace its legacy, in house Customer Resource Management (CRM) application. Which of the following ensures the organization mitigates the risk of managing separate user credentials?

  A. Ensure the SaaS provider supports dual factor authentication.
  B. Ensure the SaaS provider supports encrypted password transmission and storage.
  C. Ensure the SaaS provider supports secure hash file exchange.
  D. Ensure the SaaS provider supports role-based access control.
  E. Ensure the SaaS provider supports directory services federation.
  E. Ensure the SaaS provider supports directory services federation.

• Question 4:

  A security administrator is tasked with implementing two-factor authentication for the company VPN. The VPN is currently configured to authenticate VPN users against a backend RADIUS server. New company policies require a second factor of authentication, and the Information Security Officer has selected PKI as the second factor.

  Which of the following should the security administrator configure and implement on the VPN concentrator to implement the second factor and ensure that no error messages are displayed to the user during the VPN connection? (Select TWO).

  A. The user's certificate private key must be installed on the VPN concentrator.
  B. The CA's certificate private key must be installed on the VPN concentrator.
  C. The user certificate private key must be signed by the CA.
  D. The VPN concentrator's certificate private key must be signed by the CA and installed on the VPN concentrator.
  E. The VPN concentrator's certificate private key must be installed on the VPN concentrator.
  F. The CA's certificate public key must be installed on the VPN concentrator.
  E. The VPN concentrator's certificate private key must be installed on the VPN concentrator.
  F. The CA's certificate public key must be installed on the VPN concentrator.

• Question 5:

  A security engineer at a major financial institution is prototyping multiple secure network configurations. The testing is focused on understanding the impact each potential design will have on the three major security tenants of the network. All designs must take into account the stringent compliance and reporting requirements for most worldwide financial institutions.

  Which of the following is the BEST list of security lifecycle related concerns related to deploying the final design?

  A. Decommissioning the existing network smoothly, implementing maintenance and operations procedures for the new network in advance, and ensuring compliance with applicable regulations and laws.
  B. Interoperability with the Security Administration Remote Access protocol, integrity of the data at rest, overall network availability, and compliance with corporate and government regulations and policies.
  C. Resistance of the new network design to DDoS attacks, ability to ensure confidentiality of all data in transit, security of change management processes and procedures, and resilience of the firewalls to power fluctuations.
  D. Decommissioning plan for the new network, proper disposal protocols for the existing network equipment, transitioning operations to the new network on day one, and ensuring compliance with corporate data retention policies.
  E. Ensuring smooth transition of maintenance resources to support the new network, updating all whole disk encryption keys to be compatible with IPv6, and maximizing profits for bank shareholders.
  A. Decommissioning the existing network smoothly, implementing maintenance and operations procedures for the new network in advance, and ensuring compliance with applicable regulations and laws.

• Question 6:

  Which of the following precautions should be taken to harden network devices in case of VMEscape?

  A. Database servers should be on the same virtual server as web servers in the DMZ network segment.
  B. Web servers should be on the same physical server as database servers in the network segment.
  C. Virtual servers should only be on the same physical server as others in their network segment.
  D. Physical servers should only be on the same WAN as other physical servers in their network.
  C. Virtual servers should only be on the same physical server as others in their network segment.

• Question 7:

  A company is in the process of outsourcing its customer relationship management system to a cloud provider. It will host the entire organization's customer database. The database will be accessed by both the company's users and its customers. The procurement department has asked what security activities must be performed for the deal to proceed.

  Which of the following are the MOST appropriate security activities to be performed as part of due diligence? (Select TWO).

  A. Physical penetration test of the datacenter to ensure there are appropriate controls.
  B. Penetration testing of the solution to ensure that the customer data is well protected.
  C. Security clauses are implemented into the contract such as the right to audit.
  D. Review of the organizations security policies, procedures and relevant hosting certifications.
  E. Code review of the solution to ensure that there are no back doors located in the software.
  C. Security clauses are implemented into the contract such as the right to audit.
  D. Review of the organizations security policies, procedures and relevant hosting certifications.

• Question 8:

  Continuous monitoring is a popular risk reduction technique in many large organizations with formal certification processes for IT projects. In order to implement continuous monitoring in an effective manner which of the following is correct?

  A. Only security related alerts should be forwarded to the network team for resolution.
  B. All logs must be centrally managed and access to the logs restricted only to data storage staff.
  C. Logging must be set appropriately and alerts delivered to security staff in a timely manner.
  D. Critical logs must be monitored hourly and adequate staff must be assigned to the network team.
  C. Logging must be set appropriately and alerts delivered to security staff in a timely manner.

• Question 9:

  The Chief Executive Officer (CEO) of a corporation purchased the latest mobile device and wants to connect it to the internal network. The Chief Information Security Officer (CISO) was told to research and recommend how to secure this device.

  Which of the following should be implemented, keeping in mind that the CEO has stated that this access is required?

  A. Mitigate and Transfer
  B. Accept and Transfer
  C. Transfer and Avoid
  D. Avoid and Mitigate
  A. Mitigate and Transfer

• Question 10:

  Company A has a remote work force that often includes independent contractors and out of state full time employees. Company A's security engineer has been asked to implement a solution allowing these users to collaborate on projects with the following goals:

  

  All communications between parties need to be encrypted in transport

  

  Users must all have the same application sets at the same version

  

  All data must remain at Company A's site

  

  All users must not access the system between 12:00 and 1:00 as that is the maintenance window

  

  Easy to maintain, patch and change application environment

  Which of the following solutions should the security engineer recommend to meet the MOST goals?

  A. Create an SSL reverse proxy to a collaboration workspace. Use remote installation service to maintain application version. Have users use full desktop encryption. Schedule server downtime from 12:00 to 1:00 PM.
  B. Install an SSL VPN to Company A's datacenter, have users connect to a standard virtual workstation image, set workstation time of day restrictions.
  C. Create an extranet web portal using third party web based office applications. Ensure that Company A maintains the administrative access.
  D. Schedule server downtime from 12:00 to 1:00 PM, implement a Terminal Server Gateway, use remote installation services to standardize application on user's laptops.
  B. Install an SSL VPN to Company A's datacenter, have users connect to a standard virtual workstation image, set workstation time of day restrictions.