CompTIA CAS-001 Online Practice Questions and Exam Preparation

CompTIA CAS-001 Online Questions & Answers

• Question 211:

  A mature organization with legacy information systems has incorporated numerous new processes and dependencies to manage security as its networks and infrastructure are modernized. The Chief Information Office has become increasingly frustrated with frequent releases, stating that the organization needs everything to work completely, and the vendor should already have those desires built into the software product. The vendor has been in constant communication with personnel and groups within the organization to understand its business process and capture new software requirements from users.

  Which of the following methods of software development is this organization's configuration management process using?

  A. Agile
  B. SDL
  C. Waterfall
  D. Joint application development
  A. Agile

• Question 212:

  A corporate executive lost their smartphone while on an overseas business trip. The phone was equipped with file encryption and secured with a strong passphrase. The phone contained over 60GB of proprietary data. Given this scenario, which of the following is the BEST course of action?

  A. File an insurance claim and assure the executive the data is secure because it is encrypted.
  B. Immediately implement a plan to remotely wipe all data from the device.
  C. Have the executive change all passwords and issue the executive a new phone.
  D. Execute a plan to remotely disable the device and report the loss to the police.
  B. Immediately implement a plan to remotely wipe all data from the device.

• Question 213:

  A replacement CRM has had its business case approved. In preparation for a requirements workshop, an architect is working with a business analyst to ensure that appropriate security requirements have been captured. Which of the following documents BEST captures the security requirements?

  A. Business requirements document
  B. Requirements traceability matrix document
  C. Use case and viewpoints document
  D. Solution overview document
  A. Business requirements document

• Question 214:

  The Information Security Officer (ISO) is reviewing new policies that have been recently made effective and now apply to the company. Upon review, the ISO identifies a new requirement to implement two-factor authentication on the company's wireless system. Due to budget constraints, the company will be unable to implement the requirement for the next two years. The ISO is required to submit a policy exception form to the Chief Information Officer (CIO).

  Which of the following are MOST important to include when submitting the exception form? (Select THREE).

  A. Business or technical justification for not implementing the requirements.
  B. Risks associated with the inability to implement the requirements.
  C. Industry best practices with respect to the technical implementation of the current controls.
  D. All section of the policy that may justify non-implementation of the requirements.
  E. A revised DRP and COOP plan to the exception form.
  F. Internal procedures that may justify a budget submission to implement the new requirement.
  G. Current and planned controls to mitigate the risks.
  A. Business or technical justification for not implementing the requirements.
  B. Risks associated with the inability to implement the requirements.
  G. Current and planned controls to mitigate the risks.

• Question 215:

  Company A is purchasing Company B. Company A uses a change management system for all IT processes while Company B does not have one in place. Company B's IT staff needs to purchase a third party product to enhance production. Which of the following NEXT steps should be implemented to address the security impacts this product may cause?

  A. Purchase the product and test it in a lab environment before installing it on any live system.
  B. Allow Company A and B's IT staff to evaluate the new product prior to purchasing it.
  C. Purchase the product and test it on a few systems before installing it throughout the entire company.
  D. Use Company A's change management process during the evaluation of the new product.
  D. Use Company A's change management process during the evaluation of the new product.

• Question 216:

  A UNIX administrator notifies the storage administrator that extra LUNs can be seen on a UNIX server. The LUNs appear to be NTFS file systems. Which of the following MOST likely happened?

  A. The iSCSI initiator was not restarted.
  B. The NTFS LUNs are snapshots.
  C. The HBA allocation is wrong.
  D. The UNIX server is multipathed.
  C. The HBA allocation is wrong.

• Question 217:

  An administrator is unable to connect to a server via VNC.

  Upon investigating the host firewall configuration, the administrator sees the following lines:

  

  A INPUT -m state --state NEW -m tcp -p tcp --dport 3389 -j DENY

  

  A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j DENY

  

  A INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPT

  

  A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j DENY

  

  A INPUT -m state --state NEW -m tcp -p tcp --sport 3389 -j ACCEPT

  Which of the following should occur to allow VNC access to the server?

  A. DENY needs to be changed to ACCEPT on one line.
  B. A line needs to be added.
  C. A line needs to be removed.
  D. Fix the typo in one line.
  B. A line needs to be added.

• Question 218:

  The network administrator has been tracking the cause of network performance problems and decides to take a look at the internal and external router stats.

  

  Which of the following should the network administrator do to resolve the performance issue after analyzing the above information?

  A. The IP TOS field of business related network traffic should be modified accordingly.
  B. The TCP flags of business related traffic should be modified accordingly.
  C. An ACL should be placed on the external router to drop incoming ICMP packets.
  D. An ACL should be placed on the internal router to drop layer 4 packets to and from port 0.
  A. The IP TOS field of business related network traffic should be modified accordingly.

• Question 219:

  A small company hosting multiple virtualized client servers on a single host is considering adding a new host to create a cluster. The new host hardware and operating system will be different from the first host, but the underlying virtualization technology will be compatible. Both hosts will be connected to a shared iSCSI storage solution.

  Which of the following is the hosting company MOST likely trying to achieve?

  A. Increased customer data availability
  B. Increased customer data confidentiality
  C. Increased security through provisioning
  D. Increased security through data integrity
  A. Increased customer data availability

• Question 220:

  An organization has had component integration related vulnerabilities exploited in consecutive releases of the software it hosts. The only reason the company was able to identify the compromises was because of a correlation of slow server performance and an attentive security analyst noticing unusual outbound network activity from the application servers. End-to-end management of the development process is the responsibility of the applications development manager and testing is done by various teams of programmers.

  Which of the following will MOST likely reduce the likelihood of similar incidents?

  A. Conduct monthly audits to verify that application modifications do not introduce new vulnerabilities.
  B. Implement a peer code review requirement prior to releasing code into production.
  C. Follow secure coding practices to minimize the likelihood of creating vulnerable applications.
  D. Establish cross-functional planning and testing requirements for software development activities.
  D. Establish cross-functional planning and testing requirements for software development activities.