CompTIA CAS-001 Online Practice Questions and Exam Preparation

CompTIA CAS-001 Online Questions & Answers

• Question 251:

  Company XYZ has employed a consultant to perform a controls assessment of the HR system, backend business operations, and the SCADA system used in the factory. Which of the following correctly states the risk management options that the consultant should use during the assessment?

  A. Risk reduction, risk sharing, risk retention, and risk acceptance.
  B. Avoid, transfer, mitigate, and accept.
  C. Risk likelihood, asset value, and threat level.
  D. Calculate risk by determining technical likelihood and potential business impact.
  B. Avoid, transfer, mitigate, and accept.

• Question 252:

  The IT department of a large telecommunications company has developed and finalized a set of security solutions and policies which have been approved by upper management for deployment within the company. During the development of the security solutions and policies, the FIRST thing the IT department should have done was:

  A. contact vendor management so the RFI and RFP process can be started as soon as possible.
  B. contact an independent consultant who can tell them what policies and solutions they need.
  C. discuss requirements with stakeholders from the various internal departments.
  D. involve facilities management early in the project so they can plan for the new security hardware in the data center.
  C. discuss requirements with stakeholders from the various internal departments.

• Question 253:

  Two universities are making their 802.11n wireless networks available to the other university's students. The infrastructure will pass the student's credentials back to the home school for authentication via the Internet.

  The requirements are:

  

  Mutual authentication of clients and authentication server

  

  The design should not limit connection speeds

  

  Authentication must be delegated to the home school No passwords should be sent unencrypted

  The following design was implemented:

  

  WPA2 Enterprise using EAP-PEAP-MSCHAPv2 will be used for wireless security

  

  RADIUS proxy servers will be used to forward authentication requests to the home school

  

  The RADIUS servers will have certificates from a common public certificate authority

  

  A strong shared secret will be used for RADIUS server authentication

  Which of the following security considerations should be added to the design?

  A. The transport layer between the RADIUS servers should be secured
  B. WPA Enterprise should be used to decrease the network overhead
  C. The RADIUS servers should have local accounts for the visiting students
  D. Students should be given certificates to use for authentication to the network
  A. The transport layer between the RADIUS servers should be secured

• Question 254:

  Company ABC was formed by combining numerous companies which all had multiple databases, web portals, and cloud data sets. Each data store had a unique set of custom developed authentication mechanisms and schemas. Which of the following approaches to combining the disparate mechanisms has the LOWEST up front development costs?

  A. Attestation
  B. PKI
  C. Biometrics
  D. Federated IDs
  D. Federated IDs

• Question 255:

  An administrator attempts to install the package "named.9.3.6-12-x86_64.rpm" on a server. Even though the package was downloaded from the official repository, the server states the package cannot be installed because no GPG key is found.

  Which of the following should the administrator perform to allow the program to be installed?

  A. Download the file from the program publisher's website.
  B. Generate RSA and DSA keys using GPG.
  C. Import the repository's public key.
  D. Run sha1sum and verify the hash.
  C. Import the repository's public key.

• Question 256:

  The sales staff at a software development company has received the following requirements from a customer: "We need the system to notify us in advance of all software errors and report all outages". Which of the following BEST conveys these customer requirements to the software development team to understand and implement?

  A. The system shall send a status message to a network monitoring console every five seconds while in an error state and the system should email the administrator when the number of input errors exceeds five.
  B. The system shall alert the administrator upon the loss of network communications and when error flags are thrown.
  C. The system shall email the administrator when processing deviates from expected conditions and the system shall send a heartbeat message to a monitoring console every second while in normal operations.
  D. The system shall email the administrator when an error condition is detected and a flag is thrown and the system shall send an email to the administrator when network communications are disrupted.
  C. The system shall email the administrator when processing deviates from expected conditions and the system shall send a heartbeat message to a monitoring console every second while in normal operations.

• Question 257:

  Part of the procedure for decommissioning a database server is to wipe all local disks, as well as SAN LUNs allocated to the server, even though the SAN itself is not being decommissioned. Which of the following is the reason for wiping the SAN LUNs?

  A. LUN masking will prevent the next server from accessing the LUNs.
  B. The data may be replicated to other sites that are not as secure.
  C. Data remnants remain on the LUN that could be read by other servers.
  D. The data is not encrypted during transport.
  C. Data remnants remain on the LUN that could be read by other servers.

• Question 258:

  As part of the testing phase in the SDLC, a software developer wants to verify that an application is properly handling user error exceptions. Which of the following is the BEST tool or process for the developer use?

  A. SRTM review
  B. Fuzzer
  C. Vulnerability assessment
  D. HTTP interceptor
  B. Fuzzer

• Question 259:

  Company ABC has recently completed the connection of its network to a national high speed private research network. Local businesses in the area are seeking sponsorship from Company ABC to connect to the high speed research network by directly connecting through Company ABC's network. Company ABC's Chief Information Officer (CIO) believes that this is an opportunity to increase revenues and visibility for the company, as well as promote research and development in the area.

  Which of the following must Company ABC require of its sponsored partners in order to document the technical security requirements of the connection?

  A. SLA
  B. ISA
  C. NDA
  D. BPA
  B. ISA

• Question 260:

  The security administrator is receiving numerous alerts from the internal IDS of a possible Conficker infection spreading through the network via the Windows file sharing services. Given the size of the company which deploys over 20,000 workstations and 1,000 servers, the security engineer believes that the best course of action is to block the file sharing service across the organization by placing ACLs on the internal routers.

  Which of the following should the security administrator do before applying the ACL?

  A. Quickly research best practices with respect to stopping Conficker infections and implement the solution.
  B. Consult with the rest of the security team and get approval on the solution by all the team members and the team manager.
  C. Apply the ACL immediately since this is an emergency that could lead to a widespread data compromise.
  D. Call an emergency change management meeting to ensure the ACL will not impact core business functions.
  D. Call an emergency change management meeting to ensure the ACL will not impact core business functions.