CompTIA CAS-001 Online Practice Questions and Exam Preparation

CompTIA CAS-001 Online Questions & Answers

• Question 301:

  The IT manager is evaluating IPS products to determine which would be most effective at stopping network traffic that contains anomalous content on networks that carry very specific types of traffic. Based on the IT manager's requirements, which of the following types of IPS products would be BEST suited for use in this situation?

  A. Signature-based
  B. Rate-based
  C. Anomaly-based
  D. Host-based
  A. Signature-based

• Question 302:

  A security administrator at Company XYZ is trying to develop a body of knowledge to enable heuristic and behavior based security event monitoring of activities on a geographically distributed network. Instrumentation is chosen to allow for monitoring and measuring the network.

  Which of the following is the BEST methodology to use in establishing this baseline?

  A. Model the network in a series of VMs; instrument the systems to record comprehensive metrics; run a large volume of simulated data through the model; record and analyze results; document expected future behavior.
  B. Completely duplicate the network on virtual machines; replay eight hours of captured corporate network traffic through the duplicate network; instrument the network; analyze the results; document the baseline.
  C. Instrument the operational network; simulate extra traffic on the network; analyze net flow information from all network devices; document the baseline volume of traffic.
  D. Schedule testing on operational systems when users are not present; instrument the systems to log all network traffic; monitor the network for at least eight hours; analyze the results; document the established baseline.
  A. Model the network in a series of VMs; instrument the systems to record comprehensive metrics; run a large volume of simulated data through the model; record and analyze results; document expected future behavior.

• Question 303:

  The security manager of a company has hired an external consultant to conduct a security assessment of the company network. The contract stipulates that the consultant is not allowed to transmit any data on the company network while performing wired and wireless security assessments.

  Which of the following technical means can the consultant use to determine the manufacturer and likely operating system of the company wireless and wired network devices, as well as the computers connected to the company network?

  A. Social engineering
  B. Protocol analyzer
  C. Port scanner
  D. Grey box testing
  B. Protocol analyzer

• Question 304:

  A user logs into domain A using a PKI certificate on a smartcard protected by an 8 digit PIN. The credential is cached by the authenticating server in domain A. Later, the user attempts to access a resource in domain B. This initiates a request to the original authenticating server to somehow attest to the resource server in the second domain that the user is in fact who they claim to be.

  Which of the following is being described?

  A. Authentication
  B. Authorization
  C. SAML
  D. Kerberos
  C. SAML

• Question 305:

  A new IDS device is generating a very large number of irrelevant events. Which of the following would BEST remedy this problem?

  A. Change the IDS to use a heuristic anomaly filter.
  B. Adjust IDS filters to decrease the number of false positives.
  C. Change the IDS filter to data mine the false positives for statistical trending data.
  D. Adjust IDS filters to increase the number of false negatives.
  B. Adjust IDS filters to decrease the number of false positives.

• Question 306:

  A security administrator notices a recent increase in workstations becoming compromised by malware. Often, the malware is delivered via drive-by downloads, from malware hosting websites, and is not being detected by the corporate antivirus.

  Which of the following solutions would provide the BEST protection for the company?

  A. Increase the frequency of antivirus downloads and install updates to all workstations.
  B. Deploy a cloud-based content filter and enable the appropriate category to prevent further infections.
  C. Deploy a NIPS to inspect and block all web traffic which may contain malware and exploits.
  D. Deploy a web based gateway antivirus server to intercept viruses before they enter the network.
  B. Deploy a cloud-based content filter and enable the appropriate category to prevent further infections.

• Question 307:

  A vulnerability research team has detected a new variant of a stealth Trojan that disables itself when it detects that it is running on a virtualized environment. The team decides to use dedicated hardware and local network to identify the Trojan's behavior and the remote DNS and IP addresses it connects to.

  Which of the following tools is BEST suited to identify the DNS and IP addresses the stealth Trojan communicates with after its payload is decrypted?

  A. HIDS
  B. Vulnerability scanner
  C. Packet analyzer
  D. Firewall logs
  E. Disassembler
  C. Packet analyzer

• Question 308:

  Executive management is asking for a new manufacturing control and workflow automation solution. This application will facilitate management of proprietary information and closely guarded corporate trade secrets.

  The information security team has been a part of the department meetings and come away with the following notes:

  -Human resources would like complete access to employee data stored in the application. They would like automated data interchange with the employee management application, a cloud- based SaaS application.

  -Sales is asking for easy order tracking to facilitate feedback to customers.

  -Legal is asking for adequate safeguards to protect trade secrets. They are also concerned with data ownership questions and legal jurisdiction.

  -Manufacturing is asking for ease of use. Employees working the assembly line cannot be bothered with additional steps or overhead. System interaction needs to be quick and easy.

  -Quality assurance is concerned about managing the end product and tracking overall performance of the product being produced. They would like read-only access to the entire workflow process for monitoring and baselining.

  The favored solution is a user friendly software application that would be hosted onsite. It has extensive ACL functionality, but also has readily available APIs for extensibility. It supports read-only access, kiosk automation, custom fields, and

  data encryption.

  Which of the following departments' request is in contrast to the favored solution?

  A. Manufacturing
  B. Legal
  C. Sales
  D. Quality assurance
  E. Human resources
  E. Human resources

• Question 309:

  Some mobile devices are jail-broken by connecting via USB cable and then exploiting software vulnerabilities to get kernel-level access.

  Which of the following attack types represents this scenario? (Select TWO).

  A. Session management attack
  B. Protocol fuzzing
  C. Root-kit compromise
  D. Physical attack
  E. Privilege escalation
  F. Man-in-the-middle
  D. Physical attack
  E. Privilege escalation

• Question 310:

  A security consultant is investigating acts of corporate espionage within an organization. Each time the organization releases confidential information to high- ranking engineers, the information is soon leaked to competing companies. Which of the following techniques should the consultant use to discover the source of the information leaks?

  A. Digital watermarking
  B. Steganography
  C. Enforce non-disclosure agreements
  D. Digital rights management
  A. Digital watermarking