CompTIA CAS-001 Online Practice Questions and Exam Preparation

CompTIA CAS-001 Online Questions & Answers

• Question 431:

  An administrator implements a new PHP application into an existing website and discovers the newly added PHP pages do not work. The rest of the site also uses PHP and is functioning correctly. The administrator tested the new application

  on their personal workstation thoroughly before uploading to the server and did not run into any errors. Checking the Apache configuration file, the administrator verifies that the new virtual directory is added as listed:

  DocumentRoot "/var/www"

  AllowOveride none

  Order allow, deny

  Allow from all

  Which of the following is MOST likely occurring so that this application does not run properly?

  A. PHP is overriding the Apache security settings.
  B. SELinux is preventing HTTP access to home directories.
  C. PHP has not been restarted since the additions were added.
  D. The directory had an explicit allow statement rather than the implicit deny.
  B. SELinux is preventing HTTP access to home directories.

• Question 432:

  An organization recently upgraded its wireless infrastructure to support WPA2 and requires all clients to use this method. After the upgrade, several critical wireless clients fail to connect because they are only WEP compliant. For the foreseeable future, none of the affected clients have an upgrade path to put them into compliance with the WPA2 requirement.

  Which of the following provides the MOST secure method of integrating the non-compliant clients into the network?

  A. Create a separate SSID and WEP key to support the legacy clients and enable detection of rogue APs.
  B. Create a separate SSID and WEP key on a new network segment and only allow required communication paths.
  C. Create a separate SSID and require the legacy clients to connect to the wireless network using certificate-based 802.1x.
  D. Create a separate SSID and require the use of dynamic WEP keys.
  B. Create a separate SSID and WEP key on a new network segment and only allow required communication paths.

• Question 433:

  A security consultant is called into a small advertising business to recommend which security policies and procedures would be most helpful to the business. The business is comprised of 20 employees, operating off of two shared servers. One server houses employee data and the other houses client data. All machines are on the same local network. Often these employees must work remotely from client sites, but do not access either of the servers remotely.

  Assuming no security policies or procedures are in place right now, which of the following would be the MOST applicable for implementation? (Select TWO).

  A. Password Policy
  B. Data Classification Policy
  C. Wireless Access Procedure
  D. VPN Policy
  E. Database Administrative Procedure
  A. Password Policy
  B. Data Classification Policy

• Question 434:

  Which of the following activities could reduce the security benefits of mandatory vacations?

  A. Have a replacement employee run the same applications as the vacationing employee.
  B. Have a replacement employee perform tasks in a different order from the vacationing employee.
  C. Have a replacement employee perform the job from a different workstation than the vacationing employee.
  D. Have a replacement employee run several daily scripts developed by the vacationing employee.
  D. Have a replacement employee run several daily scripts developed by the vacationing employee.

• Question 435:

  The internal auditor at Company ABC has completed the annual audit of the company's financial system. The audit report indicates that the accounts receivable department has not followed proper record disposal procedures during a COOP/ BCP tabletop exercise involving manual processing of financial transactions.

  Which of the following should be the Information Security Officer's (ISO's) recommendation? (Select TWO).

  A. Wait for the external audit results
  B. Perform another COOP exercise
  C. Implement mandatory training
  D. Destroy the financial transactions
  E. Review company procedures
  C. Implement mandatory training
  E. Review company procedures

• Question 436:

  After connecting to a secure payment server at https://pay.xyz.com, an auditor notices that the SSL certificate was issued to *.xyz.com. The auditor also notices that many of the internal development servers use the same certificate. After installing the certificate on dev1.xyz.com, one of the developers reports misplacing the USB thumb-drive where the SSL certificate was stored.

  Which of the following should the auditor recommend FIRST?

  A. Generate a new public key on both servers.
  B. Replace the SSL certificate on dev1.xyz.com.
  C. Generate a new private key password for both servers.
  D. Replace the SSL certificate on pay.xyz.com.
  D. Replace the SSL certificate on pay.xyz.com.

• Question 437:

  A security manager at Company ABC, needs to perform a risk assessment of a new mobile device which the Chief Information Officer (CIO) wants to immediately deploy to all employees in the company. The product is commercially available, runs a popular mobile operating system, and can connect to IPv6 networks wirelessly. The model the CIO wants to procure also includes the upgraded 160GB solid state hard drive. The producer of the device will not reveal exact numbers but experts estimate that over 73 million of the devices have been sold worldwide.

  Which of the following is the BEST list of factors the security manager should consider while performing a risk assessment?

  A. Ability to remotely wipe the devices, apply security controls remotely, and encrypt the SSD; the track record of the vendor in publicizing and correcting security flaws in their products; predicted costs associated with maintaining, integrating and securing the devices.
  B. Ability to remotely administer the devices, apply security controls remotely, and remove the SSD; the track record of the vendor in securely implementing IPv6 with IPSec; predicted costs associated with securing the devices.
  C. Ability to remotely monitor the devices, remove security controls remotely, and decrypt the SSD; the track record of the vendor in publicizing and preventing security flaws in their products; predicted costs associated with maintaining, destroying and tracking the devices.
  D. Ability to remotely sanitize the devices, apply security controls locally, encrypt the SSD; the track record of the vendor in adapting the open source operating system to their platform; predicted costs associated with inventory management, maintaining, integrating and securing the devices.
  A. Ability to remotely wipe the devices, apply security controls remotely, and encrypt the SSD; the track record of the vendor in publicizing and correcting security flaws in their products; predicted costs associated with maintaining, integrating and securing the devices.

• Question 438:

  After a system update causes significant downtime, the Chief Information Security Officer (CISO) asks the IT manager who was responsible for the update. The IT manager responds that it is impossible to know who did the update since five different people have administrative access.

  How should the IT manager increase accountability to prevent this situation from reoccurring? (Select TWO).

  A. Implement an enforceable change management system.
  B. Implement a software development life cycle policy.
  C. Enable user level auditing on all servers.
  D. Implement a federated identity management system.
  E. Configure automatic updates on all servers.
  A. Implement an enforceable change management system.
  C. Enable user level auditing on all servers.

• Question 439:

  An administrator is assessing the potential risk impact on an accounting system and categorizes it as follows:

  Administrative Files = {(Confidentiality, Moderate), (Integrity, Moderate), (Availability, Low)} Vendor Information = {(Confidentiality, Moderate), (Integrity, Low), (Availability, Low)} Payroll Data = {(Confidentiality, High), (Integrity, Moderate),

  (Availability, Low)}

  Which of the following is the aggregate risk impact on the accounting system?

  A. {(Confidentiality, Moderate), (Integrity, Moderate), (Availability, Moderate)}
  B. {(Confidentiality, High), (Integrity, Low), (Availability, Low)}
  C. {(Confidentiality, High), (Integrity, Moderate), (Availability, Low)}
  D. {(Confidentiality, Moderate), (Integrity, Moderate), (Availability, Low)}
  C. {(Confidentiality, High), (Integrity, Moderate), (Availability, Low)}

• Question 440:

  An architect has been engaged to write the security viewpoint of a new initiative.

  Which of the following BEST describes a repeatable process that can be used for establishing the security architecture?

  A. Inspect a previous architectural document. Based on the historical decisions made, consult the architectural control and pattern library within the organization and select the controls that appear to best fit this new architectural need.
  B. Implement controls based on the system needs. Perform a risk analysis of the system. For any remaining risks, perform continuous monitoring.
  C. Classify information types used within the system into levels of confidentiality, integrity, and availability. Determine minimum required security controls. Conduct a risk analysis. Decide on which security controls to implement.
  D. Perform a risk analysis of the system. Avoid extreme risks. Mitigate high risks. Transfer medium risks and accept low risks. Perform continuous monitoring to ensure that the system remains at an adequate security posture.
  C. Classify information types used within the system into levels of confidentiality, integrity, and availability. Determine minimum required security controls. Conduct a risk analysis. Decide on which security controls to implement.