CompTIA CAS-001 Online Practice Questions and Exam Preparation

CompTIA CAS-001 Online Questions & Answers

• Question 491:

  An organization has just released a new mobile application for its customers. The application has an inbuilt browser and native application to render content from existing websites and the organization's new web services gateway. All rendering of the content is performed on the mobile application. The application requires SSO between the application, the web services gateway and legacy UI.

  Which of the following controls MUST be implemented to securely enable SSO?

  A. A registration process is implemented to have a random number stored on the client.
  B. The identity is passed between the applications as a HTTP header over REST.
  C. Local storage of the authenticated token on the mobile application is secured.
  D. Attestation of the XACML payload to ensure that the client is authorized.
  C. Local storage of the authenticated token on the mobile application is secured.

• Question 492:

  The VoIP administrator starts receiving reports that users are having problems placing phone calls. The VoIP administrator cannot determine the issue, and asks the security administrator for help. The security administrator reviews the switch interfaces and does not see an excessive amount of network traffic on the voice network. Using a protocol analyzer, the security administrator does see an excessive number of SIP INVITE packets destined for the SIP proxy.

  Based on the information given, which of the following types of attacks is underway and how can it be remediated?

  A. Man in the middle attack; install an IPS in front of SIP proxy.
  B. Man in the middle attack; use 802.1x to secure voice VLAN.
  C. Denial of Service; switch to more secure H.323 protocol.
  D. Denial of Service; use rate limiting to limit traffic.
  D. Denial of Service; use rate limiting to limit traffic.

• Question 493:

  A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors.

  Which of the following controls has likely been implemented by the developers?

  A. SSL certificate revocation
  B. SSL certificate pinning
  C. Mobile device root-kit detection
  D. Extended Validation certificates
  B. SSL certificate pinning