CompTIA CAS-002 Online Practice Questions and Exam Preparation

CompTIA CAS-002 Online Questions & Answers

• Question 241:

  Which of the following activities is commonly deemed "OUT OF SCOPE" when undertaking a penetration test?

  A. Test password complexity of all login fields and input validation of form fields
  B. Reverse engineering any thick client software that has been provided for the test
  C. Undertaking network-based denial of service attacks in production environment
  D. Attempting to perform blind SQL injection and reflected cross-site scripting attacks
  E. Running a vulnerability scanning tool to assess network and host weaknesses
  C. Undertaking network-based denial of service attacks in production environment

• Question 242:

  The security manager of a company has hired an external consultant to conduct a security assessment of the company network. The contract stipulates that the consultant is not allowed to transmit any data on the company network while performing wired and wireless security assessments. Which of the following technical means can the consultant use to determine the manufacturer and likely operating system of the company wireless and wired network devices, as well as the computers connected to the company network?

  A. Social engineering
  B. Protocol analyzer
  C. Port scanner
  D. Grey box testing
  B. Protocol analyzer

• Question 243:

  Two storage administrators are discussing which SAN configurations will offer the MOST confidentiality. Which of the following configurations would the administrators use? (Select TWO).

  A. Deduplication
  B. Zoning
  C. Snapshots
  D. Multipathing
  E. LUN masking
  B. Zoning
  E. LUN masking

• Question 244:

  A company decides to purchase commercially available software packages. This can introduce new security risks to the network. Which of the following is the BEST description of why this is true?

  A. Commercially available software packages are typically well known and widely available. Information concerning vulnerabilities and viable attack patterns are never revealed by the developer to avoid lawsuits.
  B. Commercially available software packages are often widely available. Information concerning vulnerabilities is often kept internal to the company that developed the software.
  C. Commercially available software packages are not widespread and are only available in limited areas. Information concerning vulnerabilities is often ignored by business managers.
  D. Commercially available software packages are well known and widely available. Information concerning vulnerabilities and viable attack patterns are always shared within the IT community.
  B. Commercially available software packages are often widely available. Information concerning vulnerabilities is often kept internal to the company that developed the software.

• Question 245:

  A security administrator is tasked with implementing two-factor authentication for the company VPN. The VPN is currently configured to authenticate VPN users against a backend RADIUS server. New company policies require a second factor of authentication, and the Information Security Officer has selected PKI as the second factor. Which of the following should the security administrator configure and implement on the VPN concentrator to implement the second factor and ensure that no error messages are displayed to the user during the VPN connection? (Select TWO).

  A. The user's certificate private key must be installed on the VPN concentrator.
  B. The CA's certificate private key must be installed on the VPN concentrator.
  C. The user certificate private key must be signed by the CA.
  D. The VPN concentrator's certificate private key must be signed by the CA and installed on the VPN concentrator.
  E. The VPN concentrator's certificate private key must be installed on the VPN concentrator.
  F. The CA's certificate public key must be installed on the VPN concentrator.
  E. The VPN concentrator's certificate private key must be installed on the VPN concentrator.
  F. The CA's certificate public key must be installed on the VPN concentrator.

• Question 246:

  A data breach has occurred at Company A and as a result, the Chief Information Officer (CIO) has resigned. The CIO's laptop, cell phone and PC were all wiped of data per company policy. A month later, prosecutors in litigation with Company A suspect the CIO knew about the data breach long before it was discovered and have issued a subpoena requesting all the CIO's email from the last 12 months. The corporate retention policy recommends keeping data for no longer than 90 days. Which of the following should occur?

  A. Restore the CIO's email from an email server backup and provide the last 90 days from the date of the subpoena request.
  B. Inform the litigators that the CIOs information has been deleted as per corporate policy.
  C. Restore the CIO's email from an email server backup and provide the last 90 days from the date of the CIO resignation.
  D. Restore the CIO's email from an email server backup and provide whatever is available up to the last 12 months from the subpoena date.
  D. Restore the CIO's email from an email server backup and provide whatever is available up to the last 12 months from the subpoena date.

• Question 247:

  Several critical servers are unresponsive after an update was installed. Other computers that have not yet received the same update are operational, but are vulnerable to certain buffer overflow attacks. The security administrator is required to ensure all systems have the latest updates while minimizing any downtime.

  Which of the following is the BEST risk mitigation strategy to use to ensure a system is properly updated and operational?

  A. Distributed patch management system where all systems in production are patched as updates are released.
  B. Central patch management system where all systems in production are patched by automatic updates as they are released.
  C. Central patch management system where all updates are tested in a lab environment after being installed on a live production system.
  D. Distributed patch management system where all updates are tested in a lab environment prior to being installed on a live production system.
  D. Distributed patch management system where all updates are tested in a lab environment prior to being installed on a live production system.

• Question 248:

  A security administrator is redesigning, and implementing a service-oriented architecture to replace an old, in-house software processing system, tied to a corporate sales website. After performing the business process analysis, the administrator decides the services need to operate in a dynamic fashion. The company has also been the victim of data injection attacks in the past and needs to build in mitigation features. Based on these requirements and past vulnerabilities, which of the following needs to be incorporated into the SOA?

  A. Point to point VPNs for all corporate intranet users.
  B. Cryptographic hashes of all data transferred between services.
  C. Service to service authentication for all workflows.
  D. Two-factor authentication and signed code
  C. Service to service authentication for all workflows.

• Question 249:

  The security administrator is reviewing the business continuity plan which consists of virtual infrastructures at corporate headquarters and at the backup site. The administrator is concerned that the VLAN used to perform live migrations of

  virtual machines to the backup site is across the network provider's MPLS network.

  This is a concern due to which of the following?

  A. The hypervisor virtual switches only support Q-in-Q VLANS, not MPLS. This may cause live migrations to the backup site to fail.
  B. VLANs are not compatible with MPLS, which may cause intermittent failures while performing live migrations virtual machines during a disaster.
  C. Passwords are stored unencrypted in memory, which are then transported across the MPLS network.
  D. Transport encryption is being used during the live migration of virtual machines which will impact the performance of the MPLS network.
  C. Passwords are stored unencrypted in memory, which are then transported across the MPLS network.

• Question 250:

  A security administrator is conducting network forensic analysis of a recent defacement of the company's secure web payment server (HTTPS). The server was compromised around the New Year's holiday when all the company employees were off. The company's network diagram is summarized below:

  Internet Gateway Firewall IDS Web SSL Accelerator Web Server Farm Internal Firewall Company Internal Network

  The security administrator discovers that all the local web server logs have been deleted. Additionally, the Internal Firewall logs are intact but show no activity from the internal network to the web server farm during the holiday. Which of the following is true?

  A. The security administrator should review the IDS logs to determine the source of the attack and the attack vector used to compromise the web server.
  B. The security administrator must correlate the external firewall logs with the intrusion detection system logs to determine what specific attack led to the web server compromise.
  C. The security administrator must reconfigure the network and place the IDS between the SSL accelerator and the server farm to be able to determine the cause of future attacks.
  D. The security administrator must correlate logs from all the devices in the network diagram to determine what specific attack led to the web server compromise.
  C. The security administrator must reconfigure the network and place the IDS between the SSL accelerator and the server farm to be able to determine the cause of future attacks.