CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 241:

  An administrator is trying to categorize the security impact of a database server in the case of a security event. There are three databases on the server.

  Current Financial Data = High level of damage if data is disclosed. Moderate damage if the system goes offline

  Archived Financial Data = No need for the database to be online. Low damage for integrity loss

  Public Website Data = Low damage if the site goes down. Moderate damage if the data is corrupted

  Given these security categorizations of each database, which of the following is the aggregate security categorization of the database server?

  A. Database server = {(Confidentiality HIGH),(Integrity High),(Availability High)}

  B. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)}

  C. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Low)}

  D. Database server = {(Confidentiality Moderate),(Integrity Moderate),(Availability Moderate)}

  Correct Answer: B

• Question 242:

  The Chief Information Security Officer (CISO) at a company knows that many users store business documents on public cloud-based storage; and realizes this is a risk to the company. In response, the CISO implements a mandatory training course in which all employees are instructed on the proper use of cloud-based storage. Which of the following risk strategies did the CISO implement?

  A. Avoid

  B. Accept

  C. Mitigate

  D. Transfer

  Correct Answer: C

• Question 243:

  A security manager has received the following email from the Chief Financial Officer (CFO):

  "While I am concerned about the security of the proprietary financial data in our ERP application, we have had a lot of turnover in the accounting group and I am having a difficult time meeting our monthly performance targets. As things currently stand, we do not allow employees to work from home but this is something I am willing to allow so we can get back on track. What should we do first to securely enable this capability for my group?"

  Based on the information provided, which of the following would be the MOST appropriate response to the CFO?

  A. Remote access to the ERP tool introduces additional security vulnerabilities and should not be allowed.

  B. Allow VNC access to corporate desktops from personal computers for the users working from home.

  C. Allow terminal services access from personal computers after the CFO provides a list of the users working from home.

  D. Work with the executive management team to revise policies before allowing any remote access.

  Correct Answer: D

• Question 244:

  A small retail company recently deployed a new point of sale (POS) system to all 67 stores. The core of the POS is an extranet site, accessible only from retail stores and the corporate office over a split-tunnel VPN. An additional split-tunnel VPN provides bi-directional connectivity back to the main office, which provides voice connectivity for store VoIP phones. Each store offers guest wireless functionality, as well as employee wireless. Only the staff wireless network has access to the POS VPN. Recently, stores are reporting poor response times when accessing the POS application from store computers as well as degraded voice quality when making phone calls. Upon investigation, it is determined that three store PCs are hosting malware, which is generating excessive network traffic. After malware removal, the information security department is asked to review the configuration and suggest changes to prevent this from happening again. Which of the following denotes the BEST way to mitigate future malware risk?

  A. Deploy new perimeter firewalls at all stores with UTM functionality.

  B. Change antivirus vendors at the store and the corporate office.

  C. Move to a VDI solution that runs offsite from the same data center that hosts the new POS solution.

  D. Deploy a proxy server with content filtering at the corporate office and route all traffic through it.

  Correct Answer: A

• Question 245:

  The IT manager is evaluating IPS products to determine which would be most effective at stopping network traffic that contains anomalous content on networks that carry very specific types of traffic. Based on the IT manager's requirements, which of the following types of IPS products would be BEST suited for use in this situation?

  A. Signature-based

  B. Rate-based

  C. Anomaly-based

  D. Host-based

  Correct Answer: A

• Question 246:

  A large organization that builds and configures every data center against distinct requirements loses efficiency, which results in slow response time to resolve issues. However, total uniformity presents other problems. Which of the following presents the GREATEST risk when consolidating to a single vendor or design solution?

  A. Competitors gain an advantage by increasing their service offerings.

  B. Vendor lock in may prevent negotiation of lower rates or prices.

  C. Design constraints violate the principle of open design.

  D. Lack of diversity increases the impact of specific events or attacks.

  Correct Answer: D

• Question 247:

  A Chief Information Security Officer (CISO) is approached by a business unit manager who heard a report on the radio this morning about an employee at a competing firm who shipped a VPN token overseas so a fake employee could log into the corporate VPN. The CISO asks what can be done to mitigate the risk of such an incident occurring within the organization. Which of the following is the MOST cost effective way to mitigate such a risk?

  A. Require hardware tokens to be replaced on a yearly basis.

  B. Implement a biometric factor into the token response process.

  C. Force passwords to be changed every 90 days.

  D. Use PKI certificates as part of the VPN authentication process.

  Correct Answer: B

• Question 248:

  News outlets are beginning to report on a number of retail establishments that are experiencing payment card data breaches. The data exfiltration is enabled by malware on a compromised computer. After the initial exploit network mapping and fingerprinting occurs in preparation for further exploitation. Which of the following is the MOST effective solution to protect against unrecognized malware infections, reduce detection time, and minimize any damage that might be done?

  A. Remove local admin permissions from all users and change anti-virus to a cloud aware, push technology.

  B. Implement an application whitelist at all levels of the organization.

  C. Deploy a network based heuristic IDS, configure all layer 3 switches to feed data to the IDS for more effective monitoring.

  D. Update router configuration to pass all network traffic through a new proxy server with advanced malware detection.

  Correct Answer: B

• Question 249:

  Two separate companies are in the process of integrating their authentication infrastructure into a unified single sign-on system. Currently, both companies use an AD backend and two factor authentication using TOTP. The system administrators have configured a trust relationship between the authentication backend to ensure proper process flow. How should the employees request access to shared resources before the authentication integration is complete?

  A. They should logon to the system using the username concatenated with the 6-digit code and their original password.

  B. They should logon to the system using the newly assigned global username: first.lastname#### where #### is the second factor code.

  C. They should use the username format: LAN\first.lastname together with their original password and the next 6-digit code displayed when the token button is depressed.

  D. They should use the username format: [email protected], together with a password and their 6-digit code.

  Correct Answer: D

• Question 250:

  A security consultant is investigating acts of corporate espionage within an organization. Each time the organization releases confidential information to high- ranking engineers, the information is soon leaked to competing companies. Which of the following techniques should the consultant use to discover the source of the information leaks?

  A. Digital watermarking

  B. Steganography

  C. Enforce non-disclosure agreements

  D. Digital rights management

  Correct Answer: A