CompTIA CAS-002 Online Practice Questions and Exam Preparation

CompTIA CAS-002 Online Questions & Answers

• Question 271:

  A financial institution wants to reduce the costs associated with managing and troubleshooting employees' desktops and applications, while keeping employees from copying data onto external storage. The Chief Information Officer (CIO) has asked the security team to evaluate four solutions submitted by the change management group. Which of the following BEST accomplishes this task?

  A. Implement desktop virtualization and encrypt all sensitive data at rest and in transit.
  B. Implement server virtualization and move the application from the desktop to the server.
  C. Implement VDI and disable hardware and storage mapping from the thin client.
  D. Move the critical applications to a private cloud and disable VPN and tunneling.
  C. Implement VDI and disable hardware and storage mapping from the thin client.

• Question 272:

  A company has received the contract to begin developing a new suite of software tools to replace an aging collaboration solution. The original collaboration solution has been in place for nine years, contains over a million lines of code, and took over two years to develop originally. The SDLC has broken the primary delivery stages into eight different deliverables, with each section requiring an in-depth risk analysis before moving on to the next phase. Which of the following software development methods is MOST applicable?

  A. Spiral model
  B. Incremental model
  C. Waterfall model
  D. Agile model
  D. Agile model

• Question 273:

  Which of the following activities could reduce the security benefits of mandatory vacations?

  A. Have a replacement employee run the same applications as the vacationing employee.
  B. Have a replacement employee perform tasks in a different order from the vacationing employee.
  C. Have a replacement employee perform the job from a different workstation than the vacationing employee.
  D. Have a replacement employee run several daily scripts developed by the vacationing employee.
  D. Have a replacement employee run several daily scripts developed by the vacationing employee.

• Question 274:

  A security engineer is responsible for monitoring company applications for known vulnerabilities. Which of the following is a way to stay current on exploits and information security news?

  A. Update company policies and procedures
  B. Subscribe to security mailing lists
  C. Implement security awareness training
  D. Ensure that the organization vulnerability management plan is up-to-date
  B. Subscribe to security mailing lists

• Question 275:

  A company is in the process of outsourcing its customer relationship management system to a cloud provider. It will host the entire organization's customer database. The database will be accessed by both the company's users and its customers. The procurement department has asked what security activities must be performed for the deal to proceed. Which of the following are the MOST appropriate security activities to be performed as part of due diligence? (Select TWO).

  A. Physical penetration test of the datacenter to ensure there are appropriate controls.
  B. Penetration testing of the solution to ensure that the customer data is well protected.
  C. Security clauses are implemented into the contract such as the right to audit.
  D. Review of the organizations security policies, procedures and relevant hosting certifications.
  E. Code review of the solution to ensure that there are no back doors located in the software.
  C. Security clauses are implemented into the contract such as the right to audit.
  D. Review of the organizations security policies, procedures and relevant hosting certifications.

• Question 276:

  A security administrator is investigating the compromise of a software distribution website. Forensic analysis shows that several popular files are infected with malicious code. However, comparing a hash of the infected files with the original, non-infected files which were restored from backup, shows that the hash is the same. Which of the following explains this?

  A. The infected files were using obfuscation techniques to evade detection by antivirus software.
  B. The infected files were specially crafted to exploit a collision in the hash function.
  C. The infected files were using heuristic techniques to evade detection by antivirus software.
  D. The infected files were specially crafted to exploit diffusion in the hash function.
  B. The infected files were specially crafted to exploit a collision in the hash function.

• Question 277:

  Which of the following authentication types is used primarily to authenticate users through the use of tickets?

  A. LDAP
  B. RADIUS
  C. TACACS+
  D. Kerberos
  D. Kerberos

• Question 278:

  An administrator is reviewing a recent security audit and determines that two users in finance also have access to the human resource data. One of those users fills in for any HR employees on vacation, the other user only works in finance. Which of the following policies is being violated by the finance user according to the audit results?

  A. Mandatory vacation
  B. Non-disclosure
  C. Job rotation
  D. Least privilege
  D. Least privilege

• Question 279:

  A company has a single subnet in a small office. The administrator wants to limit non-web related traffic to the corporate intranet server as well as prevent abnormal HTTP requests and HTTP protocol anomalies from causing problems with the web server. Which of the following is the MOST likely solution?

  A. Application firewall and NIPS
  B. Edge firewall and HIDS
  C. ACLs and anti-virus
  D. Host firewall and WAF
  D. Host firewall and WAF

• Question 280:

  After a system update causes significant downtime, the Chief Information Security Officer (CISO) asks the IT manager who was responsible for the update. The IT manager responds that it is impossible to know who did the update since five different people have administrative access. How should the IT manager increase accountability to prevent this situation from reoccurring? (Select TWO).

  A. Implement an enforceable change management system.
  B. Implement a software development life cycle policy.
  C. Enable user level auditing on all servers.
  D. Implement a federated identity management system.
  E. Configure automatic updates on all servers.
  A. Implement an enforceable change management system.
  C. Enable user level auditing on all servers.