CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 271:

  An extensible commercial software system was upgraded to the next minor release version to patch a security vulnerability. After the upgrade, an unauthorized intrusion into the system was detected. The software vendor is called in to

  troubleshoot the issue and reports that all core components were updated properly.

  Which of the following has been overlooked in securing the system? (Select TWO).

  A. The company's IDS signatures were not updated.

  B. The company's custom code was not patched.

  C. The patch caused the system to revert to http.

  D. The software patch was not cryptographically signed.

  E. The wrong version of the patch was used.

  F. Third-party plug-ins were not patched.

  Correct Answer: BF

• Question 272:

  A security manager is concerned about performance and patch management, and, as a result, wants to implement a virtualization strategy to avoid potential future OS vulnerabilities in the host system. The IT manager wants a strategy that would provide the hypervisor with direct communications with the underlying physical hardware allowing the hardware resources to be paravirtualized and delivered to the guest machines. Which of the following recommendations from the server administrator BEST meets the IT and security managers' requirements? (Select TWO).

  A. Nested virtualized hypervisors

  B. Type 1 hypervisor

  C. Hosted hypervisor with a three layer software stack

  D. Type 2 hypervisor

  E. Bare metal hypervisor with a software stack of two layers

  Correct Answer: BE

• Question 273:

  A security engineer at a software development company has identified several vulnerabilities in a product late in the development cycle. This causes a huge delay for the release of the product. Which of the following should the administrator do to prevent these issues from occurring in the future?

  A. Recommend switching to an SDLC methodology and perform security testing during each maintenance iteration

  B. Recommend switching to a spiral software development model and perform security testing during the requirements gathering

  C. Recommend switching to a waterfall development methodology and perform security testing during the testing phase

  D. Recommend switching to an agile development methodology and perform security testing during iterations

  Correct Answer: D

• Question 274:

  An asset manager is struggling with the best way to reduce the time required to perform asset location activities in a large warehouse. A project manager indicated that RFID might be a valid solution if the asset manager's requirements were supported by current RFID capabilities. Which of the following requirements would be MOST difficult for the asset manager to implement?

  A. The ability to encrypt RFID data in transmission

  B. The ability to integrate environmental sensors into the RFID tag

  C. The ability to track assets in real time as they move throughout the facility

  D. The ability to assign RFID tags a unique identifier

  Correct Answer: A

• Question 275:

  A high-tech company dealing with sensitive data seized the mobile device of an employee suspected of leaking company secrets to a competitive organization. Which of the following is the BEST order for mobile phone evidence extraction?

  A. Device isolation, evidence intake, device identification, data processing, verification of data accuracy, documentation, reporting, presentation and archival.

  B. Evidence intake, device identification, preparation to identify the necessary tools, device isolation, data processing, verification of data accuracy, documentation, reporting, presentation and archival.

  C. Evidence log, device isolation ,device identification, preparation to identify the necessary tools, data processing, verification of data accuracy, presentation and archival.

  D. Device identification, evidence log, preparation to identify the necessary tools, data processing, verification of data accuracy, device isolation, documentation, reporting, presentation and archival.

  Correct Answer: B

• Question 276:

  A security administrator notices a recent increase in workstations becoming compromised by malware. Often, the malware is delivered via drive-by downloads, from malware hosting websites, and is not being detected by the corporate antivirus. Which of the following solutions would provide the BEST protection for the company?

  A. Increase the frequency of antivirus downloads and install updates to all workstations.

  B. Deploy a cloud-based content filter and enable the appropriate category to prevent further infections.

  C. Deploy a NIPS to inspect and block all web traffic which may contain malware and exploits.

  D. Deploy a web based gateway antivirus server to intercept viruses before they enter the network.

  Correct Answer: B

• Question 277:

  The risk manager has requested a security solution that is centrally managed, can easily be updated, and protects end users' workstations from both known and unknown malicious attacks when connected to either the office or home network. Which of the following would BEST meet this requirement?

  A. HIPS

  B. UTM

  C. Antivirus

  D. NIPS

  E. DLP

  Correct Answer: A

• Question 278:

  An IT administrator has been tasked by the Chief Executive Officer with implementing security using a single device based on the following requirements:

  1.

  Selective sandboxing of suspicious code to determine malicious intent.

  2.

  VoIP handling for SIP and H.323 connections.

  3.

  Block potentially unwanted applications.

  Which of the following devices would BEST meet all of these requirements?

  A. UTM

  B. HIDS

  C. NIDS

  D. WAF

  E. HSM

  Correct Answer: A

• Question 279:

  A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors. Which of the following controls has likely been implemented by the developers?

  A. SSL certificate revocation

  B. SSL certificate pinning

  C. Mobile device root-kit detection

  D. Extended Validation certificates

  Correct Answer: B

• Question 280:

  A security engineer at a bank has detected a Zeus variant, which relies on covert communication channels to receive new instructions and updates from the malware developers. As a result, NIPS and AV systems did not detect the configuration files received by staff in emails that appeared as normal files. Which of the following BEST describes the technique used by the malware developers?

  A. Perfect forward secrecy

  B. Stenography

  C. Diffusion

  D. Confusion

  E. Transport encryption

  Correct Answer: B