CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 391:

  A security administrator was recently hired in a start-up company to represent the interest of security and to assist the network team in improving security in the company. The programmers are not on good terms with the security team and do not want to be distracted with security issues while they are working on a major project. Which of the following is the BEST time to make them address security issues in the project?

  A. In the middle of the project

  B. At the end of the project

  C. At the inception of the project

  D. At the time they request

  Correct Answer: C

• Question 392:

  A company has a difficult time communicating between the security engineers, application developers, and sales staff. The sales staff tends to overpromise the application deliverables. The security engineers and application developers are falling behind schedule. Which of the following should be done to solve this?

  A. Allow the sales staff to shadow the developers and engineers to see how their sales impact the deliverables.

  B. Allow the security engineering team to do application development so they understand why it takes so long.

  C. Allow the application developers to attend a sales conference so they understand how business is done.

  D. Allow the sales staff to learn application programming and security engineering so they understand the whole lifecycle.

  Correct Answer: A

• Question 393:

  A security architect has been engaged during the implementation stage of the SDLC to review a new HR software installation for security gaps. With the project under a tight schedule to meet market commitments on project delivery, which of the following security activities should be prioritized by the security architect? (Select TWO).

  A. Perform penetration testing over the HR solution to identify technical vulnerabilities

  B. Perform a security risk assessment with recommended solutions to close off high-rated risks

  C. Secure code review of the HR solution to identify security gaps that could be exploited

  D. Perform access control testing to ensure that privileges have been configured correctly

  E. Determine if the information security standards have been complied with by the project

  Correct Answer: BE

• Question 394:

  The following has been discovered in an internally developed application:

  Error - Memory allocated but not freed:

  char *myBuffer = malloc(BUFFER_SIZE);

  if (myBuffer != NULL) {

  *myBuffer = STRING_WELCOME_MESSAGE;

  printf("Welcome to: %s\n", myBuffer);

  }

  exit(0);

  Which of the following security assessment methods are likely to reveal this security weakness? (Select TWO).

  A. Static code analysis

  B. Memory dumping

  C. Manual code review

  D. Application sandboxing

  E. Penetration testing

  F. Black box testing

  Correct Answer: AC

• Question 395:

  An information security assessor for an organization finished an assessment that identified critical issues with the human resource new employee management software application. The assessor submitted the report to senior management but nothing has happened. Which of the following would be a logical next step?

  A. Meet the two key VPs and request a signature on the original assessment.

  B. Include specific case studies from other organizations in an updated report.

  C. Schedule a meeting with key human resource application stakeholders.

  D. Craft an RFP to begin finding a new human resource application.

  Correct Answer: C

• Question 396:

  An internal development team has migrated away from Waterfall development to use Agile development. Overall, this has been viewed as a successful initiative by the stakeholders as it has improved time-to- market. However, some staff within the security team have contended that Agile development is not secure. Which of the following is the MOST accurate statement?

  A. Agile and Waterfall approaches have the same effective level of security posture. They both need similar amounts of security effort at the same phases of development.

  B. Agile development is fundamentally less secure than Waterfall due to the lack of formal up-front design and inability to perform security reviews.

  C. Agile development is more secure than Waterfall as it is a more modern methodology which has the advantage of having been able to incorporate security best practices of recent years.

  D. Agile development has different phases and timings compared to Waterfall. Security activities need to be adapted and performed within relevant Agile phases.

  Correct Answer: D

• Question 397:

  A security administrator has been asked to select a cryptographic algorithm to meet the criteria of a new application. The application utilizes streaming video that can be viewed both on computers and mobile devices. The application designers have asked that the algorithm support the transport encryption with the lowest possible performance overhead. Which of the following recommendations would BEST meet the needs of the application designers? (Select TWO).

  A. Use AES in Electronic Codebook mode

  B. Use RC4 in Cipher Block Chaining mode

  C. Use RC4 with Fixed IV generation

  D. Use AES with cipher text padding

  E. Use RC4 with a nonce generated IV

  F. Use AES in Counter mode

  Correct Answer: EF

• Question 398:

  A firm's Chief Executive Officer (CEO) is concerned that IT staff lacks the knowledge to identify complex vulnerabilities that may exist in a payment system being internally developed. The payment system being developed will be sold to a number of organizations and is in direct competition with another leading product. The CEO highlighted that code base confidentiality is of critical importance to allow the company to exceed the competition in terms of the product's reliability, stability, and performance. Which of the following would provide the MOST thorough testing and satisfy the CEO's requirements?

  A. Sign a MOU with a marketing firm to preserve the company reputation and use in-house resources for random testing.

  B. Sign a BPA with a small software consulting firm and use the firm to perform Black box testing and address all findings.

  C. Sign a NDA with a large security consulting firm and use the firm to perform Grey box testing and address all findings.

  D. Use the most qualified and senior developers on the project to perform a variety of White box testing and code reviews.

  Correct Answer: C

• Question 399:

  A security manager looked at various logs while investigating a recent security breach in the data center from an external source. Each log below was collected from various security devices compiled from a report through the company's

  security information and event management server.

  Logs:

  Log 1:

  Feb 5 23:55:37.743: %SEC-6-IPACCESSLOGS: list 10 denied 10.2.5.81 3 packets

  Log 2:

  HTTP://www.company.com/index.php?user=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

  Log 3:

  Security Error Alert

  Event ID 50: The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client

  Log 4:

  Encoder oe = new OracleEncoder ();

  String query = "Select user_id FROM user_data WHERE user_name = ` "

  + oe.encode ( req.getParameter("userID") ) + " ` and user_password = ` "

  + oe.encode ( req.getParameter("pwd") ) +" ` ";

  Vulnerabilities

  Buffer overflow

  SQL injection

  ACL

  XSS

  Which of the following logs and vulnerabilities would MOST likely be related to the security breach? (Select TWO).

  A. Log 1

  B. Log 2

  C. Log 3

  D. Log 4

  E. Buffer overflow

  F. ACL

  G. XSS

  H. SQL injection

  Correct Answer: BE

• Question 400:

  Ann is testing the robustness of a marketing website through an intercepting proxy. She has intercepted the following HTTP request: POST /login.aspx HTTP/1.1 Host: comptia.org Content-type: text/html txtUsername=annandtxtPassword=annandalreadyLoggedIn=falseandsubmit=true Which of the following should Ann perform to test whether the website is susceptible to a simple authentication bypass?

  A. Remove all of the post data and change the request to /login.aspx from POST to GET

  B. Attempt to brute force all usernames and passwords using a password cracker

  C. Remove the txtPassword post data and change alreadyLoggedIn from false to true

  D. Remove the txtUsername and txtPassword post data and toggle submit from true to false

  Correct Answer: C