CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 401:

  An administrator is implementing a new network-based storage device. In selecting a storage protocol, the administrator would like the data in transit's integrity to be the most important concern. Which of the following protocols meets these needs by implementing either AES-CMAC or HMAC-SHA256 to sign data?

  A. SMB

  B. NFS

  C. FCoE

  D. iSCSI

  Correct Answer: A

• Question 402:

  A project manager working for a large city government is required to plan and build a WAN, which will be required to host official business and public access. It is also anticipated that the city's emergency and first response communication systems will be required to operate across the same network. The project manager has experience with enterprise IT projects, but feels this project has an increased complexity as a result of the mixed business / public use and the critical infrastructure it will provide. Which of the following should the project manager release to the public, academia, and private industry to ensure the city provides due care in considering all project factors prior to building its new WAN?

  A. NDA

  B. RFI

  C. RFP

  D. RFQ

  Correct Answer: B

• Question 403:

  It has come to the IT administrator's attention that the "post your comment" field on the company blog page has been exploited, resulting in cross-site scripting attacks against customers reading the blog. Which of the following would be the MOST effective at preventing the "post your comment" field from being exploited?

  A. Update the blog page to HTTPS

  B. Filter metacharacters

  C. Install HIDS on the server

  D. Patch the web application

  E. Perform client side input validation

  Correct Answer: B

• Question 404:

  Which of the following represents important technical controls for securing a SAN storage infrastructure? (Select TWO).

  A. Synchronous copy of data

  B. RAID configuration

  C. Data de-duplication

  D. Storage pool space allocation

  E. Port scanning

  F. LUN masking/mapping

  G. Port mapping

  Correct Answer: FG

• Question 405:

  A company decides to purchase commercially available software packages. This can introduce new security risks to the network. Which of the following is the BEST description of why this is true?

  A. Commercially available software packages are typically well known and widely available. Information concerning vulnerabilities and viable attack patterns are never revealed by the developer to avoid lawsuits.

  B. Commercially available software packages are often widely available. Information concerning vulnerabilities is often kept internal to the company that developed the software.

  C. Commercially available software packages are not widespread and are only available in limited areas. Information concerning vulnerabilities is often ignored by business managers.

  D. Commercially available software packages are well known and widely available. Information concerning vulnerabilities and viable attack patterns are always shared within the IT community.

  Correct Answer: B

• Question 406:

  ODBC access to a database on a network-connected host is required. The host does not have a security mechanism to authenticate the incoming ODBC connection, and the application requires that the connection have read/write permissions. In order to further secure the data, a nonstandard configuration would need to be implemented. The information in the database is not sensitive, but was not readily accessible prior to the implementation of the ODBC connection. Which of the following actions should be taken by the security analyst?

  A. Accept the risk in order to keep the system within the company's standard security configuration.

  B. Explain the risks to the data owner and aid in the decision to accept the risk versus choosing a nonstandard solution.

  C. Secure the data despite the need to use a security control or solution that is not within company standards.

  D. Do not allow the connection to be made to avoid unnecessary risk and avoid deviating from the standard security configuration.

  Correct Answer: B

• Question 407:

  A penetration tester is inspecting traffic on a new mobile banking application and sends the following web request:

  POST http://www.example.com/resources/NewBankAccount HTTP/1.1

  Content-type: application/json

  {

  "account":

  [

  { "creditAccount":"Credit Card Rewards account"} { "salesLeadRef":"www.example.com/badcontent/ exploitme.exe"}

  ],

  "customer":

  [

  { "name":"Joe Citizen"} { "custRef":"3153151"}

  ]

  }

  The banking website responds with:

  HTTP/1.1 200 OK

  {

  "newAccountDetails":

  [

  { "cardNumber":"1234123412341234"} { "cardExpiry":"2020-12-31"}

  { "cardCVV":"909"}

  ],

  "marketingCookieTracker":"JSESSIONID=000000001"

  "returnCode":"Account added successfully"

  }

  Which of the following are security weaknesses in this example? (Select TWO).

  A. Missing input validation on some fields

  B. Vulnerable to SQL injection

  C. Sensitive details communicated in clear-text

  D. Vulnerable to XSS

  E. Vulnerable to malware file uploads

  F. JSON/REST is not as secure as XML

  Correct Answer: AC

• Question 408:

  A small company is developing a new Internet-facing web application. The security requirements are:

  1.

  Users of the web application must be uniquely identified and authenticated.

  2.

  Users of the web application will not be added to the company's directory services.

  3.

  Passwords must not be stored in the code. Which of the following meets these requirements?

  A. Use OpenID and allow a third party to authenticate users.

  B. Use TLS with a shared client certificate for all users.

  C. Use SAML with federated directory services.

  D. Use Kerberos and browsers that support SAML.

  Correct Answer: A

• Question 409:

  A senior network security engineer has been tasked to decrease the attack surface of the corporate network. Which of the following actions would protect the external network interfaces from external attackers performing network scanning?

  A. Remove contact details from the domain name registrar to prevent social engineering attacks.

  B. Test external interfaces to see how they function when they process fragmented IP packets.

  C. Enable a honeynet to capture and facilitate future analysis of malicious attack vectors.

  D. Filter all internal ICMP message traffic, forcing attackers to use full-blown TCP port scans against external network interfaces.

  Correct Answer: B

• Question 410:

  An administrator believes that the web servers are being flooded with excessive traffic from time to time. The administrator suspects that these traffic floods correspond to when a competitor makes major announcements. Which of the following should the administrator do to prove this theory?

  A. Implement data analytics to try and correlate the occurrence times.

  B. Implement a honey pot to capture traffic during the next attack.

  C. Configure the servers for high availability to handle the additional bandwidth.

  D. Log all traffic coming from the competitor's public IP addresses.

  Correct Answer: A