CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 431:

  The security administrator finds unauthorized tables and records, which were not present before, on a Linux database server. The database server communicates only with one web server, which connects to the database server via an

  account with SELECT only privileges.

  Web server logs show the following:

  90.76.165.40 -- [08/Mar/2014:10:54:04] "GET calendar.php?create%20table%20hidden HTTP/1.1" 200 90.76.165.40 -- [08/Mar/2014:10:54:05] "GET ../../../root/.bash_history HTTP/1.1" 200 90.76.165.40 ?- [08/ Mar/2014:10:54:04] "GET index.php? user<;scrip>;Creat<;/scrip>; HTTP/1.1" 200 5724

  The security administrator also inspects the following file system locations on the database server using the command `ls -al /root'

  drwxrwxrwx 11 root root 4096 Sep 28 22:45 . drwxr-xr-x 25 root root 4096 Mar 8 09:30 ..

  -rws------ 25 root root 4096 Mar 8 09:30 .bash_history

  -rw------- 25 root root 4096 Mar 8 09:30 .bash_history

  -rw------- 25 root root 4096 Mar 8 09:30 .profile

  -rw------- 25 root root 4096 Mar 8 09:30 .ssh

  Which of the following attacks was used to compromise the database server and what can the security administrator implement to detect such attacks in the future? (Select TWO).

  A. Privilege escalation

  B. Brute force attack

  C. SQL injection

  D. Cross-site scripting

  E. Using input validation, ensure the following characters are sanitized: <>

  F. Update crontab with: find / \( -perm -4000 \) ype f rint0 | xargs -0 ls | email.sh

  G. Implement the following PHP directive: $clean_user_input = addslashes($user_input)

  H. Set an account lockout policy

  Correct Answer: AF

• Question 432:

  A company sales manager received a memo from the company's financial department which stated that the company would not be putting its software products through the same security testing as previous years to reduce the research and development cost by 20 percent for the upcoming year. The memo also stated that the marketing material and service level agreement for each product would remain unchanged. The sales manager has reviewed the sales goals for the upcoming year and identified an increased target across the software products that will be affected by the financial department's change. All software products will continue to go through new development in the coming year. Which of the following should the sales manager do to ensure the company stays out of trouble?

  A. Discuss the issue with the software product's user groups

  B. Consult the company's legal department on practices and law

  C. Contact senior finance management and provide background information

  D. Seek industry outreach for software practices and law

  Correct Answer: B

• Question 433:

  A government agency considers confidentiality to be of utmost importance and availability issues to be of least importance. Knowing this, which of the following correctly orders various vulnerabilities in the order of MOST important to LEAST important?

  A. Insecure direct object references, CSRF, Smurf

  B. Privilege escalation, Application DoS, Buffer overflow

  C. SQL injection, Resource exhaustion, Privilege escalation

  D. CSRF, Fault injection, Memory leaks

  Correct Answer: A

• Question 434:

  Which of the following provides the BEST risk calculation methodology?

  A. Annual Loss Expectancy (ALE) x Value of Asset

  B. Potential Loss x Event Probability x Control Failure Probability

  C. Impact x Threat x Vulnerability

  D. Risk Likelihood x Annual Loss Expectancy (ALE)

  Correct Answer: B

• Question 435:

  Ann, a systems engineer, is working to identify an unknown node on the corporate network. To begin her investigative work, she runs the following nmap command string:

  user@hostname:~$ sudo nmap -O 192.168.1.54

  Based on the output, nmap is unable to identify the OS running on the node, but the following ports are open on the device:

  TCP/22

  TCP/111

  TCP/512-514

  TCP/2049

  TCP/32778

  Based on this information, which of the following operating systems is MOST likely running on the unknown node?

  A. Linux

  B. Windows

  C. Solaris

  D. OSX

  Correct Answer: C

• Question 436:

  The senior security administrator wants to redesign the company DMZ to minimize the risks associated with both external and internal threats. The DMZ design must support security in depth, change management and configuration processes, and support incident reconstruction. Which of the following designs BEST supports the given requirements?

  A. A dual firewall DMZ with remote logging where each firewall is managed by a separate administrator.

  B. A single firewall DMZ where each firewall interface is managed by a separate administrator and logging to the cloud.

  C. A SaaS based firewall which logs to the company's local storage via SSL, and is managed by the change control team.

  D. A virtualized firewall, where each virtual instance is managed by a separate administrator and logging to the same hardware.

  Correct Answer: A

• Question 437:

  A security officer is leading a lessons learned meeting. Which of the following should be components of that meeting? (Select TWO).

  A. Demonstration of IPS system

  B. Review vendor selection process

  C. Calculate the ALE for the event

  D. Discussion of event timeline

  E. Assigning of follow up items

  Correct Answer: DE

• Question 438:

  A security manager for a service provider has approved two vendors for connections to the service provider backbone. One vendor will be providing authentication services for its payment card service, and the other vendor will be providing maintenance to the service provider infrastructure sites. Which of the following business agreements is MOST relevant to the vendors and service provider's relationship?

  A. Memorandum of Agreement

  B. Interconnection Security Agreement

  C. Non-Disclosure Agreement

  D. Operating Level Agreement

  Correct Answer: B

• Question 439:

  A small company's Chief Executive Officer (CEO) has asked its Chief Security Officer (CSO) to improve the company's security posture quickly with regard to targeted attacks. Which of the following should the CSO conduct FIRST?

  A. Survey threat feeds from services inside the same industry.

  B. Purchase multiple threat feeds to ensure diversity and implement blocks for malicious traffic.

  C. Conduct an internal audit against industry best practices to perform a qualitative analysis.

  D. Deploy a UTM solution that receives frequent updates from a trusted industry vendor.

  Correct Answer: A

• Question 440:

  Joe, the Chief Executive Officer (CEO), was an Information security professor and a Subject Matter Expert for over 20 years. He has designed a network defense method which he says is significantly better than prominent international

  standards. He has recommended that the company use his cryptographic method.

  Which of the following methodologies should be adopted?

  A. The company should develop an in-house solution and keep the algorithm a secret.

  B. The company should use the CEO's encryption scheme.

  C. The company should use a mixture of both systems to meet minimum standards.

  D. The company should use the method recommended by other respected information security organizations.

  Correct Answer: D