CompTIA CAS-002 Online Practice Questions and Exam Preparation

CompTIA CAS-002 Online Questions & Answers

• Question 451:

  Based on the results of a recent audit, a company rolled out a standard computer image in an effort to provide consistent security configurations across all computers. Which of the following controls provides the GREATEST level of certainty that unauthorized changes are not occurring?

  A. Schedule weekly vulnerability assessments
  B. Implement continuous log monitoring
  C. Scan computers weekly against the baseline
  D. Require monthly reports showing compliance with configuration and updates
  C. Scan computers weekly against the baseline

• Question 452:

  A Security Manager is part of a team selecting web conferencing systems for internal use. The system will only be used for internal employee collaboration. Which of the following are the MAIN concerns of the security manager? (Select THREE).

  A. Security of data storage
  B. The cost of the solution
  C. System availability
  D. User authentication strategy
  E. PBX integration of the service
  F. Operating system compatibility
  A. Security of data storage
  C. System availability
  D. User authentication strategy

• Question 453:

  An administrator is assessing the potential risk impact on an accounting system and categorizes it as follows:

  Administrative Files = {(Confidentiality, Moderate), (Integrity, Moderate), (Availability, Low)} Vendor Information = {(Confidentiality, Moderate), (Integrity, Low), (Availability, Low)} Payroll Data = {(Confidentiality, High), (Integrity, Moderate),

  (Availability, Low)} Which of the following is the aggregate risk impact on the accounting system?

  A. {(Confidentiality, Moderate), (Integrity, Moderate), (Availability, Moderate)}
  B. {(Confidentiality, High), (Integrity, Low), (Availability, Low)}
  C. {(Confidentiality, High), (Integrity, Moderate), (Availability, Low)}
  D. {(Confidentiality, Moderate), (Integrity, Moderate), (Availability, Low)}
  C. {(Confidentiality, High), (Integrity, Moderate), (Availability, Low)}

• Question 454:

  Company ABC will test connecting networks with Company XYZ as part of their upcoming merger and are both concerned with minimizing security exposures to each others network throughout the test. Which of the following is the FIRST thing both sides should do prior to connecting the networks?

  A. Create a DMZ to isolate the two companies and provide a security inspection point for all inter- company network traffic.
  B. Determine the necessary data flows between the two companies.
  C. Implement a firewall that restricts everything except the IPSec VPN traffic connecting the two companies.
  D. Implement inline NIPS on the connection points between the two companies.
  B. Determine the necessary data flows between the two companies.

• Question 455:

  The helpdesk department desires to roll out a remote support application for internal use on all company computers. This tool should allow remote desktop sharing, system log gathering, chat, hardware logging, inventory management, and remote registry access. The risk management team has been asked to review vendor responses to the RFQ. Which of the following questions is the MOST important?

  A. What are the protections against MITM?
  B. What accountability is built into the remote support application?
  C. What encryption standards are used in tracking database?
  D. What snapshot or "undo" features are present in the application?
  E. What encryption standards are used in remote desktop and file transfer functionality?
  B. What accountability is built into the remote support application?

• Question 456:

  Company XYZ is in negotiations to acquire Company ABC for $1.2millon. Due diligence activities have uncovered systemic security issues in the flagship product of Company ABC. It has been established that a complete product rewrite would be needed with average estimates indicating a cost of $1.6millon. Which of the following approaches should the risk manager of Company XYZ recommend?

  A. Transfer the risk
  B. Accept the risk
  C. Mitigate the risk
  D. Avoid the risk
  D. Avoid the risk

• Question 457:

  A process allows a LUN to be available to some hosts and unavailable to others. Which of the following causes such a process to become vulnerable?

  A. LUN masking
  B. Data injection
  C. Data fragmentation
  D. Moving the HBA
  D. Moving the HBA

• Question 458:

  A new internal network segmentation solution will be implemented into the enterprise that consists of 200 internal firewalls. As part of running a pilot exercise, it was determined that it takes three changes to deploy a new application onto the network before it is operational. Security now has a significant affect on overall availability. Which of the following would be the FIRST process to perform as a result of these findings?

  A. Lower the SLA to a more tolerable level and perform a risk assessment to see if the solution could be met by another solution. Reuse the firewall infrastructure on other projects.
  B. Perform a cost benefit analysis and implement the solution as it stands as long as the risks are understood by the business owners around the availability issues. Decrease the current SLA expectations to match the new solution.
  C. Engage internal auditors to perform a review of the project to determine why and how the project did not meet the security requirements. As part of the review ask them to review the control effectiveness.
  D. Review to determine if control effectiveness is in line with the complexity of the solution. Determine if the requirements can be met with a simpler solution.
  D. Review to determine if control effectiveness is in line with the complexity of the solution. Determine if the requirements can be met with a simpler solution.

• Question 459:

  Company A is purchasing Company B, and will import all of Company B's users into its authentication system. Company A uses 802.1x with a RADIUS server, while Company B uses a captive SSL portal with an LDAP backend. Which of the following is the BEST way to integrate these two networks?

  A. Enable RADIUS and end point security on Company B's network devices.
  B. Enable LDAP authentication on Company A's network devices.
  C. Enable LDAP/TLS authentication on Company A's network devices.
  D. Enable 802.1x on Company B's network devices.
  D. Enable 802.1x on Company B's network devices.

• Question 460:

  The Chief Information Officer (CIO) comes to the security manager and asks what can be done to reduce the potential of sensitive data being emailed out of the company. Which of the following is an active security measure to protect against this threat?

  A. Require a digital signature on all outgoing emails.
  B. Sanitize outgoing content.
  C. Implement a data classification policy.
  D. Implement a SPAM filter.
  B. Sanitize outgoing content.