CompTIA CAS-002 Online Practice Questions and Exam Preparation

CompTIA CAS-002 Online Questions & Answers

• Question 501:

  A company uses a custom Line of Business (LOB) application to facilitate all back-end manufacturing control. Upon investigation, it has been determined that the database used by the LOB application uses a proprietary data format. The risk management group has flagged this as a potential weakness in the company's operational robustness. Which of the following would be the GREATEST concern when analyzing the manufacturing control application?

  A. Difficulty backing up the custom database
  B. Difficulty migrating to new hardware
  C. Difficulty training new admin personnel
  D. Difficulty extracting data from the database
  D. Difficulty extracting data from the database

• Question 502:

  A security officer is leading a lessons learned meeting. Which of the following should be components of that meeting? (Select TWO).

  A. Demonstration of IPS system
  B. Review vendor selection process
  C. Calculate the ALE for the event
  D. Discussion of event timeline
  E. Assigning of follow up items
  D. Discussion of event timeline
  E. Assigning of follow up items

• Question 503:

  Which of the following are security components provided by an application security library or framework? (Select THREE).

  A. Authorization database
  B. Fault injection
  C. Input validation
  D. Secure logging
  E. Directory services
  F. Encryption and decryption
  C. Input validation
  D. Secure logging
  F. Encryption and decryption

• Question 504:

  A member of the software development team has requested advice from the security team to implement a new secure lab for testing malware. Which of the following is the NEXT step that the security team should take?

  A. Purchase new hardware to keep the malware isolated.
  B. Develop a policy to outline what will be required in the secure lab.
  C. Construct a series of VMs to host the malware environment.
  D. Create a proposal and present it to management for approval.
  D. Create a proposal and present it to management for approval.

• Question 505:

  The risk manager at a small bank wants to use quantitative analysis to determine the ALE of running a business system at a location which is subject to fires during the year. A risk analyst reports to the risk manager that the asset value of the business system is $120,000 and, based on industry data, the exposure factor to fires is only 20% due to the fire suppression system installed at the site. Fires occur in the area on average every four years. Which of the following is the ALE?

  A. $6,000
  B. $24,000
  C. $30,000
  D. $96,000
  A. $6,000

• Question 506:

  A new project initiative involves replacing a legacy core HR system, and is expected to touch many major operational systems in the company. A security administrator is engaged in the project to provide security consulting advice. In addition, there are database, network, application, HR, and transformation management consultants engaged on the project as well. The administrator has established the security requirements. Which of the following is the NEXT logical step?

  A. Document the security requirements in an email and move on to the next most urgent task.
  B. Organize for a requirements workshop with the non-technical project members, being the HR and transformation management consultants.
  C. Communicate the security requirements with all stakeholders for discussion and buy-in.
  D. Organize for a requirements workshop with the technical project members, being the database, network, and application consultants.
  C. Communicate the security requirements with all stakeholders for discussion and buy-in.

• Question 507:

  Company A needs to export sensitive data from its financial system to company B's database, using company B's API in an automated manner. Company A's policy prohibits the use of any intermediary external systems to transfer or store its sensitive data, therefore the transfer must occur directly between company A's financial system and company B's destination server using the supplied API. Additionally, company A's legacy financial software does not support encryption, while company B's API supports encryption. Which of the following will provide end-to-end encryption for the data transfer while adhering to these requirements?

  A. Company A must install an SSL tunneling service on the financial system.
  B. Company A's security administrator should use an HTTPS capable browser to transfer the data.
  C. Company A should use a dedicated MPLS circuit to transfer the sensitive data to company B.
  D. Company A and B must create a site-to-site IPSec VPN on their respective firewalls.
  A. Company A must install an SSL tunneling service on the financial system.

• Question 508:

  The element in SAML can be provided in which of the following predefined formats? (Select TWO).

  A. X.509 subject name
  B. PTR DNS record
  C. EV certificate OID extension
  D. Kerberos principal name
  E. WWN record name
  A. X.509 subject name
  D. Kerberos principal name

• Question 509:

  An Association is preparing to upgrade their firewalls at five locations around the United States. Each of the three vendor's RFP responses is in-line with the security and other requirements. Which of the following should the security administrator do to ensure the firewall platform is appropriate for the Association?

  A. Correlate current industry research with the RFP responses to ensure validity.
  B. Create a lab environment to evaluate each of the three firewall platforms.
  C. Benchmark each firewall platform's capabilities and experiences with similar sized companies.
  D. Develop criteria and rate each firewall platform based on information in the RFP responses.
  B. Create a lab environment to evaluate each of the three firewall platforms.

• Question 510:

  DRAG DROP

  Company A has experienced external attacks on their network and wants to minimize the attacks from reoccurring. Modify the network diagram to prevent SQL injections. XSS attacks, smurf attacks, e-mail spam, downloaded malware. viruses and ping attacks. The company can spend a MAXIMUM of 550.000 USD. A cost list for each item is listed below

  1. Anti-Virus Server- $10,000 2 Firewall-$15,000 3 Load Balanced Server - $10,000 4 NIDS/NIPS-$10,000

  5. Packet Analyzer-55.000 6 Patch Server-$15,000 7 Proxy Server-$20,000 8. Router - S10.000 9 Spam Filter - S5 000 10 Traffic Shaper - $20,000

  11. Web Application Firewall - $10,000

  Instructions: Not all placeholders in the diagram need to be filled and items can only be used once.

  Select and Place: