CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 531:

  An industry organization has implemented a system to allow trusted authentication between all of its partners. The system consists of a web of trusted RADIUS servers communicating over the Internet. An attacker was able to set up a malicious server and conduct a successful man-in-the-middle attack. Which of the following controls should be implemented to mitigate the attack in the future?

  A. Use PAP for secondary authentication on each RADIUS server

  B. Disable unused EAP methods on each RADIUS server

  C. Enforce TLS connections between RADIUS servers

  D. Use a shared secret for each pair of RADIUS servers

  Correct Answer: C

• Question 532:

  An intruder was recently discovered inside the data center, a highly sensitive area. To gain access, the intruder circumvented numerous layers of physical and electronic security measures. Company leadership has asked for a thorough review of physical security controls to prevent this from happening again. Which of the following departments are the MOST heavily invested in rectifying the problem? (Select THREE).

  A. Facilities management

  B. Human resources

  C. Research and development

  D. Programming

  E. Data center operations

  F. Marketing

  G. Information technology

  Correct Answer: AEG

• Question 533:

  A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors. Which of the following controls has likely been implemented by the developers?

  A. SSL certificate revocation

  B. SSL certificate pinning

  C. Mobile device root-kit detection

  D. Extended Validation certificates

  Correct Answer: B

• Question 534:

  A company is facing penalties for failing to effectively comply with e-discovery requests. Which of the following could reduce the overall risk to the company from this issue?

  A. Establish a policy that only allows filesystem encryption and disallows the use of individual file encryption.

  B. Require each user to log passwords used for file encryption to a decentralized repository.

  C. Permit users to only encrypt individual files using their domain password and archive all old user passwords.

  D. Allow encryption only by tools that use public keys from the existing escrowed corporate PKI.

  Correct Answer: D

• Question 535:

  Which of the following activities is commonly deemed "OUT OF SCOPE" when undertaking a penetration test?

  A. Test password complexity of all login fields and input validation of form fields

  B. Reverse engineering any thick client software that has been provided for the test

  C. Undertaking network-based denial of service attacks in production environment

  D. Attempting to perform blind SQL injection and reflected cross-site scripting attacks

  E. Running a vulnerability scanning tool to assess network and host weaknesses

  Correct Answer: C

• Question 536:

  A security architect is designing a new infrastructure using both type 1 and type 2 virtual machines. In addition to the normal complement of security controls (e.g. antivirus, host hardening, HIPS/NIDS) the security architect needs to implement a mechanism to securely store cryptographic keys used to sign code and code modules on the VMs. Which of the following will meet this goal without requiring any hardware pass-through implementations?

  A. vTPM

  B. HSM

  C. TPM

  D. INE

  Correct Answer: A

• Question 537:

  A security administrator is shown the following log excerpt from a Unix system:

  2013 Oct 10 07:14:57 web14 sshd[1632]: Failed password for root from 198.51.100.23 port 37914 ssh2

  2013 Oct 10 07:14:57 web14 sshd[1635]: Failed password for root from 198.51.100.23 port 37915 ssh2

  2013 Oct 10 07:14:58 web14 sshd[1638]: Failed password for root from 198.51.100.23 port 37916 ssh2

  2013 Oct 10 07:15:59 web14 sshd[1640]: Failed password for root from 198.51.100.23 port 37918 ssh2

  2013 Oct 10 07:16:00 web14 sshd[1641]: Failed password for root from 198.51.100.23 port 37920 ssh2

  2013 Oct 10 07:16:00 web14 sshd[1642]: Successful login for root from 198.51.100.23 port 37924 ssh2

  Which of the following is the MOST likely explanation of what is occurring and the BEST immediate response? (Select TWO).

  A. An authorized administrator has logged into the root account remotely.

  B. The administrator should disable remote root logins.

  C. Isolate the system immediately and begin forensic analysis on the host.

  D. A remote attacker has compromised the root account using a buffer overflow in sshd.

  E. A remote attacker has guessed the root password using a dictionary attack.

  F. Use iptables to immediately DROP connections from the IP 198.51.100.23.

  G. A remote attacker has compromised the private key of the root account.

  H. Change the root password immediately to a password not found in a dictionary.

  Correct Answer: CE

• Question 538:

  There have been some failures of the company's internal facing website. A security engineer has found the WAF to be the root cause of the failures. System logs show that the WAF has been unavailable for 14 hours over the past month, in four separate situations. One of these situations was a two hour scheduled maintenance time, aimed at improving the stability of the WAF. Using the MTTR based on the last month's performance figures, which of the following calculations is the percentage of uptime assuming there were 722 hours in the month?

  A. 92.24 percent

  B. 98.06 percent

  C. 98.34 percent

  D. 99.72 percent

  Correct Answer: C

• Question 539:

  The Chief Executive Officer (CEO) of a small start-up company wants to set up offices around the country for the sales staff to generate business. The company needs an effective communication solution to remain in constant contact with each other, while maintaining a secure business environment. A junior- level administrator suggests that the company and the sales staff stay connected via free social media. Which of the following decisions is BEST for the CEO to make?

  A. Social media is an effective solution because it is easily adaptable to new situations.

  B. Social media is an ineffective solution because the policy may not align with the business.

  C. Social media is an effective solution because it implements SSL encryption.

  D. Social media is an ineffective solution because it is not primarily intended for business applications.

  Correct Answer: B

• Question 540:

  During a recent audit of servers, a company discovered that a network administrator, who required remote access, had deployed an unauthorized remote access application that communicated over common ports already allowed through the firewall. A network scan showed that this remote access application had already been installed on one third of the servers in the company. Which of the following is the MOST appropriate action that the company should take to provide a more appropriate solution?

  A. Implement an IPS to block the application on the network

  B. Implement the remote application out to the rest of the servers

  C. Implement SSL VPN with SAML standards for federation

  D. Implement an ACL on the firewall with NAT for remote access

  Correct Answer: C