CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 551:

  An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the penetration tester to MOST efficiently use any obtained administrative credentials on the client organization's other systems, without impacting the integrity of any of the systems?

  A. Use the pass the hash technique

  B. Use rainbow tables to crack the passwords

  C. Use the existing access to change the password

  D. Use social engineering to obtain the actual password

  Correct Answer: A

• Question 552:

  An application present on the majority of an organization's 1,000 systems is vulnerable to a buffer overflow attack. Which of the following is the MOST comprehensive way to resolve the issue?

  A. Deploy custom HIPS signatures to detect and block the attacks.

  B. Validate and deploy the appropriate patch.

  C. Run the application in terminal services to reduce the threat landscape.

  D. Deploy custom NIPS signatures to detect and block the attacks.

  Correct Answer: B

• Question 553:

  An analyst connects to a company web conference hosted on www.webconference.com/meetingID#01234 and observes that numerous guests have been allowed to join, without providing identifying information. The topics covered during the web conference are considered proprietary to the company. Which of the following security concerns does the analyst present to management?

  A. Guest users could present a risk to the integrity of the company's information

  B. Authenticated users could sponsor guest access that was previously approved by management

  C. Unauthenticated users could present a risk to the confidentiality of the company's information

  D. Meeting owners could sponsor guest access if they have passed a background check

  Correct Answer: C

• Question 554:

  A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self service functionality. The application has been written by developers over the last six months and the project is currently in the test phase.

  Which of the following security activities should be implemented as part of the SDL in order to provide the MOST security coverage over the solution? (Select TWO).

  A. Perform unit testing of the binary code

  B. Perform code review over a sampling of the front end source code

  C. Perform black box penetration testing over the solution

  D. Perform grey box penetration testing over the solution

  E. Perform static code review over the front end source code

  Correct Answer: DE

• Question 555:

  A security firm is writing a response to an RFP from a customer that is building a new network based software product. The firm's expertise is in penetration testing corporate networks. The RFP explicitly calls for all possible behaviors of the product to be tested, however, it does not specify any particular method to achieve this goal. Which of the following should be used to ensure the security and functionality of the product? (Select TWO).

  A. Code review

  B. Penetration testing

  C. Grey box testing

  D. Code signing

  E. White box testing

  Correct Answer: AE

• Question 556:

  The Information Security Officer (ISO) is reviewing new policies that have been recently made effective and now apply to the company. Upon review, the ISO identifies a new requirement to implement two-factor authentication on the company's wireless system. Due to budget constraints, the company will be unable to implement the requirement for the next two years. The ISO is required to submit a policy exception form to the Chief Information Officer (CIO). Which of the following are MOST important to include when submitting the exception form? (Select THREE).

  A. Business or technical justification for not implementing the requirements.

  B. Risks associated with the inability to implement the requirements.

  C. Industry best practices with respect to the technical implementation of the current controls.

  D. All sections of the policy that may justify non-implementation of the requirements.

  E. A revised DRP and COOP plan to the exception form.

  F. Internal procedures that may justify a budget submission to implement the new requirement.

  G. Current and planned controls to mitigate the risks.

  Correct Answer: ABG

• Question 557:

  The Chief Information Officer (CIO) is reviewing the IT centric BIA and RA documentation. The documentation shows that a single 24 hours downtime in a critical business function will cost the business $2.3 million. Additionally, the business unit which depends on the critical business function has determined that there is a high probability that a threat will materialize based on historical data. The CIO's budget does not allow for full system hardware replacement in case of a catastrophic failure, nor does it allow for the purchase of additional compensating controls. Which of the following should the CIO recommend to the finance director to minimize financial loss?

  A. The company should mitigate the risk.

  B. The company should transfer the risk.

  C. The company should avoid the risk.

  D. The company should accept the risk.

  Correct Answer: B

• Question 558:

  A company is in the process of outsourcing its customer relationship management system to a cloud provider. It will host the entire organization's customer database. The database will be accessed by both the company's users and its customers. The procurement department has asked what security activities must be performed for the deal to proceed. Which of the following are the MOST appropriate security activities to be performed as part of due diligence? (Select TWO).

  A. Physical penetration test of the datacenter to ensure there are appropriate controls.

  B. Penetration testing of the solution to ensure that the customer data is well protected.

  C. Security clauses are implemented into the contract such as the right to audit.

  D. Review of the organizations security policies, procedures and relevant hosting certifications.

  E. Code review of the solution to ensure that there are no back doors located in the software.

  Correct Answer: CD

• Question 559:

  An insurance company is looking to purchase a smaller company in another country. Which of the following tasks would the security administrator perform as part of the security due diligence?

  A. Review switch and router configurations

  B. Review the security policies and standards

  C. Perform a network penetration test

  D. Review the firewall rule set and IPS logs

  Correct Answer: B

• Question 560:

  A security administrator notices the following line in a server's security log:

  ') + "'; The administrator is concerned that it will take the developer a lot of time to fix the application that is running on the server.

  Which of the following should the security administrator implement to prevent this particular attack?

  A. WAF

  B. Input validation

  C. SIEM

  D. Sandboxing

  E. DAM

  Correct Answer: A