CompTIA CompTIA Certifications CAS-002 Questions & Answers

• Question 631:

  Which of the following activities is commonly deemed "OUT OF SCOPE" when undertaking a penetration test?

  A. Test password complexity of all login fields and input validation of form fields

  B. Reverse engineering any thick client software that has been provided for the test

  C. Undertaking network-based denial of service attacks in production environment

  D. Attempting to perform blind SQL injection and reflected cross-site scripting attacks

  E. Running a vulnerability scanning tool to assess network and host weaknesses

  Correct Answer: C

• Question 632:

  The senior security administrator wants to redesign the company DMZ to minimize the risks associated with both external and internal threats. The DMZ design must support security in depth, change management and configuration processes, and support incident reconstruction. Which of the following designs BEST supports the given requirements?

  A. A dual firewall DMZ with remote logging where each firewall is managed by a separate administrator.

  B. A single firewall DMZ where each firewall interface is managed by a separate administrator and logging to the cloud.

  C. A SaaS based firewall which logs to the company's local storage via SSL, and is managed by the change control team.

  D. A virtualized firewall, where each virtual instance is managed by a separate administrator and logging to the same hardware.

  Correct Answer: A

• Question 633:

  Which of the following protocols only facilitates access control?

  A. XACML

  B. Kerberos

  C. SPML

  D. SAML

  Correct Answer: A

• Question 634:

  A vulnerability research team has detected a new variant of a stealth Trojan that disables itself when it detects that it is running on a virtualized environment. The team decides to use dedicated hardware and local network to identify the Trojan's behavior and the remote DNS and IP addresses it connects to. Which of the following tools is BEST suited to identify the DNS and IP addresses the stealth Trojan communicates with after its payload is decrypted?

  A. HIDS

  B. Vulnerability scanner

  C. Packet analyzer

  D. Firewall logs

  E. Disassembler

  Correct Answer: C

• Question 635:

  During a new desktop refresh, all hosts are hardened at the OS level before deployment to comply with policy. Six months later, the company is audited for compliance to regulations. The audit discovers that 40% of the desktops do not meet requirements. Which of the following is the cause of the noncompliance?

  A. The devices are being modified and settings are being overridden in production.

  B. The patch management system is causing the devices to be noncompliant after issuing the latest patches.

  C. The desktop applications were configured with the default username and password.

  D. 40% of the devices have been compromised.

  Correct Answer: A

• Question 636:

  An external auditor has found that IT security policies in the organization are not maintained and in some cases are nonexistent. As a result of the audit findings, the CISO has been tasked with the objective of establishing a mechanism to manage the lifecycle of IT security policies. Which of the following can be used to BEST achieve the CISO's objectives?

  A. CoBIT

  B. UCF

  C. ISO 27002

  D. eGRC

  Correct Answer: D

• Question 637:

  Warehouse users are reporting performance issues at the end of each month when trying to access cloud applications to complete their end of the month financial reports. They have no problem accessing those applications at the beginning of the month. Network information: DMZ network ?192.168.5.0/24 VPN network ?192.168.1.0/24 Datacenter ?192.168.2.0/24 User network - 192.168.3.0/24

  HR network ?192.168.4.0/24 Warehouse network ?192.168.6.0/24 Finance network 192.168.7.0/24

  Traffic shaper configuration: VLAN Bandwidth limit (Mbps) VPN50 User175 HR220 Finance230 Warehouse75 Guest50 External firewall allows all networks to access the Internet.

  Internal Firewall Rules: ActionSourceDestination Permit192.168.1.0/24192.168.2.0/24 Permit192.168.1.0/24192.168.3.0/24 Permit192.168.1.0/24192.168.5.0/24 Permit192.168.2.0/24192.168.1.0/24

  Permit192.168.3.0/24192.168.1.0/24

  Permit192.168.5.0/24192.168.1.0/24

  Permit192.168.4.0/24192.168.7.0/24

  Permit192.168.7.0/24192.168.4.0/24

  Permit192.168.7.0/24any

  Deny192.168.4.0/24any

  Deny192.168.1.0/24192.168.4.0/24 Denyanyany

  Which of the following restrictions is the MOST likely cause?

  A. Bandwidth limit on the traffic shaper for the finance department

  B. Proxy server preventing the warehouse from accessing cloud applications

  C. Deny statements in the firewall for the warehouse network

  D. Bandwidth limit on the traffic shaper for the warehouse department

  Correct Answer: D

• Question 638:

  Continuous monitoring is a popular risk reduction technique in many large organizations with formal certification processes for IT projects. In order to implement continuous monitoring in an effective manner which of the following is correct?

  A. Only security related alerts should be forwarded to the network team for resolution.

  B. All logs must be centrally managed and access to the logs restricted only to data storage staff.

  C. Logging must be set appropriately and alerts delivered to security staff in a timely manner.

  D. Critical logs must be monitored hourly and adequate staff must be assigned to the network team.

  Correct Answer: C

• Question 639:

  A UNIX administrator notifies the storage administrator that extra LUNs can be seen on a UNIX server. The LUNs appear to be NTFS file systems. Which of the following MOST likely happened?

  A. The iSCSI initiator was not restarted.

  B. The NTFS LUNs are snapshots.

  C. The HBA allocation is wrong.

  D. The UNIX server is multipathed.

  Correct Answer: C

• Question 640:

  In developing a new computing lifecycle process for a large corporation, the security team is developing the process for decommissioning computing equipment. In order to reduce the potential for data leakage, which of the following should the team consider? (Select TWO).

  A. Erase all files on drive

  B. Install of standard image

  C. Remove and hold all drives

  D. Physical destruction

  E. Drive wipe

  Correct Answer: DE