CompTIA CAS-002 Online Practice Questions and Exam Preparation

CompTIA CAS-002 Online Questions & Answers

• Question 81:

  Company policy requires that all company laptops meet the following baseline requirements:

  Software requirements: Antivirus Anti-malware Anti-spyware Log monitoring Full-disk encryption Terminal services enabled for RDP Administrative access for local users

  Hardware restrictions: Bluetooth disabled FireWire disabled WiFi adapter disabled Ann, a web developer, reports performance issues with her laptop and is not able to access any network resources. After further investigation, a bootkit was discovered and it was trying to access external websites. Which of the following

  hardening techniques should be applied to mitigate this specific issue from reoccurring? (Select TWO).

  A. Group policy to limit web access
  B. Restrict VPN access for all mobile users
  C. Remove full-disk encryption
  D. Remove administrative access to local users
  E. Restrict/disable TELNET access to network resources
  F. Perform vulnerability scanning on a daily basis
  G. Restrict/disable USB access
  D. Remove administrative access to local users
  G. Restrict/disable USB access

• Question 82:

  A manufacturing company is having issues with unauthorized access and modification of the controls operating the production equipment. A communication requirement is to allow the free flow of data between all network segments at the site. Which of the following BEST remediates the issue?

  A. Implement SCADA security measures.
  B. Implement NIPS to prevent the unauthorized activity.
  C. Implement an AAA solution.
  D. Implement a firewall to restrict access to only a single management station.
  C. Implement an AAA solution.

• Question 83:

  A pentester must attempt to crack passwords on a windows domain that enforces strong complex passwords. Which of the following would crack the MOST passwords in the shortest time period?

  A. Online password testing
  B. Rainbow tables attack
  C. Dictionary attack
  D. Brute force attack
  B. Rainbow tables attack

• Question 84:

  A project manager working for a large city government is required to plan and build a WAN, which will be required to host official business and public access. It is also anticipated that the city's emergency and first response communication systems will be required to operate across the same network. The project manager has experience with enterprise IT projects, but feels this project has an increased complexity as a result of the mixed business / public use and the critical infrastructure it will provide. Which of the following should the project manager release to the public, academia, and private industry to ensure the city provides due care in considering all project factors prior to building its new WAN?

  A. NDA
  B. RFI
  C. RFP
  D. RFQ
  B. RFI

• Question 85:

  There have been some failures of the company's internal facing website. A security engineer has found the WAF to be the root cause of the failures. System logs show that the WAF has been unavailable for 14 hours over the past month, in four separate situations. One of these situations was a two hour scheduled maintenance time, aimed at improving the stability of the WAF. Using the MTTR based on the last month's performance figures, which of the following calculations is the percentage of uptime assuming there were 722 hours in the month?

  A. 92.24 percent
  B. 98.06 percent
  C. 98.34 percent
  D. 99.72 percent
  C. 98.34 percent

• Question 86:

  The IT director has charged the company helpdesk with sanitizing fixed and removable media. The helpdesk manager has written a new procedure to be followed by the helpdesk staff. This procedure includes the current standard to be used for data sanitization, as well as the location of physical degaussing tools. In which of the following cases should the helpdesk staff use the new procedure? (Select THREE).

  A. During asset disposal
  B. While reviewing the risk assessment
  C. While deploying new assets
  D. Before asset repurposing
  E. After the media has been disposed of
  F. During the data classification process
  G. When installing new printers
  H. When media fails or is unusable
  A. During asset disposal
  D. Before asset repurposing
  H. When media fails or is unusable

• Question 87:

  The Chief Information Officer (CIO) is focused on improving IT governance within the organization to reduce system downtime. The CIO has mandated that the following improvements be implemented:

  -All business units must now identify IT risks and include them in their business risk profiles.

  -Key controls must be identified and monitored.

  -Incidents and events must be recorded and reported with management oversight.

  -Exemptions to the information security policy must be formally recorded, approved, and managed.

  -IT strategy will be reviewed to ensure it is aligned with the businesses strategy and objectives.

  In addition to the above, which of the following would BEST help the CIO meet the requirements?

  A. Establish a register of core systems and identify technical service owners
  B. Establish a formal change management process
  C. Develop a security requirement traceability matrix
  D. Document legacy systems to be decommissioned and the disposal process
  B. Establish a formal change management process

• Question 88:

  A security administrator wants to calculate the ROI of a security design which includes the purchase of new equipment. The equipment costs $50,000 and it will take 50 hours to install and configure the equipment. The administrator plans to hire a contractor at a rate of $100/hour to do the installation. Given that the new design and equipment will allow the company to increase revenue and make an additional $100,000 on the first year, which of the following is the ROI expressed as a percentage for the first year?

  A. -45 percent
  B. 5.5 percent
  C. 45 percent
  D. 82 percent
  D. 82 percent

• Question 89:

  The internal audit department is investigating a possible breach of security. One of the auditors is sent to interview the following employees:

  Employee A. Works in the accounts receivable office and is in charge of entering data into the finance system.

  Employee B. Works in the accounts payable office and is in charge of approving purchase orders. Employee C. Is the manager of the finance department, supervises Employee A and Employee B, and can perform the functions of both

  Employee A and Employee B.

  Which of the following should the auditor suggest be done to avoid future security breaches?

  A. All employees should have the same access level to be able to check on each others.
  B. The manager should only be able to review the data and approve purchase orders.
  C. Employee A and Employee B should rotate jobs at a set interval and cross-train.
  D. The manager should be able to both enter and approve information.
  B. The manager should only be able to review the data and approve purchase orders.

• Question 90:

  A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalability to adequately serve their clients. Since it is an e-discovery firm where chain of custody is important, which of the following scenarios should they consider?

  A. Offload some data processing to a public cloud
  B. Aligning their client intake with the resources available
  C. Using a community cloud with adequate controls
  D. Outsourcing the service to a third party cloud provider
  C. Using a community cloud with adequate controls