CompTIA CAS-003 Online Practice Questions and Exam Preparation

CompTIA CAS-003 Online Questions & Answers

• Question 231:

  A well-known retailer has experienced a massive credit card breach. The retailer had gone through an audit and had been presented with a potential problem on their network. Vendors were authenticating directly to the retailer's AD servers, and an improper firewall rule allowed pivoting from the AD server to the DMZ where credit card servers were kept. The firewall rule was needed for an internal application that was developed, which presents risk. The retailer determined that because the vendors were required to have site to site VPN's no other security action was taken.

  To prove to the retailer the monetary value of this risk, which of the following type of calculations is needed?

  A. Residual Risk calculation
  B. A cost/benefit analysis
  C. Quantitative Risk Analysis
  D. Qualitative Risk Analysis
  C. Quantitative Risk Analysis

  ---

  Performing quantitative risk analysis focuses on assessing the probability of risk with a metric measurement which is usually a numerical value based on money or time.

• Question 232:

  A cybersecunty engineer analyzed a system for vulnerabilities. The tool created an OVAL Results document as output Which of the following would enable the engineer to interpret the results in a human readable form? (Choose two.)

  A. Text editor
  B. OOXML editor
  C. Event Viewer
  D. XML style sheet
  E. SCAPtool
  F. Debugging utility
  D. XML style sheet
  E. SCAPtool

  ---

  XSLT 1.0 stylesheet. The stylesheet contains all the instructions used to organize and format the output report and can be understood by any XSLT 1.0 processor When the SCAP content is represented by multiple XML files, the OVAL Definition file can be distnbuted along with the XCCDF file. In such a situation, OVAL Definitions may depend on variables that are exported from the XCCDF file during the scan, and separate evaluation of the OVAL definition(s) would produce misleading results.

• Question 233:

  A network service on a production system keeps crashing at random times. The systems administrator suspects a bug in the listener is causing the service to crash, resulting in a DoS. When the service crashes, a core dump is left in the /tmp directory. Which of the following tools can the systems administrator use to reproduce these symptoms?

  A. Fuzzer
  B. Vulnerability scanner
  C. Core dump analyzer
  D. Debugger
  A. Fuzzer

• Question 234:

  An enterprise with global sites processes and exchanges highly sensitive information that is protected under several countries' arms trafficking laws. There is new information that malicious nation-state-sponsored activities are targeting the use of encryption between the geographically disparate sites. The organization currently employs ECDSA and ECDH with P-384, SHA-384, and AES-256-GCM on VPNs between sites.

  Which of the following techniques would MOST likely improve the resilience of the enterprise to attack on cryptographic implementation?

  A. Add a second-layer VPN from a different vendor between sites.
  B. Upgrade the cipher suite to use an authenticated AES mode of operation.
  C. Use a stronger elliptic curve cryptography algorithm.
  D. Implement an IDS with sensors inside (clear-text) and outside (cipher-text) of each tunnel between sites.
  E. Ensure cryptography modules are kept up to date from vendor supplying them.
  C. Use a stronger elliptic curve cryptography algorithm.

• Question 235:

  A company requires a task to be carried by more than one person concurrently. This is an example of:

  A. separation of d duties.
  B. dual control
  C. least privilege
  D. job rotation
  A. separation of d duties.

• Question 236:

  A company wants to configure its wireless network to require username and password authentication. Which of the following should the system administrator implement?

  A. WPS
  B. PEAP
  C. TKIP
  D. PKI
  B. PEAP

• Question 237:

  A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the following problems would MOST likely be uncovered by this tool?

  A. The tool could show that input validation was only enabled on the client side
  B. The tool could enumerate backend SQL database table and column names
  C. The tool could force HTTP methods such as DELETE that the server has denied
  D. The tool could fuzz the application to determine where memory leaks occur
  A. The tool could show that input validation was only enabled on the client side

  ---

  A HTTP Interceptor is a program that is used to assess and analyze web traffic thus it can be used to indicate that input validation was only enabled on the client side.

• Question 238:

  After being notified of an issue with the online shopping cart, where customers are able to arbitrarily change the price of listed items, a programmer analyzes the following piece of code used by a web based shopping cart.

  SELECT ITEM FROM CART WHERE ITEM=ADDSLASHES($USERINPUT);

  The programmer found that every time a user adds an item to the cart, a temporary file is created on the web server /tmp directory. The temporary file has a name which is generated by concatenating the content of the $USERINPUT variable and a timestamp in the form of MM-DD-YYYY, (e.g. smartphone-12-25-2013.tmp) containing the price of the item being purchased. Which of the following is MOST likely being exploited to manipulate the price of a shopping cart's items?

  A. Input validation
  B. SQL injection
  C. TOCTOU
  D. Session hijacking
  C. TOCTOU

  ---

  In this question, TOCTOU is being exploited to allow the user to modify the temp file that contains the price of the item.

  In software development, time of check to time of use (TOCTOU) is a class of software bug caused by changes in a system between the checking of a condition (such as a security credential) and the use of the results of that check. This is one example of a race condition.

  A simple example is as follows: Consider a Web application that allows a user to edit pages, and also allows administrators to lock pages to prevent editing. A user requests to edit a page, getting a form which can be used to alter its content. Before the user submits the form, an administrator locks the page, which should prevent editing. However, since editing has already begun, when the user submits the form, those edits (which have already been made) are accepted. When the user began editing, the appropriate authorization was checked, and the user was indeed allowed to edit. However, the authorization was used later, at a time when edits should no longer have been allowed.

  TOCTOU race conditions are most common in Unix between operations on the file system, but can occur in other contexts, including local sockets and improper use of database transactions.

• Question 239:

  The Chief Information Officer (CIO) wants to establish a non-binding agreement with a third party that outlines the objectives of the mutual arrangement dealing with data transfers between both organizations before establishing a formal partnership. Which of the following would MOST likely be used?

  A. MOU
  B. OLA
  C. NDA
  D. SLA
  A. MOU

• Question 240:

  Given the following output from a security tool in Kali:

  

  A. Log reduction
  B. Network enumerator
  C. Fuzzer
  D. SCAP scanner
  D. SCAP scanner