CompTIA CompTIA Certifications CAS-003 Questions & Answers

• Question 681:

  A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame for whose fault it was that the incident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner?

  A. During the Identification Phase

  B. During the Lessons Learned phase

  C. During the Containment Phase

  D. During the Preparation Phase

  Correct Answer: B

  The Lessons Learned phase is the final step in the Incident Response process, when everyone involved reviews what happened and why.

• Question 682:

  A small retail company recently deployed a new point of sale (POS) system to all 67 stores. The core of the POS is an extranet site, accessible only from retail stores and the corporate office over a split-tunnel VPN. An additional split-tunnel VPN provides bi-directional connectivity back to the main office, which provides voice connectivity for store VoIP phones. Each store offers guest wireless functionality, as well as employee wireless. Only the staff wireless network has access to the POS VPN. Recently, stores are reporting poor response times when accessing the POS application from store computers as well as degraded voice quality when making phone calls. Upon investigation, it is determined that three store PCs are hosting malware, which is generating excessive network traffic. After malware removal, the information security department is asked to review the configuration and suggest changes to prevent this from happening again. Which of the following denotes the BEST way to mitigate future malware risk?

  A. Deploy new perimeter firewalls at all stores with UTM functionality.

  B. Change antivirus vendors at the store and the corporate office.

  C. Move to a VDI solution that runs offsite from the same data center that hosts the new POS solution.

  D. Deploy a proxy server with content filtering at the corporate office and route all traffic through it.

  Correct Answer: A

  A perimeter firewall is located between the local network and the Internet where it can screen network traffic flowing in and out of the organization. A firewall with unified threat management (UTM) functionalities includes anti-malware capabilities.

• Question 683:

  The Chief Executive Officer (CEO) of a company that allows telecommuting has challenged the Chief Security Officer's (CSO) request to harden the corporate network's perimeter. The CEO argues that the company cannot protect its employees at home, so the risk at work is no different. Which of the following BEST explains why this company should proceed with protecting its corporate network boundary?

  A. The corporate network is the only network that is audited by regulators and customers.

  B. The aggregation of employees on a corporate network makes it a more valuable target for attackers.

  C. Home networks are unknown to attackers and less likely to be targeted directly.

  D. Employees are more likely to be using personal computers for general web browsing when they are at home.

  Correct Answer: B

  Data aggregation is any process in which information is gathered and expressed in a summary form, for purposes such as statistical analysis. Data aggregation increases the impact and scale of a security breach. The amount of data aggregation on the corporate network is much more that on an employee's home network, and is therefore more valuable.

• Question 684:

  A security policy states that all applications on the network must have a password length of eight characters. There are three legacy applications on the network that cannot meet this policy. One system will be upgraded in six months, and two are not expected to be upgraded or removed from the network. Which of the following processes should be followed?

  A. Establish a risk matrix

  B. Inherit the risk for six months

  C. Provide a business justification to avoid the risk

  D. Provide a business justification for a risk exception

  Correct Answer: D

  The Exception Request must include:

  A description of the non-compliance.

  The anticipated length of non-compliance (2-year maximum).

  The proposed assessment of risk associated with non-compliance.

  The proposed plan for managing the risk associated with non-compliance.

  The proposed metrics for evaluating the success of risk management (if risk is significant).

  The proposed review date to evaluate progress toward compliance.

  An endorsement of the request by the appropriate Information Trustee (VP or Dean).

• Question 685:

  A security analyst has been asked to develop a quantitative risk analysis and risk assessment for the company's online shopping application. Based on heuristic information from the Security Operations Center (SOC), a Denial of Service Attack (DoS) has been successfully executed 5 times a year. The Business Operations department has determined the loss associated to each attack is $40,000. After implementing application caching, the number of DoS attacks was reduced to one time a year. The cost of the countermeasures was $100,000. Which of the following is the monetary value earned during the first year of operation?

  A. $60,000

  B. $100,000

  C. $140,000

  D. $200,000

  Correct Answer: A

  ALE before implementing application caching: ALE = ARO x SLE ALE = 5 x $40,000 ALE = $200,000 ALE after implementing application caching: ALE = ARO x SLE ALE = 1 x $40,000 ALE = $40,000 The monetary value earned would be the sum of subtracting the ALE calculated after implementing application caching and the cost of the countermeasures, from the ALE calculated before implementing application caching. Monetary value earned = $200,000 - $40,000 - $100,000 Monetary value earned = $60,000

• Question 686:

  A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self-service functionality. The application has been written by developers over the last six months and the project is currently in the test phase.

  Which of the following security activities should be implemented as part of the SDL in order to provide the MOST security coverage over the solution? (Select TWO).

  A. Perform unit testing of the binary code

  B. Perform code review over a sampling of the front end source code

  C. Perform black box penetration testing over the solution

  D. Perform grey box penetration testing over the solution

  E. Perform static code review over the front end source code

  Correct Answer: DE

  With grey box penetration testing it means that you have limited insight into the devise which would most probable by some code knowledge and this type of testing over the solution would provide the most security coverage under the circumstances.

  A Code review refers to the examination of an application (the new network based software product in this case) that is designed to identify and assess threats to the organization. With a static code review it is assumed that you have all the sources available for the application that is being examined. By performing a static code review over the front end source code you can provide adequate security coverage over the solution.

• Question 687:

  The helpdesk manager wants to find a solution that will enable the helpdesk staff to better serve company employees who call with computer-related problems. The helpdesk staff is currently unable to perform effective troubleshooting and relies on callers to describe their technology problems. Given that the helpdesk staff is located within the company headquarters and 90% of the callers are telecommuters, which of the following tools should the helpdesk manager use to make the staff more effective at troubleshooting while at the same time reducing company costs? (Select TWO).

  A. Web cameras

  B. Email

  C. Instant messaging

  D. BYOD

  E. Desktop sharing

  F. Presence

  Correct Answer: CE

  C: Instant messaging (IM) allows two-way communication in near real time, allowing users to collaborate, hold informal chat meetings, and share files and information. Some IM platforms have added encryption, central logging, and user access controls. This can be used to replace calls between the end-user and the helpdesk.

  E: Desktop sharing allows a remote user access to another user's desktop and has the ability to function as a remote system administration tool. This can allow the helpdesk to determine the cause of the problem on the end-users desktop.

• Question 688:

  A user has a laptop configured with multiple operating system installations. The operating systems are all installed on a single SSD, but each has its own partition and logical volume. Which of the following is the BEST way to ensure confidentiality of individual operating system data?

  A. Encryption of each individual partition

  B. Encryption of the SSD at the file level

  C. FDE of each logical volume on the SSD

  D. FDE of the entire SSD as a single disk

  Correct Answer: A

  In this question, we have multiple operating system installations on a single disk. Some operating systems store their boot loader in the MBR of the disk. However, some operating systems install their boot loader outside the MBR especially when multiple operating systems are installed. We need to encrypt as much data as possible but we cannot encrypt the boot loaders. This would prevent the operating systems from loading.

  Therefore, the solution is to encrypt each individual partition separately.

• Question 689:

  A security manager is looking into the following vendor proposal for a cloud-based SIEM solution. The intention is that the cost of the SIEM solution will be justified by having reduced the number of incidents and therefore saving on the

  amount spent investigating incidents.

  Proposal:

  External cloud-based software as a service subscription costing $5,000 per month. Expected to reduce the number of current incidents per annum by 50%.

  The company currently has ten security incidents per annum at an average cost of $10,000 per incident. Which of the following is the ROI for this proposal after three years?

  A. -$30,000

  B. $120,000

  C. $150,000

  D. $180,000

  Correct Answer: A

  Return on investment = Net profit / Investment where:Net profit = gross profit expenses. or Return on investment = (gain from investment ?cost of investment) / cost of investment Subscriptions = 5,000 x 12 = 60,000 per annum 10 incidents @ 10,000 = 100.000 per annumreduce by 50% = 50,000 per annum Thus the rate of Return is -10,000 per annum and that makes for -$30,000 after three years. References: http://www.financeformulas.net/Return_on_Investment.html

• Question 690:

  A user is suspected of engaging in potentially illegal activities. Law enforcement has requested that the user continue to operate on the network as normal. However, they would like to have a copy of any communications from the user involving certain key terms. Additionally, the law enforcement agency has requested that the user's ongoing communication be retained in the user's account for future investigations. Which of the following will BEST meet the goals of law enforcement?

  A. Begin a chain-of-custody on for the user's communication. Next, place a legal hold on the user's email account.

  B. Perform an e-discover using the applicable search terms. Next, back up the user's email for a future investigation.

  C. Place a legal hold on the user's email account. Next, perform e-discovery searches to collect applicable emails.

  D. Perform a back up of the user's email account. Next, export the applicable emails that match the search terms.

  Correct Answer: C

  A legal hold is a process that an organization uses to maintain all forms of pertinent information when legal action is reasonably expected. E-discovery refers to discovery in litigation or government investigations that manages the exchange of electronically stored information (ESI). ESI includes email and office documents, photos, video, databases, and other filetypes.