CompTIA CompTIA Certifications CAS-003 Questions & Answers

• Question 731:

  A large hospital has implemented BYOD to allow doctors and specialists the ability to access patient medical records on their tablets. The doctors and specialists access patient records over the hospital's guest WiFi network which is isolated from the internal network with appropriate security controls. The patient records management system can be accessed from the guest network and require two factor authentication. Using a remote desktop type interface, the doctors and specialists can interact with the hospital's system. Cut and paste and printing functions are disabled to prevent the copying of data to BYOD devices. Which of the following are of MOST concern? (Select TWO).

  A. Privacy could be compromised as patient records can be viewed in uncontrolled areas.

  B. Device encryption has not been enabled and will result in a greater likelihood of data loss.

  C. The guest WiFi may be exploited allowing non-authorized individuals access to confidential patient data.

  D. Malware may be on BYOD devices which can extract data via key logging and screen scrapes.

  E. Remote wiping of devices should be enabled to ensure any lost device is rendered inoperable.

  Correct Answer: AD

  Privacy could be compromised because patient records can be from a doctor's personal device. This can then be shown to persons not authorized to view this information. Similarly, the doctor's personal device could have malware on it.

• Question 732:

  The latest independent research shows that cyber attacks involving SCADA systems grew an average of 15% per year in each of the last four years, but that this year's growth has slowed to around 7%. Over the same time period, the number of attacks against applications has decreased or stayed flat each year. At the start of the measure period, the incidence of PC boot loader or BIOS based attacks was negligible. Starting two years ago, the growth in the number of PC boot loader attacks has grown exponentially. Analysis of these trends would seem to suggest which of the following strategies should be employed?

  A. Spending on SCADA protections should stay steady; application control spending should increase substantially and spending on PC boot loader controls should increase substantially.

  B. Spending on SCADA security controls should stay steady; application control spending should decrease slightly and spending on PC boot loader protections should increase substantially.

  C. Spending all controls should increase by 15% to start; spending on application controls should be suspended, and PC boot loader protection research should increase by 100%.

  D. Spending on SCADA security controls should increase by 15%; application control spending should increase slightly, and spending on PC boot loader protections should remain steady.

  Correct Answer: B

  Spending on the security controls should stay steady because the attacks are still ongoing albeit reduced in occurrence Due to the incidence of BIOS-based attacks growing exponentially as the application attacks being decreased or staying flat spending should increase in this field.

• Question 733:

  An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the penetration tester to MOST efficiently use any obtained administrative credentials on the client organization's other systems, without impacting the integrity of any of the systems?

  A. Use the pass the hash technique

  B. Use rainbow tables to crack the passwords

  C. Use the existing access to change the password

  D. Use social engineering to obtain the actual password

  Correct Answer: A

  With passing the hash you can grab NTLM credentials and you can manipulate the Windows logon sessions maintained by the LSA component. This will allow you to operate as an administrative user and not impact the integrity of any of the systems when running your tests.

• Question 734:

  An organization has implemented an Agile development process for front end web application development. A new security architect has just joined the company and wants to integrate security activities into the SDLC. Which of the following activities MUST be mandated to ensure code quality from a security perspective? (Select TWO).

  A. Static and dynamic analysis is run as part of integration

  B. Security standards and training is performed as part of the project

  C. Daily stand-up meetings are held to ensure security requirements are understood

  D. For each major iteration penetration testing is performed

  E. Security requirements are story boarded and make it into the build

  F. A security design is performed at the end of the requirements phase

  Correct Answer: AD

  SDLC stands for systems development life cycle. An agile project is completed in small sections called iterations. Each iteration is reviewed and critiqued by the project team. Insights gained from the critique of an iteration are used to determine what the next step should be in the project. Each project iteration is typically scheduled to be completed within two weeks.

  Static and dynamic security analysis should be performed throughout the project. Static program analysis is the analysis of computer software that is performed without actually executing programs (analysis performed on executing programs is known as dynamic analysis). In most cases the analysis is performed on some version of the source code, and in the other cases, some form of the object code.

  For each major iteration penetration testing is performed. The output of a major iteration will be a functioning part of the application. This should be penetration tested to ensure security of the application.

• Question 735:

  A well-known retailer has experienced a massive credit card breach. The retailer had gone through an audit and had been presented with a potential problem on their network. Vendors were authenticating directly to the retailer's AD servers, and an improper firewall rule allowed pivoting from the AD server to the DMZ where credit card servers were kept. The firewall rule was needed for an internal application that was developed, which presents risk. The retailer determined that because the vendors were required to have site to site VPN's no other security action was taken.

  To prove to the retailer the monetary value of this risk, which of the following type of calculations is needed?

  A. Residual Risk calculation

  B. A cost/benefit analysis

  C. Quantitative Risk Analysis

  D. Qualitative Risk Analysis

  Correct Answer: C

  Performing quantitative risk analysis focuses on assessing the probability of risk with a metric measurement which is usually a numerical value based on money or time.

• Question 736:

  At 9:00 am each morning, all of the virtual desktops in a VDI implementation become extremely slow and/or unresponsive. The outage lasts for around 10 minutes, after which everything runs properly again. The administrator has traced the problem to a lab of thin clients that are all booted at 9:00 am each morning. Which of the following is the MOST likely cause of the problem and the BEST solution? (Select TWO).

  A. Add guests with more memory to increase capacity of the infrastructure.

  B. A backup is running on the thin clients at 9am every morning.

  C. Install more memory in the thin clients to handle the increased load while booting.

  D. Booting all the lab desktops at the same time is creating excessive I/O.

  E. Install 10-Gb uplinks between the hosts and the lab to increase network capacity.

  F. Install faster SSD drives in the storage system used in the infrastructure.

  G. The lab desktops are saturating the network while booting.

  H. The lab desktops are using more memory than is available to the host systems.

  Correct Answer: DF

  The problem lasts for 10 minutes at 9am every day and has been traced to the lab desktops. This question is asking for the MOST likely cause of the problem. The most likely cause of the problem is that the lab desktops being started at the same time at the beginning of the day is causing excessive disk I/O as the operating systems are being read and loaded from disk storage.

  The solution is to install faster SSD drives in the storage system that contains the desktop operating systems.

• Question 737:

  A security administrator is shown the following log excerpt from a Unix system: 2013 Oct 10 07:14:57 web14 sshd[1632]: Failed password for root from 198.51.100.23 port 37914 ssh2 2013 Oct 10 07:14:57 web14 sshd[1635]: Failed password for root from 198.51.100.23 port 37915 ssh2 2013 Oct 10 07:14:58 web14 sshd[1638]: Failed password for root from 198.51.100.23 port 37916 ssh2 2013 Oct 10 07:15:59 web14 sshd[1640]: Failed password for root from 198.51.100.23 port 37918 ssh2 2013 Oct 10 07:16:00 web14 sshd[1641]: Failed password for root from 198.51.100.23 port 37920 ssh2 2013 Oct 10 07:16:00 web14 sshd[1642]: Successful login for root from 198.51.100.23 port 37924 ssh2 Which of the following is the MOST likely explanation of what is occurring and the BEST immediate response? (Select TWO).

  A. An authorized administrator has logged into the root account remotely.

  B. The administrator should disable remote root logins.

  C. Isolate the system immediately and begin forensic analysis on the host.

  D. A remote attacker has compromised the root account using a buffer overflow in sshd.

  E. A remote attacker has guessed the root password using a dictionary attack.

  F. Use iptables to immediately DROP connections from the IP 198.51.100.23.

  G. A remote attacker has compromised the private key of the root account.

  H. Change the root password immediately to a password not found in a dictionary.

  Correct Answer: CE

  The log shows six attempts to log in to a system. The first five attempts failed due to `failed password'. The sixth attempt was a successful login. Therefore, the MOST likely explanation of what is occurring is that a remote attacker has guessed the root password using a dictionary attack.

  The BEST immediate response is to isolate the system immediately and begin forensic analysis on the host. You should isolate the system to prevent any further access to it and prevent it from doing any damage to other systems on the network. You should perform a forensic analysis on the system to determine what the attacker did on the system after gaining access.

• Question 738:

  A human resources manager at a software development company has been tasked with recruiting personnel for a new cyber defense division in the company. This division will require personnel to have high technology skills and industry certifications. Which of the following is the BEST method for this manager to gain insight into this industry to execute the task?

  A. Interview candidates, attend training, and hire a staffing company that specializes in technology jobs

  B. Interview employees and managers to discover the industry hot topics and trends

  C. Attend meetings with staff, internal training, and become certified in software management

  D. Attend conferences, webinars, and training to remain current with the industry and job requirements

  Correct Answer: D

  Conferences represent an important method of exchanging information between researchers who are usually experts in their respective fields. Together with webinars and training to remain current on the subject the manager will be able to gain valuable insight into the cyber defense industry and be able to recruit personnel.

• Question 739:

  A company is facing penalties for failing to effectively comply with e-discovery requests. Which of the following could reduce the overall risk to the company from this issue?

  A. Establish a policy that only allows filesystem encryption and disallows the use of individual file encryption.

  B. Require each user to log passwords used for file encryption to a decentralized repository.

  C. Permit users to only encrypt individual files using their domain password and archive all old user passwords.

  D. Allow encryption only by tools that use public keys from the existing escrowed corporate PKI.

  Correct Answer: D

  Electronic discovery (also called e-discovery) refers to any process in which electronic data is sought, located, secured, and searched with the intent of using it as evidence in a civil or criminal legal case. E-discovery can be carried out offline on a particular computer or it can be done in a network.

  An e-discovery policy would define how data is archived and encrypted. If the data is archived in an insecure manor, a user could be able to delete data that the user does not want to be searched. Therefore, we need to find a way of securing the data in a way that only authorized people can access the data.

  A public key infrastructure (PKI) supports the distribution and identification of public encryption keys for the encryption of data. The data can only be decrypted by the private key.

  In this question, we have an escrowed corporate PKI. Escrow is an independent and licensed third party that holds something (money, sensitive data etc.) and releases it only when predefined conditions have been met. In this case, Escrow is holding the private key of the PKI.

  By encrypting the e-discovery data by using the PKI public key, we can ensure that the data can only be decrypted by the private key held in Escrow and this will only happen when the predefined conditions are met.

• Question 740:

  During a new desktop refresh, all hosts are hardened at the OS level before deployment to comply with policy. Six months later, the company is audited for compliance to regulations. The audit discovers that 40 percent of the desktops do not meet requirements. Which of the following is the MOST likely cause of the noncompliance?

  A. The devices are being modified and settings are being overridden in production.

  B. The patch management system is causing the devices to be noncompliant after issuing the latest patches.

  C. The desktop applications were configured with the default username and password.

  D. 40 percent of the devices use full disk encryption.

  Correct Answer: A

  The question states that all hosts are hardened at the OS level before deployment. So we know the desktops are fully patched when the users receive them. Six months later, the desktops do not meet the compliance standards. The most likely explanation for this is that the users have changed the settings of the desktops during the six months that they've had them.