CompTIA RC0-C02 Online Practice Questions and Exam Preparation

CompTIA RC0-C02 Online Questions & Answers

• Question 1:

  ABC Corporation has introduced token-based authentication to system administrators due to the risk of password compromise. The tokens have a set of HMAC counter-based codes and are valid until they are used. Which of the following types of authentication mechanisms does this statement describe?

  A. TOTP
  B. PAP
  C. CHAP
  D. HOTP
  D. HOTP

  ---

  The question states that the HMAC counter-based codes and are valid until they are used.

  These are "one-time" use codes.

  HOTP is an HMAC-based one-time password (OTP) algorithm. HOTP can be used to authenticate a user in a system via an authentication server. Also, if some more steps are carried out (the server calculates subsequent OTP value and

  sends/displays it to the user who checks it against subsequent OTP value calculated by his token), the user can also authenticate the validation server. Both hardware and software tokens are available from various vendors. Hardware tokens

  implementing OATH HOTP tend to be significantly cheaper than their competitors based on proprietary algorithms. Some products can be used for strong passwords as well as OATH HOTP.

  Software tokens are available for (nearly) all major mobile/smartphone platforms.

• Question 2:

  The following has been discovered in an internally developed application:

  Error - Memory allocated but not freed:

  char *myBuffer = malloc(BUFFER_SIZE);

  if (myBuffer != NULL) {

  *myBuffer = STRING_WELCOME_MESSAGE;

  printf("Welcome to: %s\n", myBuffer);

  }

  exit(0);

  Which of the following security assessment methods are likely to reveal this security weakness? (Select TWO).

  A. Static code analysis
  B. Memory dumping
  C. Manual code review
  D. Application sandboxing
  E. Penetration testing
  F. Black box testing
  A. Static code analysis
  C. Manual code review

  ---

  A Code review refers to the examination of an application (the new network based software product in this case) that is designed to identify and assess threats to the organization. Application code review ?whether manual or static will reveal the type of security weakness as shown in the exhibit.

• Question 3:

  A new IDS device is generating a very large number of irrelevant events. Which of the following would BEST remedy this problem?

  A. Change the IDS to use a heuristic anomaly filter.
  B. Adjust IDS filters to decrease the number of false positives.
  C. Change the IDS filter to data mine the false positives for statistical trending data.
  D. Adjust IDS filters to increase the number of false negatives.
  B. Adjust IDS filters to decrease the number of false positives.

• Question 4:

  The security administrator finds unauthorized tables and records, which were not present before, on a Linux database server. The database server communicates only with one web server, which connects to the database server via an

  account with SELECT only privileges.

  Web server logs show the following:

  90.76.165.40 ?- [08/Mar/2014:10:54:04] "GET calendar.php?create%20table%20hidden HTTP/1.1" 200 5724

  90.76.165.40 ?- [08/Mar/2014:10:54:05] "GET ../../../root/.bash_history HTTP/1.1" 200 90.76.165.40 ?- [08/Mar/2014:10:54:04] "GET index.php?user<;scrip>;Creat<;/scrip>; HTTP/1.1" 200 5724

  The security administrator also inspects the following file system locations on the database server using the command `ls -al /root'

  drwxrwxrwx 11 root root 4096 Sep 28 22:45 .

  drwxr-xr-x 25 root root 4096 Mar 8 09:30 ..

  -rws------ 25 root root 4096 Mar 8 09:30 .bash_history

  -rw------- 25 root root 4096 Mar 8 09:30 .bash_history

  -rw------- 25 root root 4096 Mar 8 09:30 .profile

  -rw------- 25 root root 4096 Mar 8 09:30 .ssh

  Which of the following attacks was used to compromise the database server and what can the security administrator implement to detect such attacks in the future? (Select TWO).

  A. Privilege escalation
  B. Brute force attack
  C. SQL injection
  D. Cross-site scripting
  E. Using input validation, ensure the following characters are sanitized:
  F. Update crontab with: find / \( -perm -4000 \) –type f –print0 | xargs -0 ls –l | email.sh
  G. Implement the following PHP directive: $clean_user_input = addslashes($user_input)
  H. Set an account lockout policy
  A. Privilege escalation
  F. Update crontab with: find / \( -perm -4000 \) –type f –print0 | xargs -0 ls –l | email.sh

  ---

  This is an example of privilege escalation.

  Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user.

  The question states that the web server communicates with the database server via an account with SELECT only privileges. However, the privileges listed include read, write and execute (rwx). This suggests the privileges have been

  `escalated'.

  Now that we know the system has been attacked, we should investigate what was done to the system.

  The command “Update crontab with: find / \( -perm -4000 \) –type f –print0 | xargs -0 ls –l | email.sh” is used to find all the files that are setuid enabled. Setuid means set user ID upon execution. If the setuid bit is turned on for a file, the user

  executing that executable file gets the permissions of the individual or group that owns the file.

• Question 5:

  A security administrator wants to calculate the ROI of a security design which includes the purchase of new equipment. The equipment costs $50,000 and it will take 50 hours to install and configure the equipment. The administrator plans to hire a contractor at a rate of $100/hour to do the installation. Given that the new design and equipment will allow the company to increase revenue and make an additional $100,000 on the first year, which of the following is the ROI expressed as a percentage for the first year?

  A. -45 percent
  B. 5.5 percent
  C. 45 percent
  D. 82 percent
  D. 82 percent

  ---

  Return on investment = Net profit / Investment

  where:Net profit = gross profit ?expenses

  investment = stock + market outstanding[when defined as?] + claims

  or

  Return on investment = (gain from investment ?cost of investment) / cost of investment Thus (100 000 ?55 000)/50 000 = 0,82 = 82 %

  References:

  Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley and Sons, Indianapolis, 2012, p. 337 http://www.financeformulas.net/Return_on_Investment.html

• Question 6:

  IT staff within a company often conduct remote desktop sharing sessions with vendors to troubleshoot vendor product-related issues. Drag and drop the following security controls to match the associated security concern. Options may be used once or not at all.

  Select and Place:

  

  

  ---

  Vendor may accidentally or maliciously make changes to the IT system - Allow view-only access.

  With view-only access, the third party can view the desktop but cannot interact with it. In other words, they cannot control the keyboard or mouse to make any changes.

  Desktop sharing traffic may be intercepted by network attackers - Use SSL for remote sessions.

  SSL (Secure Sockets Layer) encrypts data in transit between computers. If an attacker intercepted the traffic, the data would be encrypted and therefore unreadable to the attacker.

  No guarantees that shoulder surfing attacks are not occurring at the vendor - Identified control gap.

  Shoulder surfing is where someone else gains information by looking at your computer screen. This should be identified as a risk. A control gap occurs when there are either insufficient or no actions taken to avoid or mitigate a significant risk.

  Vendor may inadvertently see confidential material from the company such as email and IMs - Limit desktop session to certain windows.

  The easiest way to prevent a third party from viewing your emails and IMs is to close the email and IM application windows for the duration of the desktop sharing session.

• Question 7:

  Which of the following provides the BEST risk calculation methodology?

  A. Annual Loss Expectancy (ALE) x Value of Asset
  B. Potential Loss x Event Probability x Control Failure Probability
  C. Impact x Threat x Vulnerability
  D. Risk Likelihood x Annual Loss Expectancy (ALE)
  B. Potential Loss x Event Probability x Control Failure Probability

  ---

  Of the options given, the BEST risk calculation methodology would be Potential Loss x Event Probability x Control Failure Probability. This exam is about computer and data security so `loss' caused by risk is not necessarily a monetary value.

  For example:

  Potential Loss could refer to the data lost in the event of a data storage failure. Event probability could be the risk a disk drive or drives failing. Control Failure Probability could be the risk of the storage RAID not being able to handle the

  number of failed hard drives without losing data.

• Question 8:

  A security administrator was doing a packet capture and noticed a system communicating with an unauthorized address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network.

  Which of the following is the BEST course of action?

  A. Investigate the network traffic and block UDP port 3544 at the firewall
  B. Remove the system from the network and disable IPv6 at the router
  C. Locate and remove the unauthorized 6to4 relay from the network
  D. Disable the switch port and block the 2001::/32 traffic at the firewall
  A. Investigate the network traffic and block UDP port 3544 at the firewall

  ---

  The 2001::/32 prefix is used for Teredo tunneling. Teredo is a transition technology that gives full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 Internet but have no native connection to an IPv6 network. Unlike similar protocols,

  it can perform its function even from behind network address translation (NAT) devices such as home routers.

  Teredo provides IPv6 (Internet Protocol version 6) connectivity by encapsulating IPv6 datagram packets within IPv4 User Datagram Protocol (UDP) packets. Teredo routes these datagrams on the IPv4 Internet and through NAT devices.

  Teredo nodes elsewhere on the IPv6 network (called Teredo relays) receive the packets, decapsulate them, and pass them on. The Teredo server listens on UDP port 3544.

  Teredo clients are assigned an IPv6 address that starts with the Teredo prefix (2001::/32). In this question, the BEST course of action would be to block UDP port 3544 at the firewall. This will block the unauthorized communication. You can

  then investigate the traffic within the network.

• Question 9:

  Anne, the security administrator, at a company has received a subpoena for the release of all the email received and sent by the company Chief Information Officer (CIO) for the past three years. Anne is only able to find one year's worth of email records on the server and is now concerned about the possible legal implications of not complying with the request. Which of the following should Anne check BEFORE responding to the request?

  A. The company data privacy policies
  B. The company backup logs and archives
  C. The company data retention policies and guidelines
  D. The company data retention procedures
  B. The company backup logs and archives

• Question 10:

  A medical device manufacturer has decided to work with another international organization to develop the software for a new robotic surgical platform to be introduced into hospitals within the next 12 months. In order to ensure a competitor does not become aware, management at the medical device manufacturer has decided to keep it secret until formal contracts are signed. Which of the following documents is MOST likely to contain a description of the initial terms and arrangement and is not legally enforceable?

  A. OLA
  B. BPA
  C. SLA
  D. SOA
  E. MOU
  E. MOU

  ---

  A memorandum of understanding (MOU) documents conditions and applied terms for outsourcing partner organizations that must share data and information resources. It must be signed by a re presentative from each organization that has the legal authority to sign and are typically secured, as they are considered confidential.