CompTIA RC0-C02 Online Practice Questions and Exam Preparation

CompTIA RC0-C02 Online Questions & Answers

• Question 161:

  Which of the following is true about an unauthenticated SAMLv2 transaction?

  A. The browser asks the SP for a resource. The SP provides the browser with an XHTML format. The browser asks the IdP to validate the user, and then provides the XHTML back to the SP for access.
  B. The browser asks the IdP for a resource. The IdP provides the browser with an XHTML format. The browser asks the SP to validate the user, and then provides the XHTML to the IdP for access.
  C. The browser asks the IdP to validate the user. The IdP sends an XHTML form to the SP and a cookie to the browser. The browser asks for a resource to the SP, which verifies the cookie and XHTML format for access.
  D. The browser asks the SP to validate the user. The SP sends an XHTML form to the IdP. The IdP provides the XHTML form back to the SP, and then the browser asks the SP for a resource.
  A. The browser asks the SP for a resource. The SP provides the browser with an XHTML format. The browser asks the IdP to validate the user, and then provides the XHTML back to the SP for access.

• Question 162:

  Joe, an administrator, is notified that contract workers will be onsite assisting with a new project. Joe wants each worker to be aware of the corporate policy pertaining to USB storage devices. Which of the following should each worker review and understand before beginning work?

  A. Interconnection Security Agreement
  B. Memorandum of Understanding
  C. Business Partnership Agreement
  D. Non-Disclosure Agreement
  C. Business Partnership Agreement

• Question 163:

  A developer has implemented a piece of client-side JavaScript code to sanitize a user's provided input to a web page login screen. The code ensures that only the upper case and lower case letters are entered in the username field, and that only a 6-digit PIN is entered in the password field. A security administrator is concerned with the following web server log:

  10.235.62.11 ?- [02/Mar/2014:06:13:04] "GET /site/script.php?user=adminandpass=pass%20or%201=1 HTTP/1.1" 200 5724

  Given this log, which of the following is the security administrator concerned with and which fix should be implemented by the developer?

  A. The security administrator is concerned with nonprintable characters being used to gain administrative access, and the developer should strip all nonprintable characters.
  B. The security administrator is concerned with XSS, and the developer should normalize Unicode characters on the browser side.
  C. The security administrator is concerned with SQL injection, and the developer should implement server side input validation.
  D. The security administrator is concerned that someone may log on as the administrator, and the developer should ensure strong passwords are enforced.
  C. The security administrator is concerned with SQL injection, and the developer should implement server side input validation.

  ---

  The code in the question is an example of a SQL Injection attack. The code `1=1' will always provide a value of true. This can be included in statement designed to return all rows in a SQL table. In this question, the administrator has implemented client-side input validation. Client-side validation can be bypassed. It is much more difficult to bypass server-side input validation.

  SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

• Question 164:

  During a new desktop refresh, all hosts are hardened at the OS level before deployment to comply with policy. Six months later, the company is audited for compliance to regulations. The audit discovers that 40 percent of the desktops do not meet requirements. Which of the following is the MOST likely cause of the noncompliance?

  A. The devices are being modified and settings are being overridden in production.
  B. The patch management system is causing the devices to be noncompliant after issuing the latest patches.
  C. The desktop applications were configured with the default username and password.
  D. 40 percent of the devices use full disk encryption.
  A. The devices are being modified and settings are being overridden in production.

  ---

  The question states that all hosts are hardened at the OS level before deployment. So we know the desktops are fully patched when the users receive them. Six months later, the desktops do not meet the compliance standards. The most likely explanation for this is that the users have changed the settings of the desktops during the six months that they've had them.

• Question 165:

  A security analyst at Company A has been trying to convince the Information Security Officer (ISO) to allocate budget towards the purchase of a new intrusion prevention system (IPS) capable of analyzing encrypted web transactions. Which of the following should the analyst provide to the ISO to support the request? (Select TWO).

  A. Emerging threat reports
  B. Company attack trends
  C. Request for Quote (RFQ)
  D. Best practices
  E. New technologies report
  A. Emerging threat reports
  B. Company attack trends

• Question 166:

  A small company is developing a new Internet-facing web application. The security requirements are:

  Users of the web application must be uniquely identified and authenticated.

  Users of the web application will not be added to the company's directory services.

  Passwords must not be stored in the code.

  Which of the following meets these requirements?

  A. Use OpenID and allow a third party to authenticate users.
  B. Use TLS with a shared client certificate for all users.
  C. Use SAML with federated directory services.
  D. Use Kerberos and browsers that support SAML.
  A. Use OpenID and allow a third party to authenticate users.

  ---

  Users create accounts by selecting an OpenID identity provider, and then use those accounts to sign onto any website which accepts OpenID authentication. OpenID is an open standard and decentralized protocol by the non-profit OpenID Foundation that allows users to be authenticated by certain co-operating sites (known as Relying Parties or RP) using a third party service. This eliminates the need for webmasters to provide their own ad hoc systems and allowing users to consolidate their digital identities. In other words, users can log into multiple unrelated websites without having to register with their information over and over again. Several large organizations either issue or accept OpenIDs on their websites according to the OpenID Foundation: AOL, Blogger, Flickr, France Telecom, Google, Hyves, LiveJournal, Microsoft (provider name Microsoft account), Mixi, Myspace, Novell, Orange, Sears, Sun, Telecom Italia, Universal Music Group, VeriSign, WordPress, and Yahoo!. Other providers include BBC, IBM, PayPal, and Steam.

• Question 167:

  Statement: "The system shall implement measures to notify system administrators prior to a security incident occurring."

  Which of the following BEST restates the above statement to allow it to be implemented by a team of software developers?

  A. The system shall cease processing data when certain configurable events occur.
  B. The system shall continue processing in the event of an error and email the security administrator the error logs.
  C. The system shall halt on error.
  D. The system shall throw an error when specified incidents pass a configurable threshold.
  D. The system shall throw an error when specified incidents pass a configurable threshold.

• Question 168:

  A trust relationship has been established between two organizations with web based services. One organization is acting as the Requesting Authority (RA) and the other acts as the Provisioning Service Provider (PSP). Which of the following is correct about the trust relationship?

  A. The trust relationship uses SAML in the SOAP header. The SOAP body transports the SPML requests / responses.
  B. The trust relationship uses XACML in the SAML header. The SAML body transports the SOAP requests / responses.
  C. The trust relationship uses SPML in the SOAP header. The SOAP body transports the SAML requests / responses.
  D. The trust relationship uses SPML in the SAML header. The SAML body transports the SPML requests / responses.
  A. The trust relationship uses SAML in the SOAP header. The SOAP body transports the SPML requests / responses.

• Question 169:

  A corporation has expanded for the first time by integrating several newly acquired businesses. Which of the following are the FIRST tasks that the security team should undertake? (Select TWO).

  A. Remove acquired companies Internet access.
  B. Federate identity management systems.
  C. Install firewalls between the businesses.
  D. Re-image all end user computers to a standard image.
  E. Develop interconnection policy.
  F. Conduct a risk analysis of each acquired company's networks.
  E. Develop interconnection policy.
  F. Conduct a risk analysis of each acquired company's networks.

• Question 170:

  A Security Administrator has some concerns about the confidentiality of data when using SOAP. Which of the following BEST describes the Security Administrator's concerns?

  A. The SOAP header is not encrypted and allows intermediaries to view the header data. The body can be partially or completely encrypted.
  B. The SOAP protocol supports weak hashing of header information. As a result the header and body can easily be deciphered by brute force tools.
  C. The SOAP protocol can be easily tampered with, even though the header is encrypted.
  D. The SOAP protocol does not support body or header encryption which allows assertions to be viewed in clear text by intermediaries.
  A. The SOAP header is not encrypted and allows intermediaries to view the header data. The body can be partially or completely encrypted.