CompTIA Advanced Security Practitioner (CASP) - CAS-002 FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

A security engineer is troubleshooting a possible virus infection, which may have spread to multiple desktop computers within the organization. The company implements enterprise antivirus software on all desktops, but the enterprise antivirus server's logs show no sign of a virus infection. The border firewall logs show suspicious activity from multiple internal hosts trying to connect to the same external IP address. The security administrator decides to post the firewall logs to a security mailing list and receives confirmation from other security administrators that the firewall logs indicate internal hosts are compromised with a new variant of the Trojan.Ransomcrypt.G malware not yet detected by most antivirus software. Which of the following would have detected the malware infection sooner?

A. The security administrator should consider installing a cloud augmented security service. B. The security administrator should consider deploying a signature-based intrusion detection system. C. The security administrator should consider establishing an incident response team. D. The security administrator should consider deploying enterprise forensic analysis tools.

Discussion 0

Correct Answer: A Vote an answer

Question 2

A retail bank has had a number of issues in regards to the integrity of sensitive information across all of its customer databases. This has resulted in the bank's share price decreasing in value by 50% and regulatory intervention and monitoring.
The new Chief Information Security Officer (CISO) as a result has initiated a program of work to solve the issues.
The business has specified that the solution needs to be enterprise grade and meet the following requirements:
Be across all major platforms, applications and infrastructure.
Be able to track user and administrator activity.
Does not significantly degrade the performance of production platforms, applications, and infrastructures.
Real time incident reporting.
Manageable and has meaningful information.
Business units are able to generate reports in a timely manner of the unit's system assets.
In order to solve this problem, which of the following security solutions will BEST meet the above requirements? (Select THREE).

A. Implement a security operations center to provide real time monitoring and incident response with self service reporting capability. B. Implement an aggregation based SIEM solution to be deployed on the log servers of the major platforms, applications, and infrastructure. C. Manually pull the logs from the major platforms, applications, and infrastructures to a central secure server. D. Implement a security operations center to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capability. E. Implement an agent only based SIEM solution to be deployed on all major platforms, applications, and infrastructures. F. Ensure that the network operations center has the tools to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capabilities. G. Ensure appropriate auditing is enabled to capture the required information.

Discussion 0

Correct Answer: B,D,G Vote an answer

Question 3

An administrator receives a notification from legal that an investigation is being performed on members of the finance department. As a precaution, legal has advised a legal hold on all documents for an unspecified period of time. Which of the following policies will MOST likely be violated? (Select TWO).

A. Data Storage Policy B. Data Retention Policy C. Corporate Privacy Policy D. Corporate Confidentiality Policy E. Data Breach Mitigation Policy

Discussion 0

Correct Answer: A,B Vote an answer

Question 4

Company XYZ has experienced a breach and has requested an internal investigation be conducted by the IT Department. Which of the following represents the correct order of the investigation process?

A. Identification, Examination, Preservation, Collection, Analysis, Presentation. B. Collection, Preservation, Examination, Identification, Analysis, Presentation. C. Identification, Preservation, Collection, Examination, Analysis, Presentation. D. Collection, Identification, Preservation, Examination, Analysis, Presentation.

Discussion 0

Correct Answer: C Vote an answer

Question 5

New zero-day attacks are announced on a regular basis against a broad range of technology systems. Which of the following best practices should a security manager do to manage the risks of these attack vectors? (Select TWO).

A. Maintain a list of critical systems. B. Update all network diagrams. C. Create an inventory of applications. D. Backup the router and firewall configurations. E. Establish an emergency response call tree.

Discussion 0

Correct Answer: A,C Vote an answer

Question 6

A vulnerability scanner report shows that a client-server host monitoring solution operating in the credit card corporate environment is managing SSL sessions with a weak algorithm which does not meet corporate policy. Which of the following are true statements? (Select TWO).

A. The X509 V3 certificate was issued by a non trusted public CA. B. The client-server handshake is configured with a wrong priority. C. The X509 V3 certificate is expired. D. The client-server handshake is based on TLS authentication. E. The client-server handshake could not negotiate strong ciphers. F. The client-server implements client-server mutual authentication with different certificates.

Discussion 0

Correct Answer: B,E Vote an answer

Question 7

A security administrator is assessing a new application. The application uses an API that is supposed to encrypt text strings that are stored in memory. How might the administrator test that the strings are indeed encrypted in memory?

A. Initiate a core dump of the application B. Use an HTTP interceptor to capture the text strings C. Use a packet analyzer to inspect the strings D. Run nmap to attach to application memory E. Use fuzzing techniques to examine application inputs

Discussion 0

Correct Answer: A Vote an answer

Question 8

A security company is developing a new cloud-based log analytics platform. Its purpose is to allow:
* Customers to upload their log files to the "big data" platform
* Customers to perform remote log search
* Customers to integrate into the platform using an API so that third party business intelligence tools can be used for the purpose of trending, insights, and/or discovery Which of the following are the BEST security considerations to protect data from one customer being disclosed to other customers? (Select THREE).

A. Secure protocols for transmission of log files and search results B. At least two years retention of log files in case of e-discovery requests C. Sanitizing filters to prevent upload of sensitive log file contents D. Encryption of logical volumes on which the customers' log files reside E. Secure storage and transmission of API keys F. Multi-tenancy with RBAC support

Discussion 0

Correct Answer: A,E,F Vote an answer

Question 9

A security manager is collecting RFQ, RFP, and RFI publications to help identify the technology trends which a government will be moving towards in the future. This information is available to the public. By consolidating the information, the security manager will be able to combine several perspectives into a broader view of technology trends. This is an example of which of the following? (Select TWO).

A. Espionage B. Universal description discovery and integration C. Data aggregation D. Hacktivism E. Supervisory control and data acquisition F. Open source intelligence gathering

Discussion 0

Correct Answer: C,F Vote an answer

Question 10

A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self service functionality. The application has been written by developers over the last six months and the project is currently in the test phase.
Which of the following security activities should be implemented as part of the SDL in order to provide the MOST security coverage over the solution? (Select TWO).

A. Perform black box penetration testing over the solution B. Perform static code review over the front end source code C. Perform unit testing of the binary code D. Perform grey box penetration testing over the solution E. Perform code review over a sampling of the front end source code

Discussion 0

Correct Answer: B,D Vote an answer

Question 11

A security consultant is conducting a network assessment and wishes to discover any legacy backup Internet connections the network may have. Where would the consultant find this information and why would it be valuable?

A. This information can be found in global routing tables, and is valuable because backup connections typically do not have perimeter protection as strong as the primary connection. B. This information can be found by accessing telecom billing records, and is valuable because backup connections typically have much lower latency than primary connections. C. This information can be found by calling the regional Internet registry, and is valuable because backup connections typically do not require VPN access to the network. D. This information can be found by querying the network's DNS servers, and is valuable because backup DNS servers typically allow recursive queries from Internet hosts.

Discussion 0

Correct Answer: A Vote an answer

Question 12

The Chief Executive Officer (CEO) of a company that allows telecommuting has challenged the Chief Security Officer's (CSO) request to harden the corporate network's perimeter.
The CEO argues that the company cannot protect its employees at home, so the risk at work is no different. Which of the following BEST explains why this company should proceed with protecting its corporate network boundary?

A. Home networks are unknown to attackers and less likely to be targeted directly. B. The corporate network is the only network that is audited by regulators and customers. C. The aggregation of employees on a corporate network makes it a more valuable target for attackers. D. Employees are more likely to be using personal computers for general web browsing when they are at home.

Discussion 0

Correct Answer: C Vote an answer

Question 13

A company is deploying a new iSCSI-based SAN. The requirements are as follows:
* SAN nodes must authenticate each other.
* Shared keys must NOT be used.
* Do NOT use encryption in order to gain performance.
Which of the following design specifications meet all the requirements? (Select TWO).

A. Initiators and targets use CHAP authentication B. IPSec using AH with PSK authentication and 3DES C. IPSec using AH with PKI certificates for authentication D. Targets have SCSI IDs for authentication E. Fiber channel over Ethernet should be used F. Targets use CHAP authentication G. Fiber channel should be used with AES

Discussion 0

Correct Answer: A,C Vote an answer

Question 14

An external auditor has found that IT security policies in the organization are not maintained and in some cases are nonexistent. As a result of the audit findings, the CISO has been tasked with the objective of establishing a mechanism to manage the lifecycle of IT security policies. Which of the following can be used to BEST achieve the CISO's objectives?

A. eGRC B. CoBIT C. UCF D. ISO 27002

Discussion 0

Correct Answer: A Vote an answer