CAS-002 answers(21 to 30) for candidates: Oct 2017 Edition

We provide real CAS-002 exam questions and answers braindumps in two formats. Download PDF & Practice Tests. Pass CompTIA CAS-002 Exam quickly & easily. The CAS-002 PDF type is available for reading and printing. You can print more and practice many times. With the help of our CompTIA CAS-002 dumps pdf and vce product and material, you can easily pass the CAS-002 exam.

Q21. - (Topic 4) 

A security architect is designing a new infrastructure using both type 1 and type 2 virtual machines. In addition to the normal complement of security controls (e.g. antivirus, host hardening, HIPS/NIDS) the security architect needs to implement a mechanism to securely store cryptographic keys used to sign code and code modules on the VMs. Which of the following will meet this goal without requiring any hardware pass-through implementations? 

A. vTPM 

B. HSM 

C. TPM 

D. INE 

Answer:


Q22. - (Topic 3) 

A data processing server uses a Linux based file system to remotely mount physical disks on a shared SAN. The server administrator reports problems related to processing of files where the file appears to be incompletely written to the disk. The network administration team has conducted a thorough review of all network infrastructure and devices and found everything running at optimal performance. Other SAN customers are unaffected. The data being processed consists of millions of small files being written to disk from a network source one file at a time. These files are then accessed by a local Java program for processing before being transferred over the network to a SE Linux host for processing. Which of the following is the MOST likely cause of the processing problem? 

A. The administrator has a PERL script running which disrupts the NIC by restarting the CRON process every 65 seconds. 

B. The Java developers accounted for network latency only for the read portion of the processing and not the write process. 

C. The virtual file system on the SAN is experiencing a race condition between the reads and writes of network files. 

D. The Linux file system in use cannot write files as fast as they can be read by the Java program resulting in the errors. 

Answer:


Q23. - (Topic 2) 

The latest independent research shows that cyber attacks involving SCADA systems grew an average of 15% per year in each of the last four years, but that this year’s growth has slowed to around 7%. Over the same time period, the number of attacks against applications has decreased or stayed flat each year. At the start of the measure period, the incidence of PC boot loader or BIOS based attacks was negligible. Starting two years ago, the growth in the number of PC boot loader attacks has grown exponentially. Analysis of these trends would seem to suggest which of the following strategies should be employed? 

A. Spending on SCADA protections should stay steady; application control spending should increase substantially and spending on PC boot loader controls should increase substantially. 

B. Spending on SCADA security controls should stay steady; application control spending should decrease slightly and spending on PC boot loader protections should increase substantially. 

C. Spending all controls should increase by 15% to start; spending on application controls should be suspended, and PC boot loader protection research should increase by 100%. 

D. Spending on SCADA security controls should increase by 15%; application control spending should increase slightly, and spending on PC boot loader protections should remain steady. 

Answer:


Q24. - (Topic 1) 

Due to a new regulatory requirement, ABC Company must now encrypt all WAN transmissions. When speaking with the network administrator, the security administrator learns that the existing routers have the minimum processing power to do the required level of encryption. Which of the following solutions minimizes the performance impact on the router? 

A. Deploy inline network encryption devices 

B. Install an SSL acceleration appliance 

C. Require all core business applications to use encryption 

D. Add an encryption module to the router and configure IPSec 

Answer:


Q25. - (Topic 4) 

The security administrator finds unauthorized tables and records, which were not present before, on a Linux database server. The database server communicates only with one web server, which connects to the database server via an account with SELECT only privileges. Web server logs show the following: 

90.76.165.40 – - [08/Mar/2014:10:54:04] “GET calendar.php?create%20table%20hidden HTTP/1.1” 200 5724 

90.76.165.40 – - [08/Mar/2014:10:54:05] “GET ../../../root/.bash_history HTTP/1.1” 200 90.76.165.40 – - [08/Mar/2014:10:54:04] “GET index.php?user=<script>Create</script> HTTP/1.1” 200 5724 

The security administrator also inspects the following file system locations on the database server using the command ‘ls -al /root’ 

drwxrwxrwx 11 root root 4096 Sep 28 22:45 . 

drwxr-xr-x 25 root root 4096 Mar 8 09:30 .. 

-rws------ 25 root root 4096 Mar 8 09:30 .bash_history 

-rw------- 25 root root 4096 Mar 8 09:30 .bash_history 

-rw------- 25 root root 4096 Mar 8 09:30 .profile 

-rw------- 25 root root 4096 Mar 8 09:30 .ssh 

Which of the following attacks was used to compromise the database server and what can the security administrator implement to detect such attacks in the future? (Select TWO). 

A. Privilege escalation 

B. Brute force attack 

C. SQL injection 

D. Cross-site scripting 

E. Using input validation, ensure the following characters are sanitized. <> 

F. Update crontab with: find / \\( -perm -4000 \\) –type f –print0 | xargs -0 ls –l | email.sh 

G. Implement the following PHP directive: $clean_user_input = addslashes($user_input) 

H. Set an account lockout policy 

Answer: A,F 


Q26. - (Topic 1) 

A security manager has received the following email from the Chief Financial Officer (CFO): 

“While I am concerned about the security of the proprietary financial data in our ERP application, we have had a lot of turnover in the accounting group and I am having a difficult time meeting our monthly performance targets. As things currently stand, we do not allow employees to work from home but this is something I am willing to allow so we can get back on track. What should we do first to securely enable this capability for my group?” 

Based on the information provided, which of the following would be the MOST appropriate response to the CFO? 

A. Remote access to the ERP tool introduces additional security vulnerabilities and should not be allowed. 

B. Allow VNC access to corporate desktops from personal computers for the users working from home. 

C. Allow terminal services access from personal computers after the CFO provides a list of the users working from home. 

D. Work with the executive management team to revise policies before allowing any remote access. 

Answer:


Q27. - (Topic 2) 

An organization uses IP address block 203.0.113.0/24 on its internal network. At the border router, the network administrator sets up rules to deny packets with a source address in this subnet from entering the network, and to deny packets with a destination address in this subnet from leaving the network. Which of the following is the administrator attempting to prevent? 

A. BGP route hijacking attacks 

B. Bogon IP network traffic 

C. IP spoofing attacks 

D. Man-in-the-middle attacks 

E. Amplified DDoS attacks 

Answer:


Q28. - (Topic 4) 

A retail bank has had a number of issues in regards to the integrity of sensitive information across all of its customer databases. This has resulted in the bank’s share price decreasing in value by 50% and regulatory intervention and monitoring. 

The new Chief Information Security Officer (CISO) as a result has initiated a program of work to solve the issues. 

The business has specified that the solution needs to be enterprise grade and meet the following requirements: 

In order to solve this problem, which of the following security solutions will BEST meet the above requirements? (Select THREE). 

A. Implement a security operations center to provide real time monitoring and incident response with self service reporting capability. 

B. Implement an aggregation based SIEM solution to be deployed on the log servers of the major platforms, applications, and infrastructure. 

C. Implement a security operations center to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capability. 

D. Ensure that the network operations center has the tools to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capabilities. 

E. Implement an agent only based SIEM solution to be deployed on all major platforms, applications, and infrastructures. 

F. Ensure appropriate auditing is enabled to capture the required information. 

G. Manually pull the logs from the major platforms, applications, and infrastructures to a central secure server. 

Answer: B,C,F 


Q29. - (Topic 4) 

A company has implemented data retention policies and storage quotas in response to their legal department's requests and the SAN administrator's recommendation. The retention policy states all email data older than 90 days should be eliminated. As there are no technical controls in place, users have been instructed to stick to a storage quota of 500Mb of network storage and 200Mb of email storage. After being presented with an e-discovery request from an opposing legal council, the security administrator discovers that the user in the suit has 1Tb of files and 300Mb of email spanning over two years. Which of the following should the security administrator provide to opposing council? 

A. Delete files and email exceeding policy thresholds and turn over the remaining files and email. 

B. Delete email over the policy threshold and hand over the remaining emails and all of the files. 

C. Provide the 1Tb of files on the network and the 300Mb of email files regardless of age. 

D. Provide the first 200Mb of e-mail and the first 500Mb of files as per policy. 

Answer:


Q30. - (Topic 2) 

A Chief Information Security Officer (CISO) has requested that a SIEM solution be implemented. The CISO wants to know upfront what the projected TCO would be before looking further into this concern. Two vendor proposals have been received: 

Bundled offering expected to be $100,000 per year. 

Operational expenses for the pharmaceutical company to partner with the vendor are expected to be a 0.5 FTE per year. 

Internal employee costs are averaged to be $80,000 per year per FTE. Based on calculating TCO of the two vendor proposals over a 5 year period, which of the following options is MOST accurate? 

A. Based on cost alone, having an outsourced solution appears cheaper. 

B. Based on cost alone, having an outsourced solution appears to be more expensive. 

C. Based on cost alone, both outsourced an in-sourced solutions appear to be the same. 

D. Based on cost alone, having a purchased product solution appears cheaper. 

Answer: