CAS-003 Online Practice Questions and Answers

SIMULATION

An administrator wants to install a patch to an application.

INSTRUCTIONS

Given the scenario, download, verify, and install the patch in the most secure manner.

The last install that is completed will be the final submission.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Since the implementation of IPv6 on the company network, the security administrator has been unable to identify the users associated with certain devices utilizing IPv6 addresses, even when the devices are centrally managed. en1: flags=8863 mtu 1500 ether f8:1e:af:ab:10:a3 inet6 fw80::fa1e:dfff:fee6:9d8%en1 prefixlen 64 scopeid 0x5 inet 192.168.1.14 netmask 0xffffff00 broadcast 192.168.1.255 inet6 2001:200:5:922:1035:dfff:fee6:9dfe prefixlen 64 autoconf inet6 2001:200:5:922:10ab:5e21:aa9a:6393 prefixlen 64 autoconf temporary nd6 options=1 media: autoselect status: active Given this output, which of the following protocols is in use by the company and what can the system administrator do to positively map users with IPv6 addresses in the future? (Select TWO).

A. The devices use EUI-64 format

B. The routers implement NDP

C. The network implements 6to4 tunneling

D. The router IPv6 advertisement has been disabled

E. The administrator must disable IPv6 tunneling

F. The administrator must disable the mobile IPv6 router flag

G. The administrator must disable the IPv6 privacy extensions

H. The administrator must disable DHCPv6 option code 1

A new piece of ransomware got installed on a company's backup server which encrypted the hard drives containing the OS and backup application configuration but did not affect the deduplication data hard drives. During the incident response, the company finds that all backup tapes for this server are also corrupt. Which of the following is the PRIMARY concern?

A. Determining how to install HIPS across all server platforms to prevent future incidents

B. Preventing the ransomware from re-infecting the server upon restore

C. Validating the integrity of the deduplicated data

D. Restoring the data will be difficult without the application configuration

A network administrator with a company's NSP has received a CERT alert for targeted adversarial behavior at the company. In addition to the company's physical security, which of the following can the network administrator use to detect the presence of a malicious actor physically accessing the company's network or information systems from within? (Select TWO).

A. RAS

B. Vulnerability scanner

C. HTTP intercept

D. HIDS

E. Port scanner

F. Protocol analyzer

The Chief Information Security Officer (CISO) at a large organization has been reviewing some security-related incidents at the organization and comparing them to current industry trends. The desktop security engineer feels that the use of USB storage devices on office computers has contributed to the frequency of security incidents. The CISO knows the acceptable use policy prohibits the use of USB storage devices. Every user receives a popup warning about this policy upon login. The SIEM system produces a report of USB violations on a monthly basis; yet violations continue to occur.

Which of the following preventative controls would MOST effectively mitigate the logical risks associated with the use of USB storage devices?

A. Revise the corporate policy to include possible termination as a result of violations

B. Increase the frequency and distribution of the USB violations report

C. Deploy PKI to add non-repudiation to login sessions so offenders cannot deny the offense

D. Implement group policy objects

A security manager is looking into the following vendor proposal for a cloud-based SIEM solution. The intention is that the cost of the SIEM solution will be justified by having reduced the number of incidents and therefore saving on the

amount spent investigating incidents.

Proposal:

External cloud-based software as a service subscription costing $5,000 per month. Expected to reduce the number of current incidents per annum by 50%.

The company currently has ten security incidents per annum at an average cost of $10,000 per incident. Which of the following is the ROI for this proposal after three years?

A. -$30,000

B. $120,000

C. $150,000

D. $180,000

A security engineer is investigating a compromise that occurred between two internal computers. The engineer has determined during the investigation that one computer infected another. While reviewing the IDS logs, the engineer can view the outbound callback traffic, but sees no traffic between the two computers. Which of the following would BEST address the IDS visibility gap?

A. Install network taps at the edge of the network.

B. Send syslog from the IDS into the SIEM.

C. Install HIDS on each computer.

D. SPAN traffic form the network core into the IDS.

A security consultant is performing a penetration test on www.comptia.org and wants to discover the DNS administrator's email address to use in a later social engineering attack. The information listed with the DNS registrar is private. Which of the following commands will also disclose the email address?

A. dig comptia.org

B. whois comptia.org

C. nslookup ype=SOA comptia.org

D. dnsrecon comptia.org hostmaster

Given the following output from a security tool in Kali:

A. Log reduction

B. Network enumerator

C. Fuzzer

D. SCAP scanner

A company has entered into a business agreement with a business partner for managed human resources services. The Chief Information Security Officer (CISO) has been asked to provide documentation that is required to set up a business-to-business VPN between the two organizations.

Which of the following is required in this scenario?

A. ISA

B. BIA

C. SLA

D. RA

A security appliance vendor is reviewing an RFP that is requesting solutions for the defense of a set of web-based applications. This RFP is from a financial institution with very strict performance requirements. The vendor would like to respond with its solutions.

Before responding, which of the following factors is MOST likely to have an adverse effect on the vendor's qualifications?

A. The solution employs threat information-sharing capabilities using a proprietary data model.

B. The RFP is issued by a financial institution that is headquartered outside of the vendor's own country.

C. The overall solution proposed by the vendor comes in less that the TCO parameter in the RFP.

D. The vendor's proposed solution operates below the KPPs indicated in the RFP.

A request has been approved for a vendor to access a new internal server using only HTTPS and SSH to manage the back-end system for the portal. Internal users just need HTTP and HTTPS access to all internal web servers. All other external access to the new server and its subnet is not allowed. The security manager must ensure proper access is configured.

Below is a snippet from the firewall related to that server (access is provided in a top-down model):

Which of the following lines should be configured to allow the proper access? (Choose two.)

A. Move line 3 below line 4 and change port 80 to 443 on line 4.

B. Move line 3 below line 4 and add port 443 to line.

C. Move line 4 below line 5 and add port 80 to 8080 on line 2.

D. Add port 22 to line 2.

E. Add port 22 to line 5.

F. Add port 443 to line 2.

G. Add port 443 to line 5.

An organization wants to allow its employees to receive corporate email on their own smartphones. A security analyst is reviewing the following information contained within the file system of an employee's smartphone:

1.

FamilyPix.jpg

2.

Taxreturn.tax

3.

paystub.pdf

4.

employeesinfo.xls

5.

SoccerSchedule.doc

6.

RecruitmentPlan.xls

Based on the above findings, which of the following should the organization implement to prevent further exposure? (Select two).

A. Remote wiping

B. Side loading

C. VPN

D. Containerization

E. Rooting

F. Geofencing

G. Jailbreaking

As part of the asset management life cycle, a company engages a certified equipment disposal vendor to appropriately recycle and destroy company assets that are no longer in use. As part of the company's vendor due diligence, which of the following would be MOST important to obtain from the vendor?

A. A copy of the vendor's information security policies.

B. A copy of the current audit reports and certifications held by the vendor.

C. A signed NDA that covers all the data contained on the corporate systems.

D. A copy of the procedures used to demonstrate compliance with certification requirements.

A company is outsourcing to an MSSP that performs managed detection and response services. The MSSP requires a server to be placed inside the network as a log aggregate and allows remote access to MSSP analyst. Critical devices send logs to the log aggregator, where data is stored for 12 months locally before being archived to a multitenant cloud. The data is then sent from the log aggregate to a public IP address in the MSSP datacenter for analysis.

A security engineer is concerned about the security of the solution and notes the following:

1.

The critical devise send cleartext logs to the aggregator.

2.

The log aggregator utilize full disk encryption.

3.

The log aggregator sends to the analysis server via port 80.

4.

MSSP analysis utilize an SSL VPN with MFA to access the log aggregator remotely.

5.

The data is compressed and encrypted prior to being achieved in the cloud.

Which of the following should be the engineer's GREATEST concern?

A. Hardware vulnerabilities introduced by the log aggregate server

B. Network bridging from a remote access VPN

C. Encryption of data in transit

D. Multinancy and data remnants in the cloud