Proper study guides for Abreast of the times CompTIA CompTIA Advanced Security Practitioner (CASP) certified begins with CompTIA CAS-002 preparation products which designed to deliver the Verified CAS-002 questions by making you pass the CAS-002 test at your first time. Try the free CAS-002 demo right now.

Q201. - (Topic 2) 

A security manager is looking into the following vendor proposal for a cloud-based SIEM solution. The intention is that the cost of the SIEM solution will be justified by having reduced the number of incidents and therefore saving on the amount spent investigating incidents. 

Proposal: 

External cloud-based software as a service subscription costing $5,000 per month. Expected to reduce the number of current incidents per annum by 50%. 

The company currently has ten security incidents per annum at an average cost of $10,000 per incident. Which of the following is the ROI for this proposal after three years? 

A. -$30,000 

B. $120,000 

C. $150,000 

D. $180,000 

Answer: A 


Q202. - (Topic 4) 

The security administrator finds unauthorized tables and records, which were not present before, on a Linux database server. The database server communicates only with one web server, which connects to the database server via an account with SELECT only privileges. Web server logs show the following: 

90.76.165.40 – - [08/Mar/2014:10:54:04] “GET calendar.php?create%20table%20hidden HTTP/1.1” 200 5724 

90.76.165.40 – - [08/Mar/2014:10:54:05] “GET ../../../root/.bash_history HTTP/1.1” 200 90.76.165.40 – - [08/Mar/2014:10:54:04] “GET index.php?user=<script>Create</script> HTTP/1.1” 200 5724 

The security administrator also inspects the following file system locations on the database server using the command ‘ls -al /root’ 

drwxrwxrwx 11 root root 4096 Sep 28 22:45 . 

drwxr-xr-x 25 root root 4096 Mar 8 09:30 .. 

-rws------ 25 root root 4096 Mar 8 09:30 .bash_history 

-rw------- 25 root root 4096 Mar 8 09:30 .bash_history 

-rw------- 25 root root 4096 Mar 8 09:30 .profile 

-rw------- 25 root root 4096 Mar 8 09:30 .ssh 

Which of the following attacks was used to compromise the database server and what can the security administrator implement to detect such attacks in the future? (Select TWO). 

A. Privilege escalation 

B. Brute force attack 

C. SQL injection 

D. Cross-site scripting 

E. Using input validation, ensure the following characters are sanitized. <> 

F. Update crontab with: find / \( -perm -4000 \) –type f –print0 | xargs -0 ls –l | email.sh 

G. Implement the following PHP directive: $clean_user_input = addslashes($user_input) 

H. Set an account lockout policy 

Answer: A,F 


Q203. - (Topic 2) 

It has come to the IT administrator’s attention that the “post your comment” field on the company blog page has been exploited, resulting in cross-site scripting attacks against customers reading the blog. Which of the following would be the MOST effective at preventing the “post your comment” field from being exploited? 

A. Update the blog page to HTTPS 

B. Filter metacharacters 

C. Install HIDS on the server 

D. Patch the web application 

E. Perform client side input validation 

Answer: B 


Q204. - (Topic 4) 

Some mobile devices are jail-broken by connecting via USB cable and then exploiting software vulnerabilities to get kernel-level access. Which of the following attack types represents this scenario? (Select TWO). 

A. Session management attack 

B. Protocol fuzzing 

C. Root-kit compromise 

D. Physical attack 

E. Privilege escalation 

F. Man-in-the-middle 

Answer: D,E 


Q205. - (Topic 2) 

A company is trying to decide how to manage hosts in a branch location connected via a slow WAN link. The company desires to provide the same level of performance and functionality to the branch office as it provides to the main campus. The company uses Active Directory for its directory service and host configuration management. The branch location does not have a datacenter, and the physical security posture of the building is weak. Which of the following designs is MOST appropriate for this scenario? 

A. Deploy a branch location Read-Only Domain Controller in the DMZ at the main campus with a two-way trust. 

B. Deploy a corporate Read-Only Domain Controller to the branch location. 

C. Deploy a corporate Domain Controller in the DMZ at the main campus. 

D. Deploy a branch location Read-Only Domain Controller to the branch office location with a one-way trust. 

E. Deploy a corporate Domain Controller to the branch location. 

F. Deploy a branch location Domain Controller to the branch location with a one-way trust. 

Answer: B 


Q206. - (Topic 4) 

A system administrator has installed a new Internet facing secure web application that consists of a Linux web server and Windows SQL server into a new corporate site. The administrator wants to place the servers in the most logical network security zones and implement the appropriate security controls. Which of the following scenarios BEST accomplishes this goal? 

A. Create an Internet zone, DMZ, and Internal zone on the firewall. Place the web server in the DMZ. Configure IPtables to allow TCP 80 and 443. Set SELinux to permissive. Place the SQL server in the internal zone. Configure the Windows firewall to allow TCP 80 and 

443. Configure the Internet zone with ACLs of allow 80 and 443 destination DMZ. 

B. Create an Internet zone, DMZ, and Internal zone on the firewall. Place the web server in the DMZ. Configure IPtables to allow TCP 443. Set enforcement threshold on SELinux to one. Place the SQL server in the internal zone. Configure the Windows firewall to allow TCP 1433 and 1443. Configure the Internet zone with ACLs of allow 443 destination DMZ. 

C. Create an Internet zone and two DMZ zones on the firewall. Place the web server in the DMZ one. Set the enforcement threshold on SELinux to 100, and configure IPtables to allow TCP 80 and 443. Place the SQL server in DMZ two. Configure the Windows firewall to allow TCP 80 and 443. Configure the Internet zone with an ACL of allow 443 destination ANY. 

D. Create an Internet zone and two DMZ zones on the firewall. Place the web server in DMZ one. Set enforcement threshold on SELinux to zero, and configure IPtables to allow TCP 80 and 443. Place the SQL server in DMZ two. Configure the Internet zone ACLs with allow 80, 443, 1433, and 1443 destination ANY. 

Answer: B 


Q207. - (Topic 5) 

A security administrator notices a recent increase in workstations becoming compromised by malware. Often, the malware is delivered via drive-by downloads, from malware hosting websites, and is not being detected by the corporate antivirus. Which of the following solutions would provide the BEST protection for the company? 

A. Increase the frequency of antivirus downloads and install updates to all workstations. 

B. Deploy a cloud-based content filter and enable the appropriate category to prevent further infections. 

C. Deploy a NIPS to inspect and block all web traffic which may contain malware and exploits. 

D. Deploy a web based gateway antivirus server to intercept viruses before they enter the network. 

Answer: B 


Q208. - (Topic 1) 

Joe, the Chief Executive Officer (CEO), was an Information security professor and a Subject Matter Expert for over 20 years. He has designed a network defense method which he says is significantly better than prominent international standards. He has recommended that the company use his cryptographic method. Which of the following methodologies should be adopted? 

A. The company should develop an in-house solution and keep the algorithm a secret. 

B. The company should use the CEO’s encryption scheme. 

C. The company should use a mixture of both systems to meet minimum standards. 

D. The company should use the method recommended by other respected information security organizations. 

Answer: D 


Q209. - (Topic 2) 

An insurance company has an online quoting system for insurance premiums. It allows potential customers to fill in certain details about their car and obtain a quote. During an investigation, the following patterns were detected: 

Pattern 1 – Analysis of the logs identifies that insurance premium forms are being filled in but only single fields are incrementally being updated. 

Pattern 2 – For every quote completed, a new customer number is created; due to legacy systems, customer numbers are running out. 

Which of the following is the attack type the system is susceptible to, and what is the BEST way to defend against it? (Select TWO). 

A. Apply a hidden field that triggers a SIEM alert 

B. Cross site scripting attack 

C. Resource exhaustion attack 

D. Input a blacklist of all known BOT malware IPs into the firewall 

E. SQL injection 

F. Implement an inline WAF and integrate into SIEM 

G. Distributed denial of service 

H. Implement firewall rules to block the attacking IP addresses 

Answer: C,F 


Q210. - (Topic 1) 

Ann, a software developer, wants to publish her newly developed software to an online store. Ann wants to ensure that the software will not be modified by a third party or end users before being installed on mobile devices. Which of the following should Ann implement to stop modified copies of her software from running on mobile devices? 

A. Single sign-on 

B. Identity propagation 

C. Remote attestation 

D. Secure code review 

Answer: C