Act now and download your CompTIA CAS-002 test today! Do not waste time for the worthless CompTIA CAS-002 tutorials. Download Up to date CompTIA CompTIA Advanced Security Practitioner (CASP) exam with real questions and answers and begin to learn CompTIA CAS-002 with a classic professional.

2021 Dec CAS-002 exam

Q311. - (Topic 1) 

Company XYZ has purchased and is now deploying a new HTML5 application. The company wants to hire a penetration tester to evaluate the security of the client and server components of the proprietary web application before launch. Which of the following is the penetration tester MOST likely to use while performing black box testing of the security of the company’s purchased application? (Select TWO). 

A. Code review 

B. Sandbox 

C. Local proxy 

D. Fuzzer 

E. Port scanner 

Answer: C,D 


Q312. - (Topic 1) 

A university requires a significant increase in web and database server resources for one week, twice a year, to handle student registration. The web servers remain idle for the rest of the year. Which of the following is the MOST cost effective way for the university to securely handle student registration? 

A. Virtualize the web servers locally to add capacity during registration. 

B. Move the database servers to an elastic private cloud while keeping the web servers local. 

C. Move the database servers and web servers to an elastic private cloud. 

D. Move the web servers to an elastic public cloud while keeping the database servers local. 

Answer: D 


Q313. - (Topic 1) 

A system administrator needs to meet the maximum amount of security goals for a new DNS infrastructure. The administrator deploys DNSSEC extensions to the domain names 

and infrastructure. Which of the following security goals does this meet? (Select TWO). 

A. Availability 

B. Authentication 

C. Integrity 

D. Confidentiality 

E. Encryption 

Answer: B,C 


Q314. - (Topic 2) 

A new IT company has hired a security consultant to implement a remote access system, which will enable employees to telecommute from home using both company issued as well as personal computing devices, including mobile devices. The company wants a flexible system to provide confidentiality and integrity for data in transit to the company’s internally developed application GUI. Company policy prohibits employees from having administrative rights to company issued devices. Which of the following remote access solutions has the lowest technical complexity? 

A. RDP server 

B. Client-based VPN 

C. IPSec 

D. Jump box 

E. SSL VPN 

Answer: A 


Up to the immediate present CAS-002 practice test:

Q315. - (Topic 4) 

During a new desktop refresh, all hosts are hardened at the OS level before deployment to comply with policy. Six months later, the company is audited for compliance to regulations. The audit discovers that 40% of the desktops do not meet requirements. Which of the following is the cause of the noncompliance? 

A. The devices are being modified and settings are being overridden in production. 

B. The patch management system is causing the devices to be noncompliant after issuing the latest patches. 

C. The desktop applications were configured with the default username and password. 

D. 40% of the devices have been compromised. 

Answer: A 


Q316. - (Topic 4) 

Part of the procedure for decommissioning a database server is to wipe all local disks, as well as SAN LUNs allocated to the server, even though the SAN itself is not being decommissioned. Which of the following is the reason for wiping the SAN LUNs? 

A. LUN masking will prevent the next server from accessing the LUNs. 

B. The data may be replicated to other sites that are not as secure. 

C. Data remnants remain on the LUN that could be read by other servers. 

D. The data is not encrypted during transport. 

Answer: C 


Q317. - (Topic 3) 

Customer Need: 

“We need the system to produce a series of numbers with no discernible mathematical progression for use by our Java based, PKI-enabled, customer facing website.” 

Which of the following BEST restates the customer need? 

A. The system shall use a pseudo-random number generator seeded the same every time. 

B. The system shall generate a pseudo-random number upon invocation by the existing Java program. 

C. The system shall generate a truly random number based upon user PKI certificates. 

D. The system shall implement a pseudo-random number generator for use by corporate customers. 

Answer: B 


Q318. DRAG DROP - (Topic 3) 

Company A has experienced external attacks on their network and wants to minimize the attacks from reoccurring. Modify the network diagram to prevent SQL injections. XSS attacks, smurf attacks, e-mail spam, downloaded malware. viruses and ping attacks. The company can spend a MAXIMUM of 550.000 USD. A cost list for each item is listed below 

1. Anti-Virus Server- $10,000 2 Firewall-$15,000 3 Load Balanced Server - $10,000 4 NIDS/NIPS-$10,000 

5. Packet Analyzer-55.000 6 Patch Server-$15,000 7 Proxy Server-$20,000 8. Router - S10.000 9 Spam Filter - S5 000 10 Traffic Shaper - $20,000 

11. Web Application Firewall - $10,000 

Instructions: Not all placeholders in the diagram need to be filled and items can only be used once. 

Answer: 

303. - (Topic 3) 

An organization did not know its internal customer and financial databases were compromised until the attacker published sensitive portions of the database on several popular attacker websites. The organization was unable to determine when, how, or who conducted the attacks but rebuilt, restored, and updated the compromised database server to continue operations. 

Which of the following is MOST likely the cause for the organization’s inability to determine what really occurred? 

A. Too few layers of protection between the Internet and internal network 

B. Lack of a defined security auditing methodology 

C. Poor intrusion prevention system placement and maintenance 

D. Insufficient logging and mechanisms for review 

Answer: D