CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 91:

  An attacker attempts to create a DoS event against the VoIP system of a company. The attacker uses a tool to flood the network with a large number of SIP INVITE traffic. Which of the following would be LEAST likely to thwart such an attack?

  A. Install IDS/IPS systems on the network

  B. Force all SIP communication to be encrypted

  C. Create separate VLANs for voice and data traffic

  D. Implement QoS parameters on the switches

  Correct Answer: D

  Quality of service (QoS) is a mechanism that is designed to give priority to different applications, users, or data to provide a specific level of performance. It is often used in networks to prioritize certain types of network traffic. It is not designed to block traffic, per se, but to give certain types of traffic a lower or higher priority than others. This is least likely to counter a denial of service (DoS) attack.

• Question 92:

  The telecommunications manager wants to improve the process for assigning company- owned mobile devices and ensuring data is properly removed when no longer needed. Additionally, the manager wants to onboard and offboard personally owned mobile devices that will be used in the BYOD initiative. Which of the following should be implemented to ensure these processes can be automated? (Select THREE).

  A. SIM's PIN

  B. Remote wiping

  C. Chargeback system

  D. MDM software

  E. Presence software

  F. Email profiles

  G. Identity attestation

  H. GPS tracking

  Correct Answer: BDG

  In identity management, onboarding is the addition of a new employee to an organization's identity and access management (IAM) system. The term is also used if an employee changes roles within the organization and is granted new or

  expanded access privileges. Conversely, offboarding refers to the IAM processes surrounding the removal of an identity for an employee who has left the organization.

  Mobile device management (MDM) is a type of security software used by an IT department to monitor, manage and secure employees' mobile devices that are deployed across multiple mobile service providers and across multiple mobile

  operating systems being used in the organization.

  Remote wiping is a function of MDM software that enables an administrator to remotely wipe data from a mobile device usually be resetting the device back to its factory default settings.

  Identity attestation is used to prove one's identity by using third party trusted authentication providers.

• Question 93:

  A security manager has received the following email from the Chief Financial Officer (CFO):

  "While I am concerned about the security of the proprietary financial data in our ERP application, we have had a lot of turnover in the accounting group and I am having a difficult time meeting our monthly performance targets. As things

  currently stand, we do not allow employees to work from home but this is something I am willing to allow so we can get back on track. What should we do first to securely enable this capability for my group?"

  Based on the information provided, which of the following would be the MOST appropriate response to the CFO?

  A. Remote access to the ERP tool introduces additional security vulnerabilities and should not be allowed.

  B. Allow VNC access to corporate desktops from personal computers for the users working from home.

  C. Allow terminal services access from personal computers after the CFO provides a list of the users working from home.

  D. Work with the executive management team to revise policies before allowing any remote access.

  Correct Answer: D

  The Chief Financial Officer (CFO) wants to change company policy to allow employees to work from home. Before the new policy is implemented, the relevant documented company policies should be updated to reflect the new policy. Company policies are rarely defined by a single person in a company; they are usually defined by executive management. Therefore, you should work with the executive management team to revise the policies.

• Question 94:

  A security engineer on a large enterprise network needs to schedule maintenance within a fixed window of time. A total outage period of four hours is permitted for servers. Workstations can undergo maintenance from 8:00 pm to 6:00 am daily. Which of the following can specify parameters for the maintenance work? (Select TWO).

  A. Managed security service

  B. Memorandum of understanding

  C. Quality of service

  D. Network service provider

  E. Operating level agreement

  Correct Answer: BE

  B: A memorandum of understanding (MOU) documents conditions and applied terms for outsourcing partner organizations that must share data and information resources. It must be signed by a re presentative from each organization that has the legal authority to sign and are typically secured, as they are considered confidential.

  E: An operating level agreement (O LA) defines the responsibilities of each partner's internal support group and what group and resources are used to meet the specified goal. It is used in conjunction with service level agreements (SLAs).

• Question 95:

  A medical device manufacturer has decided to work with another international organization to develop the software for a new robotic surgical platform to be introduced into hospitals within the next 12 months. In order to ensure a competitor does not become aware, management at the medical device manufacturer has decided to keep it secret until formal contracts are signed. Which of the following documents is MOST likely to contain a description of the initial terms and arrangement and is not legally enforceable?

  A. OLA

  B. BPA

  C. SLA

  D. SOA

  E. MOU

  Correct Answer: E

  A memorandum of understanding (MOU) documents conditions and applied terms for outsourcing partner organizations that must share data and information resources. It must be signed by a re presentative from each organization that has the legal authority to sign and are typically secured, as they are considered confidential.

• Question 96:

  A team is established to create a secure connection between software packages in order to list employee's remaining or unused benefits on their paycheck stubs. Which of the following business roles would be MOST effective on this team?

  A. Network Administrator, Database Administrator, Programmers

  B. Network Administrator, Emergency Response Team, Human Resources

  C. Finance Officer, Human Resources, Security Administrator

  D. Database Administrator, Facilities Manager, Physical Security Manager

  Correct Answer: C

• Question 97:

  A completely new class of web-based vulnerabilities has been discovered. Claims have been made that all common web-based development frameworks are susceptible to attack. Proof-of-concept details have emerged on the Internet. A security advisor within a company has been asked to provide recommendations on how to respond quickly to these vulnerabilities. Which of the following BEST describes how the security advisor should respond?

  A. Assess the reliability of the information source, likelihood of exploitability, and impact to hosted data. Attempt to exploit via the proof-of-concept code. Consider remediation options.

  B. Hire an independent security consulting agency to perform a penetration test of the web servers. Advise management of any `high' or `critical' penetration test findings and put forward recommendations for mitigation.

  C. Review vulnerability write-ups posted on the Internet. Respond to management with a recommendation to wait until the news has been independently verified by software vendors providing the web application software.

  D. Notify all customers about the threat to their hosted data. Bring the web servers down into "maintenance mode" until the vulnerability can be reliably mitigated through a vendor patch.

  Correct Answer: A

  The first thing you should do is verify the reliability of the claims. From there you can assess the likelihood of the vulnerability affecting your systems. If it is determined that your systems are likely to be affected by the exploit, you need to determine what impact an attack will have on your hosted data. Now that you know what the impact will be, you can test the exploit by using the proof-of-concept code. That should help you determine your options for dealing with the threat (remediation).

• Question 98:

  An international shipping company discovered that deliveries left idle are being tampered with. The company wants to reduce the idle time associated with international deliveries by ensuring that personnel are automatically notified when an inbound delivery arrives at the transit dock. Which of the following should be implemented to help the company increase the security posture of its operations?

  A. Back office database

  B. Asset tracking

  C. Geo-fencing

  D. Barcode scanner

  Correct Answer: C

  Mobile device management (MDM) is a type of security software used by an IT department to monitor, manage and secure employees' mobile devices that are deployed across multiple mobile service providers and across multiple mobile

  operating systems being used in the organization.

  A secure container, in a mobile security context, is an authenticated and encrypted area of an employee's device that separates sensitive corporate information from the owner's personal data and apps.

  The purpose of containerization is to prevent malware, intruders, system resources or other applications from interacting with the secured application and associated corporate data. Secure data containers are third-party mobile apps. The

  container acts as a storage area that is authenticated and encrypted by software and governed by corporate IT security policies. Such apps let IT enforce security policies on the same sensitive business data across different devices, which is

  especially useful because native device security capabilities vary.

  As BYOD (bring your own device) and consumerization trends have grown, the challenges involved in protecting both corporate data and user privacy have also increased. Containerization is one means of providing administrators with full

  control over corporate applications and data without affecting those of the user.

• Question 99:

  An internal development team has migrated away from Waterfall development to use Agile development. Overall, this has been viewed as a successful initiative by the stakeholders as it has improved time-to-market. However, some staff within the security team have contended that Agile development is not secure. Which of the following is the MOST accurate statement?

  A. Agile and Waterfall approaches have the same effective level of security posture. They both need similar amounts of security effort at the same phases of development.

  B. Agile development is fundamentally less secure than Waterfall due to the lack of formal up-front design and inability to perform security reviews.

  C. Agile development is more secure than Waterfall as it is a more modern methodology which has the advantage of having been able to incorporate security best practices of recent years.

  D. Agile development has different phases and timings compared to Waterfall. Security activities need to be adapted and performed within relevant Agile phases.

  Correct Answer: D

  Agile and Waterfall are two distinct methods of software development. The Waterfall model employs a sequential design process. Development flows sequentially from start point to end point, with several different stages. The Agile method is an incremental and iterative approach to software design with the design process being broken into individual models that designers work on. Security activities need to be adapted and performed within individual model that designers work on.

• Question 100:

  A corporation has expanded for the first time by integrating several newly acquired businesses. Which of the following are the FIRST tasks that the security team should undertake? (Select TWO).

  A. Remove acquired companies Internet access.

  B. Federate identity management systems.

  C. Install firewalls between the businesses.

  D. Re-image all end user computers to a standard image.

  E. Develop interconnection policy.

  F. Conduct a risk analysis of each acquired company's networks.

  Correct Answer: EF