CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 101:

  The risk committee has endorsed the adoption of a security system development life cycle (SSDLC) designed to ensure compliance with PCI-DSS, HIPAA, and meet the organization's mission. Which of the following BEST describes the correct order of implementing a five phase SSDLC?

  A. Initiation, assessment/acquisition, development/implementation, operations/maintenance and sunset.

  B. Initiation, acquisition/development, implementation/assessment, operations/maintenance and sunset.

  C. Assessment, initiation/development, implementation/assessment, operations/maintenance and disposal.

  D. Acquisition, initiation/development, implementation/assessment, operations/maintenance and disposal.

  Correct Answer: B

• Question 102:

  A company with 2000 workstations is considering purchasing a HIPS to minimize the impact of a system compromise from malware. Currently, the company projects a total cost of $50,000 for the next three years responding to and

  eradicating workstation malware. The Information Security Officer (ISO) has received three quotes from different companies that provide HIPS.

  The first quote requires a $10,000 one-time fee, annual cost of $6 per workstation, and a 10% annual support fee based on the number of workstations.

  The second quote requires a $15,000 one-time fee, an annual cost of $5 per workstation, and a 12% annual fee based on the number of workstations.

  The third quote has no one-time fee, an annual cost of $8 per workstation, and a 15% annual fee based on the number of workstations.

  Which solution should the company select if the contract is only valid for three years?

  A. First quote

  B. Second quote

  C. Third quote

  D. Accept the risk

  Correct Answer: B

  We have 2000 workstations and a budget of $50,000 for the next three years. An annual fee of $5 per workstation works out to $10,000 per year. An additional 12% annual support fee adds another $1,200, which makes it $11,200 a year and $33,600 over three years. The $15,000 one-time fee pushes the total up to $48,600 over the tree years.

• Question 103:

  A security engineer is working on a large software development project. As part of the design of the project, various stakeholder requirements were gathered and decomposed to an implementable and testable level. Various security

  requirements were also documented.

  Organize the following security requirements into the correct hierarchy required for an SRTM.

  Requirement 1: The system shall provide confidentiality for data in transit and data at rest.

  Requirement 2: The system shall use SSL, SSH, or SCP for all data transport.

  Requirement 3: The system shall implement a file-level encryption scheme.

  Requirement 4: The system shall provide integrity for all data at rest.

  Requirement 5: The system shall perform CRC checks on all files.

  A. Level 1: Requirements 1 and 4; Level 2: Requirements 2, 3, and 5

  B. Level 1: Requirements 1 and 4; Level 2: Requirements 2 and 3 under 1, Requirement 5 under 4

  C. Level 1: Requirements 1 and 4; Level 2: Requirement 2 under 1, Requirement 5 under 4; Level 3: Requirement 3 under 2

  D. Level 1: Requirements 1, 2, and 3; Level 2: Requirements 4 and 5

  Correct Answer: B

  Confidentiality and integrity are two of the key facets of data security. Confidentiality ensures that sensitive information is not disclosed to unauthorized users; while integrity ensures that data is not altered by unauthorized users. These are

  Level 1 requirements.

  Confidentiality is enforced through encryption of data at rest, encryption of data in transit, and access control. Encryption of data in transit is accomplished by using secure protocols such as PSec, SSL, PPTP, SSH, and SCP, etc.

  Integrity can be enforced through hashing, digital signatures and CRC checks on the files.

  In the SRTM hierarchy, the enforcement methods would fall under the Level requirement.

  References:

  Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley and Sons, Indianapolis, 2012, pp. 17-19, 20, 27-29

• Question 104:

  A bank has decided to outsource some existing IT functions and systems to a third party service provider. The third party service provider will manage the outsourced systems on their own premises and will continue to directly interface with the bank's other systems through dedicated encrypted links. Which of the following is critical to ensure the successful management of system security concerns between the two organizations?

  A.ISA

  B. BIA

  C. MOU

  D. SOA

  E. BPA

  Correct Answer: A

  An interconnection security agreement (ISA) is a security document that derails the requirements for establishing, maintaining, and operating an interconnection between systems or networks. It specifies the requirements for connecting the systems and networks and details what security controls are co be used to protect the systems and sensitive data.

• Question 105:

  The security administrator is responsible for the confidentiality of all corporate data. The company's servers are located in a datacenter run by a different vendor. The vendor datacenter hosts servers for many different clients, all of whom have access to the datacenter. None of the racks are physically secured. Recently, the company has been the victim of several attacks involving data injection and exfiltatration. The security administrator suspects these attacks are due to several new network based attacks facilitated by having physical access to a system. Which of the following BEST describes how to adapt to the threat?

  A. Apply port security to all switches, switch to SCP, and implement IPSec tunnels between devices.

  B. Apply two factor authentication, require point to point VPNs, and enable log auditing on all devices.

  C. Apply port security to all routers, switch to telnet, and implement point to point VPNs on all servers.

  D. Apply three factor authentication, implement IPSec, and enable SNMP.

  Correct Answer: A

• Question 106:

  A security administrator was recently hired in a start-up company to represent the interest of security and to assist the network team in improving security in the company. The programmers are not on good terms with the security team and do not want to be distracted with security issues while they are working on a major project. Which of the following is the BEST time to make them address security issues in the project?

  A. In the middle of the project

  B. At the end of the project

  C. At the inception of the project

  D. At the time they request

  Correct Answer: C

  It would be easier for the programmers to accommodate and address security concerns if they are made aware of the security issues at the start of the project. The security issues could affect the design of the solution. It would be better to address the security issues at the beginning of the project before the solution has been designed rather than change the design of the solution halfway through the project.

• Question 107:

  A corporation has expanded for the first time by integrating several newly acquired businesses. Which of the following are the FIRST tasks that the security team should undertake? (Select TWO).

  A. Remove acquired companies Internet access.

  B. Federate identity management systems.

  C. Install firewalls between the businesses.

  D. Re-image all end user computers to a standard image.

  E. Develop interconnection policy.

  F. Conduct a risk analysis of each acquired company's networks.

  Correct Answer: EF

• Question 108:

  A telecommunication company has recently upgraded their teleconference systems to multicast. Additionally, the security team has instituted a new policy which requires VPN to access the company's video conference. All parties must be issued a VPN account and must connect to the company's VPN concentrator to participate in the remote meetings. Which of the following settings will increase bandwidth utilization on the VPN concentrator during the remote meetings?

  A. IPSec transport mode is enabled

  B. ICMP is disabled

  C. Split tunneling is disabled

  D. NAT-traversal is enabled

  Correct Answer: C

• Question 109:

  An organization has decided to reduce labor costs by outsourcing back office processing of credit applications to a provider located in another country. Data sovereignty and privacy concerns raised by the security team resulted in the third-party provider only accessing and processing the data via remote desktop sessions. To facilitate communications and improve productivity, staff at the third party has been provided with corporate email accounts that are only accessible via the remote desktop sessions. Email forwarding is blocked and staff at the third party can only communicate with staff within the organization. Which of the following additional controls should be implemented to prevent data loss? (Select THREE).

  A. Implement hashing of data in transit

  B. Session recording and capture

  C. Disable cross session cut and paste

  D. Monitor approved credit accounts

  E. User access audit reviews

  F. Source IP whitelisting

  Correct Answer: CEF

  Data sovereignty is a legal concern where the data is governed by the laws of the country in which the data resides. In this scenario the company does not want the data to fall under the law of the country of the organization to whom back office process has be outsourced to. Therefore we must ensure that data can only be accessed on local servers and no copies are held on computers of the outsource partner. It is important therefore to prevent cut and paste operations.

  Privacy concerns can be addressed by ensuring the unauthorized users do not have access to the data. This can be accomplished though user access auditing, which needs to be reviewed on an ongoing basis; and source IP whitelisting, which is a list of IP addresses that are explicitly allowed access to the system.

• Question 110:

  A company has adopted a BYOD program. The company would like to protect confidential information. However, it has been decided that when an employee leaves, the company will not completely wipe the personal device. Which of the following would MOST likely help the company maintain security when employees leave?

  A. Require cloud storage on corporate servers and disable access upon termination

  B. Whitelist access to only non-confidential information

  C. Utilize an MDM solution with containerization

  D. Require that devices not have local storage

  Correct Answer: C

  Mobile device management (MDM) is a type of security software used by an IT department to monitor, manage and secure employees' mobile devices that are deployed across multiple mobile service providers and across multiple mobile

  operating systems being used in the organization.

  A secure container, in a mobile security context, is an authenticated and encrypted area of an employee's device that separates sensitive corporate information from the owner's personal data and apps.

  The purpose of containerization is to prevent malware, intruders, system resources or other applications from interacting with the secured application and associated corporate data. Secure data containers are third-party mobile apps. The

  container acts as a storage area that is authenticated and encrypted by software and governed by corporate IT security policies. Such apps let IT enforce security policies on the same sensitive business data across different devices, which is

  especially useful because native device security capabilities vary.

  As BYOD (bring your own device) and consumerization trends have grown, the challenges involved in protecting both corporate data and user privacy have also increased. Containerization is one means of providing administrators with full

  control over corporate applications and data without affecting those of the user.