CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 121:

  The security engineer receives an incident ticket from the helpdesk stating that DNS lookup requests are no longer working from the office. The network team has ensured that Layer 2 and Layer 3 connectivity are working. Which of the following tools would a security engineer use to make sure the DNS server is listening on port 53?

  A. PING

  B. NESSUS

  C. NSLOOKUP

  D. NMAP

  Correct Answer: D

  NMAP works as a port scanner and is used to check if the DNS server is listening on port 53.

• Question 122:

  A network administrator with a company's NSP has received a CERT alert for targeted adversarial behavior at the company. In addition to the company's physical security, which of the following can the network administrator use to detect the presence of a malicious actor physically accessing the company's network or information systems from within? (Select TWO).

  A. RAS

  B. Vulnerability scanner

  C. HTTP intercept

  D. HIDS

  E. Port scanner

  F. Protocol analyzer

  Correct Answer: DF

  A protocol analyzer can be used to capture and analyze signals and data traffic over a communication channel which makes it ideal for use to assess a company's network from within under the circumstances.

  HIDS is used as an intrusion detection system that can monitor and analyze the internal company network especially the dynamic behavior and the state of the computer systems; behavior such as network packets targeted at that specific

  host, which programs accesses what resources etc.

• Question 123:

  An IT manager is concerned about the cost of implementing a web filtering solution in an effort to mitigate the risks associated with malware and resulting data leakage. Given that the ARO is twice per year, the ALE resulting from a data leak is $25,000 and the ALE after implementing the web filter is $15,000. The web filtering solution will cost the organization $10,000 per year. Which of the following values is the single loss expectancy of a data leakage event after implementing the web filtering solution?

  A. $0

  B. $7,500

  C. $10,000

  D. $12,500

  E. $15,000

  Correct Answer: B

  The annualized loss expectancy (ALE) is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is mathematically expressed as: ALE = ARO x SLE

  Single Loss Expectancy (SLE) is mathematically expressed as: Asset value (AV) x Exposure Factor (EF)

  SLE = AV x EF - Thus the Single Loss Expectancy (SLE) = ALE/ARO = $15,000 / 2 = $ 7,500

  References:

  http://www.financeformulas.net/Return_on_Investment.html https://en.wikipedia.org/wiki/Risk_assessment

• Question 124:

  An administrator wishes to replace a legacy clinical software product as it has become a security risk. The legacy product generates $10,000 in revenue a month. The new software product has an initial cost of $180,000 and a yearly maintenance of $2,000 after the first year. However, it will generate $15,000 in revenue per month and be more secure. How many years until there is a return on investment for this new package?

  B. 2

  C. 3

  D. 4

  Correct Answer: D

  Return on investment = Net profit / Investment where: Profit for the first year is $60 000, second year = $ 120 000 ; third year = $ 180 000 ; and fourth year = $ 240 000 investment in first year = $ 180 000, by year 2 = $ 182 000; by year 3 = $ 184 000 ; and by year 4 = $ 186 000 Thus you will only get a return on the investment in 4 years' time.

  References: http://www.financeformulas.net/Return_on_Investment.html

• Question 125:

  A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the following problems would MOST likely be uncovered by this tool?

  A. The tool could show that input validation was only enabled on the client side

  B. The tool could enumerate backend SQL database table and column names

  C. The tool could force HTTP methods such as DELETE that the server has denied

  D. The tool could fuzz the application to determine where memory leaks occur

  Correct Answer: A

  A HTTP Interceptor is a program that is used to assess and analyze web traffic thus it can be used to indicate that input validation was only enabled on the client side.

• Question 126:

  A security manager is looking into the following vendor proposal for a cloud-based SIEM solution. The intention is that the cost of the SIEM solution will be justified by having reduced the number of incidents and therefore saving on the

  amount spent investigating incidents.

  Proposal:

  External cloud-based software as a service subscription costing $5,000 per month. Expected to reduce the number of current incidents per annum by 50%.

  The company currently has ten security incidents per annum at an average cost of $10,000 per incident. Which of the following is the ROI for this proposal after three years?

  A. -$30,000

  B. $120,000

  C. $150,000

  D. $180,000

  Correct Answer: A

  Return on investment = Net profit / Investment where:Net profit = gross profit expenses. or Return on investment = (gain from investment ?cost of investment) / cost of investment Subscriptions = 5,000 x 12 = 60,000 per annum 10 incidents @ 10,000 = 100.000 per annumreduce by 50% = 50,000 per annum Thus the rate of Return is -10,000 per annum and that makes for -$30,000 after three years.

  References: http://www.financeformulas.net/Return_on_Investment.html

• Question 127:

  An administrator believes that the web servers are being flooded with excessive traffic from time to time. The administrator suspects that these traffic floods correspond to when a competitor makes major announcements. Which of the following should the administrator do to prove this theory?

  A. Implement data analytics to try and correlate the occurrence times.

  B. Implement a honey pot to capture traffic during the next attack.

  C. Configure the servers for high availability to handle the additional bandwidth.

  D. Log all traffic coming from the competitor's public IP addresses.

  Correct Answer: A

  There is a time aspect to the traffic flood and if you correlate the data analytics with the times that the incidents happened, you will be able to prove the theory.

• Question 128:

  A security manager looked at various logs while investigating a recent security breach in the data center from an external source. Each log below was collected from various security devices compiled from a report through the company's

  security information and event management server.

  Logs:

  Log 1:

  Feb 5 23:55:37.743: %SEC-6-IPACCESSLOGS: list 10 denied 10.2.5.81 3 packets

  Log 2:

  HTTP://www.company.com/index.php?user=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

  Log 3:

  Security Error Alert

  Event ID 50: The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client

  Log 4:

  Encoder oe = new OracleEncoder ();

  String query = "Select user_id FROM user_data WHERE user_name = ` "

  + oe.encode ( req.getParameter("userID") ) + " ` and user_password = ` "

  + oe.encode ( req.getParameter("pwd") ) +" ` ";

  Vulnerabilities

  Buffer overflow

  SQL injection

  ACL

  XSS

  Which of the following logs and vulnerabilities would MOST likely be related to the security breach? (Select TWO).

  A. Log 1

  B. Log 2

  C. Log 3

  D. Log 4

  E. Buffer overflow

  F. ACL

  G. XSS

  H. SQL injection

  Correct Answer: BE

  Log 2 indicates that the security breach originated from an external source. And the vulnerability that can be associated with this security breach is a buffer overflow that happened when the amount of data written into the buffer exceeded the limit of that particular buffer.

• Question 129:

  A new internal network segmentation solution will be implemented into the enterprise that consists of 200 internal firewalls. As part of running a pilot exercise, it was determined that it takes three changes to deploy a new application onto the network before it is operational. Security now has a significant effect on overall availability. Which of the following would be the FIRST process to perform as a result of these findings?

  A. Lower the SLA to a more tolerable level and perform a risk assessment to see if the solution could be met by another solution. Reuse the firewall infrastructure on other projects.

  B. Perform a cost benefit analysis and implement the solution as it stands as long as the risks are understood by the business owners around the availability issues. Decrease the current SLA expectations to match the new solution.

  C. Engage internal auditors to perform a review of the project to determine why and how the project did not meet the security requirements. As part of the review ask them to review the control effectiveness.

  D. Review to determine if control effectiveness is in line with the complexity of the solution. Determine if the requirements can be met with a simpler solution.

  Correct Answer: D

  Checking whether control effectiveness complies with the complexity of the solution and then determining if there is not an alternative simpler solution would be the first procedure to follow in the light of the findings.

• Question 130:

  A business wants to start using social media to promote the corporation and to ensure that customers have a good experience with their products. Which of the following security items should the company have in place before implementation? (Select TWO).

  A. The company must dedicate specific staff to act as social media representatives of the company.

  B. All staff needs to be instructed in the proper use of social media in the work environment.

  C. Senior staff blogs should be ghost written by marketing professionals.

  D. The finance department must provide a cost benefit analysis for social media.

  E. The security policy needs to be reviewed to ensure that social media policy is properly implemented.

  F. The company should ensure that the company has sufficient bandwidth to allow for social media traffic.

  Correct Answer: AE