CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 131:

  The helpdesk is receiving multiple calls about slow and intermittent Internet access from the finance department. The following information is compiled: Caller 1, IP 172.16.35.217, NETMASK 255.255.254.0 Caller 2, IP 172.16.35.53, NETMASK 255.255.254.0 Caller 3, IP 172.16.35.173, NETMASK 255.255.254.0 All callers are connected to the same switch and are routed by a router with five built-in interfaces. The upstream router interface's MAC is 00-01-42-32-ab-1a A packet capture shows the following: 09:05:15.934840 arp reply 172.16.34.1 is-at 00:01:42:32:ab:1a (00:01:42:32:ab:1a) 09:06:16.124850 arp reply 172.16.34.1 is-at 00:01:42:32:ab:1a (00:01:42:32:ab:1a) 09:07:25.439811 arp reply 172.16.34.1 is-at 00:01:42:32:ab:1a (00:01:42:32:ab:1a) 09:08:10.937590 IP 172.16.35.1 > 172.16.35.255: ICMP echo request, id 2305, seq 1, length 65534 09:08:10.937591 IP 172.16.35.1 > 172.16.35.255: ICMP echo request, id 2306, seq 2, length 65534 09:08:10.937592 IP 172.16.35.1 > 172.16.35.255: ICMP echo request, id 2307, seq 3, length 65534 Which of the following is occurring on the network?

  A. A man-in-the-middle attack is underway on the network.

  B. An ARP flood attack is targeting at the router.

  C. The default gateway is being spoofed on the network.

  D. A denial of service attack is targeting at the router.

  Correct Answer: D

  The above packet capture shows an attack where the attacker is busy consuming your resources (in this case the router) and preventing normal use. This is thus a Denial Of Service Attack.

• Question 132:

  The Information Security Officer (ISO) believes that the company has been targeted by cybercriminals and it is under a cyber attack. Internal services that are normally available to the public via the Internet are inaccessible, and employees in the office are unable to browse the Internet. The senior security engineer starts by reviewing the bandwidth at the border router, and notices that the incoming bandwidth on the router's external interface is maxed out. The security engineer then inspects the following piece of log to try and determine the reason for the downtime, focusing on the company's external router's IP which is 128.20.176.19:

  11:16:22.110343 IP 90.237.31.27.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110351 IP 23.27.112.200.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110358 IP 192.200.132.213.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110402 IP 70.192.2.55.19 > 128.20.176.19.19: UDP, length 1400 11:16:22.110406 IP 112.201.7.39.19 > 128.20.176.19.19: UDP, length 1400 Which of the following describes the findings the senior security engineer should report to the ISO and the BEST solution for service restoration?

  A. After the senior engineer used a network analyzer to identify an active Fraggle attack, the company's ISP should be contacted and instructed to block the malicious packets.

  B. After the senior engineer used the above IPS logs to detect the ongoing DDOS attack, an IPS filter should be enabled to block the attack and restore communication.

  C. After the senior engineer used a mirror port to capture the ongoing amplification attack, a BGP sinkhole should be configured to drop traffic at the source networks.

  D. After the senior engineer used a packet capture to identify an active Smurf attack, an ACL should be placed on the company's external router to block incoming UDP port 19 traffic.

  Correct Answer: A

  The exhibit displays logs that are indicative of an active fraggle attack. A Fraggle attack is similar to a smurf attack in that it is a denial of service attack, but the difference is that a fraggle attack makes use of ICMP and UDP ports 7 and 19. Thus when the senior engineer uses a network analyzer to identify the attack he should contact the company's ISP to block those malicious packets.

• Question 133:

  Company XYZ has purchased and is now deploying a new HTML5 application. The company wants to hire a penetration tester to evaluate the security of the client and server components of the proprietary web application before launch. Which of the following is the penetration tester MOST likely to use while performing black box testing of the security of the company's purchased application? (Select TWO).

  A. Code review

  B. Sandbox

  C. Local proxy

  D. Fuzzer

  E. Port scanner

  Correct Answer: CD

  C: Local proxy will work by proxying traffic between the web client and the web server. This is a tool that can be put to good effect in this case.

  D: Fuzzing is another form of blackbox testing and works by feeding a program multiple input iterations that are specially written to trigger an internal error that might indicate a bug and crash it.

• Question 134:

  A security administrator wants to calculate the ROI of a security design which includes the purchase of new equipment. The equipment costs $50,000 and it will take 50 hours to install and configure the equipment. The administrator plans to hire a contractor at a rate of $100/hour to do the installation. Given that the new design and equipment will allow the company to increase revenue and make an additional $100,000 on the first year, which of the following is the ROI expressed as a percentage for the first year?

  A. -45 percent

  B. 5.5 percent

  C. 45 percent

  D. 82 percent

  Correct Answer: D

  Return on investment = Net profit / Investment

  where:Net profit = gross profit ?expenses

  investment = stock + market outstanding[when defined as?] + claims

  or

  Return on investment = (gain from investment ?cost of investment) / cost of investment Thus (100 000 ?55 000)/50 000 = 0,82 = 82 %

  References:

  Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley and Sons, Indianapolis, 2012, p. 337 http://www.financeformulas.net/Return_on_Investment.html

• Question 135:

  A security administrator notices a recent increase in workstations becoming compromised by malware. Often, the malware is delivered via drive-by downloads, from malware hosting websites, and is not being detected by the corporate antivirus. Which of the following solutions would provide the BEST protection for the company?

  A. Increase the frequency of antivirus downloads and install updates to all workstations.

  B. Deploy a cloud-based content filter and enable the appropriate category to prevent further infections.

  C. Deploy a WAF to inspect and block all web traffic which may contain malware and exploits.

  D. Deploy a web based gateway antivirus server to intercept viruses before they enter the network.

  Correct Answer: B

  The undetected malware gets delivered to the company via drive-by and malware hosing websites. Display filters and Capture filters when deployed on the cloud-based content should provide the protection required.

• Question 136:

  A human resources manager at a software development company has been tasked with recruiting personnel for a new cyber defense division in the company. This division will require personnel to have high technology skills and industry certifications. Which of the following is the BEST method for this manager to gain insight into this industry to execute the task?

  A. Interview candidates, attend training, and hire a staffing company that specializes in technology jobs

  B. Interview employees and managers to discover the industry hot topics and trends

  C. Attend meetings with staff, internal training, and become certified in software management

  D. Attend conferences, webinars, and training to remain current with the industry and job requirements

  Correct Answer: D

  Conferences represent an important method of exchanging information between researchers who are usually experts in their respective fields. Together with webinars and training to remain current on the subject the manager will be able to gain valuable insight into the cyber defense industry and be able to recruit personnel.

• Question 137:

  An accountant at a small business is trying to understand the value of a server to determine if the business can afford to buy another server for DR. The risk manager only provided the accountant with the SLE of $24,000, ARO of 20% and the exposure factor of 25%. Which of the following is the correct asset value calculated by the accountant?

  A. $4,800

  B. $24,000

  C. $96,000

  D. $120,000

  Correct Answer: C

  The annualized loss expectancy (ALE) is the product of the annual rate of occurrence (ARO) and the single loss expectancy (SLE). It is mathematically expressed as: ALE = ARO x SLE

  Single Loss Expectancy (SLE) is mathematically expressed as: Asset value (AV) x Exposure Factor (EF)

  Thus if SLE = $ 24,000 and EF = 25% then the Asset value is SLE/EF = $ 96,000

  References:

  http://www.financeformulas.net/Return_on_Investment.html https://en.wikipedia.org/wiki/Risk_assessment

• Question 138:

  A business wants to start using social media to promote the corporation and to ensure that customers have a good experience with their products. Which of the following security items should the company have in place before implementation? (Select TWO).

  A. The company must dedicate specific staff to act as social media representatives of the company.

  B. All staff needs to be instructed in the proper use of social media in the work environment.

  C. Senior staff blogs should be ghost written by marketing professionals.

  D. The finance department must provide a cost benefit analysis for social media.

  E. The security policy needs to be reviewed to ensure that social media policy is properly implemented.

  F. The company should ensure that the company has sufficient bandwidth to allow for social media traffic.

  Correct Answer: AE

• Question 139:

  A Chief Information Security Officer (CISO) has requested that a SIEM solution be implemented. The CISO wants to know upfront what the projected TCO would be before looking further into this concern. Two vendor proposals have been received:

  Vendor A: product-based solution which can be purchased by the pharmaceutical company.

  Capital expenses to cover central log collectors, correlators, storage and management consoles expected to be $150,000. Operational expenses are expected to be a 0.5 full time employee (FTE) to manage the solution, and 1 full time

  employee to respond to incidents per year.

  Vendor B: managed service-based solution which can be the outsourcer for the pharmaceutical company's needs.

  Bundled offering expected to be $100,000 per year.

  Operational expenses for the pharmaceutical company to partner with the vendor are expected to be a 0.5 FTE per year.

  Internal employee costs are averaged to be $80,000 per year per FTE. Based on calculating TCO of the two vendor proposals over a 5 year period, which of the following options is MOST accurate?

  A. Based on cost alone, having an outsourced solution appears cheaper.

  B. Based on cost alone, having an outsourced solution appears to be more expensive.

  C. Based on cost alone, both outsourced an in-sourced solutions appear to be the same.

  D. Based on cost alone, having a purchased product solution appears cheaper.

  Correct Answer: A

  The costs of making use of an outsources solution will actually be a savings for the company thus the outsourced solution is a cheaper option over a 5 year period because it amounts to 0,5 FTE per year for the company and at present the

  company expense if $80,000 per year per FTE.

  For the company to go alone it will cost $80,000 per annum per FTE = $400,000 over 5 years.

  With Vendor a $150,000 + $200,000 (?FTE) = $350,000 With Vendor B = $100,000 it will be more expensive.

  References:

  Gregg, Michael, and Billy Haines, CASP CompTIA Advanced Security Practitioner Study Guide, John Wiley and Sons, Indianapolis, 2012, p. 130

• Question 140:

  The following has been discovered in an internally developed application:

  Error - Memory allocated but not freed:

  char *myBuffer = malloc(BUFFER_SIZE);

  if (myBuffer != NULL) {

  *myBuffer = STRING_WELCOME_MESSAGE;

  printf("Welcome to: %s\n", myBuffer);

  }

  exit(0);

  Which of the following security assessment methods are likely to reveal this security weakness? (Select TWO).

  A. Static code analysis

  B. Memory dumping

  C. Manual code review

  D. Application sandboxing

  E. Penetration testing

  F. Black box testing

  Correct Answer: AC

  A Code review refers to the examination of an application (the new network based software product in this case) that is designed to identify and assess threats to the organization. Application code review ?whether manual or static will reveal the type of security weakness as shown in the exhibit.