CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 141:

  A small company's Chief Executive Officer (CEO) has asked its Chief Security Officer (CSO) to improve the company's security posture quickly with regard to targeted attacks. Which of the following should the CSO conduct FIRST?

  A. Survey threat feeds from services inside the same industry.

  B. Purchase multiple threat feeds to ensure diversity and implement blocks for malicious traffic.

  C. Conduct an internal audit against industry best practices to perform a qualitative analysis.

  D. Deploy a UTM solution that receives frequent updates from a trusted industry vendor.

  Correct Answer: A

  Security posture refers to the overall security plan from planning through to implementation and comprises technical and non-technical policies, procedures and controls to protect from both internal and external threats. From a security standpoint, one of the first questions that must be answered in improving the overall security posture of an organization is to identify where data resides. All the advances that were made by technology make this very difficult. The best way then to improve your company's security posture is to first survey threat feeds from services inside the same industry.

• Question 142:

  A Chief Financial Officer (CFO) has raised concerns with the Chief Information Security Officer (CISO) because money has been spent on IT security infrastructure, but corporate assets are still found to be vulnerable. The business recently funded a patch management product and SOE hardening initiative. A third party auditor reported findings against the business because some systems were missing patches. Which of the following statements BEST describes this situation?

  A. The CFO is at fault because they are responsible for patching the systems and have already been given patch management and SOE hardening products.

  B. The audit findings are invalid because remedial steps have already been applied to patch servers and the remediation takes time to complete.

  C. The CISO has not selected the correct controls and the audit findings should be assigned to them instead of the CFO.

  D. Security controls are generally never 100% effective and gaps should be explained to stakeholders and managed accordingly.

  Correct Answer: D

  Security controls can never be run 100% effective and is mainly observed as a risk mitigation strategy thus the gaps should be explained to all stakeholders and managed accordingly.

• Question 143:

  A system worth $100,000 has an exposure factor of eight percent and an ARO of four. Which of the following figures is the system's SLE?

  A. $2,000

  B. $8,000

  C. $12,000

  D. $32,000

  Correct Answer: B

  Single Loss Expectancy (SLE) is mathematically expressed as: Asset value (AV) x Exposure Factor (EF) SLE = AV x EF = $100 000 x 8% = $ 8 000

  References:

  http://www.financeformulas.net/Return_on_Investment.html https://en.wikipedia.org/wiki/Risk_assessment

• Question 144:

  A security engineer is responsible for monitoring company applications for known vulnerabilities. Which of the following is a way to stay current on exploits and information security news?

  A. Update company policies and procedures

  B. Subscribe to security mailing lists

  C. Implement security awareness training

  D. Ensure that the organization vulnerability management plan is up-to-date

  Correct Answer: B

  Subscribing to bug and vulnerability, security mailing lists is a good way of staying abreast and keeping up to date with the latest in those fields.

• Question 145:

  News outlets are beginning to report on a number of retail establishments that are experiencing payment card data breaches. The data exfiltration is enabled by malware on a compromised computer. After the initial exploit, network mapping and fingerprinting is conducted to prepare for further exploitation. Which of the following is the MOST effective solution to protect against unrecognized malware infections?

  A. Remove local admin permissions from all users and change anti-virus to a cloud aware, push technology.

  B. Implement an application whitelist at all levels of the organization.

  C. Deploy a network based heuristic IDS, configure all layer 3 switches to feed data to the IDS for more effective monitoring.

  D. Update router configuration to pass all network traffic through a new proxy server with advanced malware detection.

  Correct Answer: B

  In essence a whitelist screening will ensure that only acceptable applications are passed / or granted access.

• Question 146:

  An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the penetration tester to MOST efficiently use any obtained administrative credentials on the client organization's other systems, without impacting the integrity of any of the systems?

  A. Use the pass the hash technique

  B. Use rainbow tables to crack the passwords

  C. Use the existing access to change the password

  D. Use social engineering to obtain the actual password

  Correct Answer: A

  With passing the hash you can grab NTLM credentials and you can manipulate the Windows logon sessions maintained by the LSA component. This will allow you to operate as an administrative user and not impact the integrity of any of the systems when running your tests.

• Question 147:

  A large company is preparing to merge with a smaller company. The smaller company has been very profitable, but the smaller company's main applications were created in-house. Which of the following actions should the large company's security administrator take in preparation for the merger?

  A. A review of the mitigations implemented from the most recent audit findings of the smaller company should be performed.

  B. An ROI calculation should be performed to determine which company's application should be used.

  C. A security assessment should be performed to establish the risks of integration or co- existence.

  D. A regression test should be performed on the in-house software to determine security risks associated with the software.

  Correct Answer: C

  With any merger regardless of the monetary benefit there is always security risks and prior to the merger the security administrator should assess the security risks to as to mitigate these.

• Question 148:

  Joe is a security architect who is tasked with choosing a new NIPS platform that has the ability to perform SSL inspection, analyze up to 10Gbps of traffic, can be centrally managed and only reveals inspected application payload data to specified internal security employees. Which of the following steps should Joe take to reach the desired outcome?

  A. Research new technology vendors to look for potential products. Contribute to an RFP and then evaluate RFP responses to ensure that the vendor product meets all mandatory requirements. Test the product and make a product recommendation.

  B. Evaluate relevant RFC and ISO standards to choose an appropriate vendor product. Research industry surveys, interview existing customers of the product and then recommend that the product be purchased.

  C. Consider outsourcing the product evaluation and ongoing management to an outsourced provider on the basis that each of the requirements are met and a lower total cost of ownership (TCO) is achieved.

  D. Choose a popular NIPS product and then consider outsourcing the ongoing device management to a cloud provider. Give access to internal security employees so that they can inspect the application payload data.

  E. Ensure that the NIPS platform can also deal with recent technological advancements, such as threats emerging from social media, BYOD and cloud storage prior to purchasing the product.

  Correct Answer: A

  A request for a Proposal (RFP) is in essence an invitation that you present to vendors asking them to submit proposals on a specific commodity or service. This should be evaluated, then the product should be tested and then a product recommendation can be made to achieve the desired outcome.

• Question 149:

  The Chief Information Security Officer (CISO) is asking for ways to protect against zero-day exploits. The CISO is concerned that an unrecognized threat could compromise corporate data and result in regulatory fines as well as poor corporate publicity. The network is mostly flat, with split staff/guest wireless functionality. Which of the following equipment MUST be deployed to guard against unknown threats?

  A. Cloud-based antivirus solution, running as local admin, with push technology for definition updates.

  B. Implementation of an offsite data center hosting all company data, as well as deployment of VDI for all client computing needs.

  C. Host based heuristic IPS, segregated on a management VLAN, with direct control of the perimeter firewall ACLs.

  D. Behavior based IPS with a communication link to a cloud based vulnerability and threat feed.

  Correct Answer: D

  Good preventive security practices are a must. These include installing and keeping firewall policies carefully matched to business and application needs, keeping antivirus software updated, blocking potentially harmful file attachments and keeping all systems patched against known vulnerabilities. Vulnerability scans are a good means of measuring the effectiveness of preventive procedures. Real-time protection: Deploy inline intrusion- prevention systems (IPS) that offer comprehensive protection. When considering an IPS, seek the following capabilities: network-level protection, application integrity checking, application protocol Request for Comment (RFC) validation, content validation and forensics capability. In this case it would be behavior-based IPS with a communication link to a cloud-based vulnerability and threat feed.

• Question 150:

  As part of a new wireless implementation, the Chief Information Officer's (CIO's) main objective is to immediately deploy a system that supports the 802.11r standard, which will help wireless VoIP devices in moving vehicles. However, the 802.11r standard was not ratified by the IETF. The wireless vendor's products do support the pre-ratification version of 802.11r. The security and network administrators have tested the product and do not see any security or compatibility issues; however, they are concerned that the standard is not yet final. Which of the following is the BEST way to proceed?

  A. Purchase the equipment now, but do not use 802.11r until the standard is ratified.

  B. Do not purchase the equipment now as the client devices do not yet support 802.11r.

  C. Purchase the equipment now, as long as it will be firmware upgradeable to the final 802.11r standard.

  D. Do not purchase the equipment now; delay the implementation until the IETF has ratified the final 802.11r standard.

  Correct Answer: C