CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 161:

  Since the implementation of IPv6 on the company network, the security administrator has been unable to identify the users associated with certain devices utilizing IPv6 addresses, even when the devices are centrally managed. en1: flags=8863 mtu 1500 ether f8:1e:af:ab:10:a3 inet6 fw80::fa1e:dfff:fee6:9d8%en1 prefixlen 64 scopeid 0x5 inet 192.168.1.14 netmask 0xffffff00 broadcast 192.168.1.255 inet6 2001:200:5:922:1035:dfff:fee6:9dfe prefixlen 64 autoconf inet6 2001:200:5:922:10ab:5e21:aa9a:6393 prefixlen 64 autoconf temporary nd6 options=1 media: autoselect status: active Given this output, which of the following protocols is in use by the company and what can the system administrator do to positively map users with IPv6 addresses in the future? (Select TWO).

  A. The devices use EUI-64 format

  B. The routers implement NDP

  C. The network implements 6to4 tunneling

  D. The router IPv6 advertisement has been disabled

  E. The administrator must disable IPv6 tunneling

  F. The administrator must disable the mobile IPv6 router flag

  G. The administrator must disable the IPv6 privacy extensions

  H. The administrator must disable DHCPv6 option code 1

  Correct Answer: BG

  IPv6 makes use of the Neighbor Discovery Protocol (NDP). Thus if your routers implement NDP you will be able to map users with IPv6 addresses. However to be able to positively map users with IPv6 addresses you will need to disable IPv6 privacy extensions.

• Question 162:

  A security analyst at Company A has been trying to convince the Information Security Officer (ISO) to allocate budget towards the purchase of a new intrusion prevention system (IPS) capable of analyzing encrypted web transactions. Which of the following should the analyst provide to the ISO to support the request? (Select TWO).

  A. Emerging threat reports

  B. Company attack trends

  C. Request for Quote (RFQ)

  D. Best practices

  E. New technologies report

  Correct Answer: AB

• Question 163:

  A data breach has occurred at Company A and as a result, the Chief Information Officer (CIO) has resigned. The CIO's laptop, cell phone and PC were all wiped of data per company policy. A month later, prosecutors in litigation with Company A suspect the CIO knew about the data breach long before it was discovered and have issued a subpoena requesting all the CIO's email from the last 12 months. The corporate retention policy recommends keeping data for no longer than 90 days. Which of the following should occur?

  A. Restore the CIO's email from an email server backup and provide the last 90 days from the date of the subpoena request.

  B. Inform the litigators that the CIOs information has been deleted as per corporate policy.

  C. Restore the CIO's email from an email server backup and provide the last 90 days from the date of the CIO resignation.

  D. Restore the CIO's email from an email server backup and provide whatever is available up to the last 12 months from the subpoena date.

  Correct Answer: D

• Question 164:

  The senior security administrator wants to redesign the company DMZ to minimize the risks associated with both external and internal threats. The DMZ design must support security in depth, change management and configuration processes, and support incident reconstruction. Which of the following designs BEST supports the given requirements?

  A. A dual firewall DMZ with remote logging where each firewall is managed by a separate administrator.

  B. A single firewall DMZ where each firewall interface is managed by a separate administrator and logging to the cloud.

  C. A SaaS based firewall which logs to the company's local storage via SSL, and is managed by the change control team.

  D. A virtualized firewall, where each virtual instance is managed by a separate administrator and logging to the same hardware.

  Correct Answer: A

  Security in depth is the concept of creating additional layers of security. The traditional approach of securing the IT infrastructure is no longer enough. Today's threats are multifaceted and often persistent, and traditional network perimeter security controls cannot effectively mitigate them. Organizations need to implement more effective, multi-level security controls that are embedded with their electronic assets. They need to protect key assets from both external and internal threats. This security in depth approach is meant to sustain attacks even when perimeter and traditional controls have been breached.

  In this question, using two firewalls to secure the DMZ from both external and internal attacks is the best approach. Having each firewall managed by a separate administrator will reduce the chance of a configuration error being made on both firewalls. The remote logging will enable incident reconstruction.

• Question 165:

  The technology steering committee is struggling with increased requirements stemming from an increase in telecommuting. The organization has not addressed telecommuting in the past. The implementation of a new SSL-VPN and a VOIP phone solution enables personnel to work from remote locations with corporate assets. Which of the following steps must the committee take FIRST to outline senior management's directives?

  A. Develop an information classification scheme that will properly secure data on corporate systems.

  B. Implement database views and constrained interfaces so remote users will be unable to access PII from personal equipment.

  C. Publish a policy that addresses the security requirements for working remotely with company equipment.

  D. Work with mid-level managers to identify and document the proper procedures for telecommuting.

  Correct Answer: C

  The question states that "the organization has not addressed telecommuting in the past". It is therefore unlikely that a company policy exists for telecommuting workers. There are many types of company policies including Working time, Equality and diversity, Change management, Employment policies, Security policies and Data Protection policies. In this question, a new method of working has been employed: remote working or telecommuting. Policies should be created to establish company security requirements (and any other requirements) for users working remotely.

• Question 166:

  Which of the following must be taken into consideration for e-discovery purposes when a legal case is first presented to a company?

  A. Data ownership on all files

  B. Data size on physical disks

  C. Data retention policies on only file servers

  D. Data recovery and storage

  Correct Answer: D

• Question 167:

  A large enterprise acquires another company which uses antivirus from a different vendor. The CISO has requested that data feeds from the two different antivirus platforms be combined in a way that allows management to assess and rate the overall effectiveness of antivirus across the entire organization. Which of the following tools can BEST meet the CISO's requirement?

  A. GRC

  B. IPS

  C. CMDB

  D. Syslog-ng

  E. IDS

  Correct Answer: A

  GRC is a discipline that aims to coordinate information and activity across governance, risk management and compliance with the purpose of operating more efficiently, enabling effective information sharing, more effectively reporting activities and avoiding wasteful overlaps. An integrated GRC (iGRC) takes data feeds from one or more sources that detect or sense abnormalities, faults or other patterns from security or business applications.

• Question 168:

  Company A is merging with Company B. Company B uses mostly hosted services from an outside vendor, while Company A uses mostly in-house products. The project manager of the merger states the merged systems should meet these goals:

  -Ability to customize systems per department

  -Quick implementation along with an immediate ROI

  -The internal IT team having administrative level control over all products

  The project manager states the in-house services are the best solution. Because of staff shortages, the senior security administrator argues that security will be best maintained by continuing to use outsourced services. Which of the following solutions BEST solves the disagreement?

  A. Raise the issue to the Chief Executive Officer (CEO) to escalate the decision to senior management with the recommendation to continue the outsourcing of all IT services.

  B. Calculate the time to deploy and support the in-sourced systems accounting for the staff shortage and compare the costs to the ROI costs minus outsourcing costs. Present the document numbers to management for a final decision.

  C. Perform a detailed cost benefit analysis of outsourcing vs. in-sourcing the IT systems and review the system documentation to assess the ROI of in-sourcing. Select COTS products to eliminate development time to meet the ROI goals.

  D. Arrange a meeting between the project manager and the senior security administrator to review the requirements and determine how critical all the requirements are.

  Correct Answer: B

• Question 169:

  A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame for whose fault it was that the incident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner?

  A. During the Identification Phase

  B. During the Lessons Learned phase

  C. During the Containment Phase

  D. During the Preparation Phase

  Correct Answer: B

  The Lessons Learned phase is the final step in the Incident Response process, when everyone involved reviews what happened and why.

• Question 170:

  The Chief Information Security Officer (CISO) at a company knows that many users store business documents on public cloud-based storage, and realizes this is a risk to the company. In response, the CISO implements a mandatory training course in which all employees are instructed on the proper use of cloud-based storage. Which of the following risk strategies did the CISO implement?

  A. Avoid

  B. Accept

  C. Mitigate

  D. Transfer

  Correct Answer: C

  Mitigation means that a control is used to reduce the risk. In this case, the control is training.