CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 181:

  The sales division within a large organization purchased touch screen tablet computers for all 250 sales representatives in an effort to showcase the use of technology to its customers and increase productivity. This includes the development of a new product tracking application that works with the new platform. The security manager attempted to stop the deployment because the equipment and application are non-standard and unsupported within the organization. However, upper management decided to continue the deployment. Which of the following provides the BEST method for evaluating the potential threats?

  A. Conduct a vulnerability assessment to determine the security posture of the new devices and the application.

  B. Benchmark other organizations that already encountered this type of situation and apply all relevant learnings and industry best practices.

  C. Work with the business to understand and classify the risk associated with the full lifecycle of the hardware and software deployment.

  D. Develop a standard image for the new devices and migrate to a web application to eliminate locally resident data.

  Correct Answer: C

• Question 182:

  A user is suspected of engaging in potentially illegal activities. Law enforcement has requested that the user continue to operate on the network as normal. However, they would like to have a copy of any communications from the user involving certain key terms. Additionally, the law enforcement agency has requested that the user's ongoing communication be retained in the user's account for future investigations. Which of the following will BEST meet the goals of law enforcement?

  A. Begin a chain-of-custody on for the user's communication. Next, place a legal hold on the user's email account.

  B. Perform an e-discover using the applicable search terms. Next, back up the user's email for a future investigation.

  C. Place a legal hold on the user's email account. Next, perform e-discovery searches to collect applicable emails.

  D. Perform a back up of the user's email account. Next, export the applicable emails that match the search terms.

  Correct Answer: C

  A legal hold is a process that an organization uses to maintain all forms of pertinent information when legal action is reasonably expected. E-discovery refers to discovery in litigation or government investigations that manages the exchange of electronically stored information (ESI). ESI includes email and office documents, photos, video, databases, and other filetypes.

• Question 183:

  An insurance company is looking to purchase a smaller company in another country. Which of the following tasks would the security administrator perform as part of the security due diligence?

  A. Review switch and router configurations

  B. Review the security policies and standards

  C. Perform a network penetration test

  D. Review the firewall rule set and IPS logs

  Correct Answer: B

  IT security professionals should have a chance to review the security controls and practices of a company targeted for acquisition. Any irregularities that are found should be reported to management so that expenses and concerns are properly identified.

• Question 184:

  The Chief Executive Officer (CEO) of a corporation purchased the latest mobile device and wants to connect it to the company's internal network. The Chief Information Security Officer (CISO) was told to research and recommend how to secure this device. Which of the following recommendations should be implemented to keep the device from posing a security risk to the company?

  A. A corporate policy to prevent sensitive information from residing on a mobile device and anti-virus software.

  B. Encryption of the non-volatile memory and a corporate policy to prevent sensitive information from residing on a mobile device.

  C. Encryption of the non-volatile memory and a password or PIN to access the device.

  D. A password or PIN to access the device and a corporate policy to prevent sensitive information from residing on a mobile device.

  Correct Answer: C

• Question 185:

  It has come to the IT administrator's attention that the "post your comment" field on the company blog page has been exploited, resulting in cross-site scripting attacks against customers reading the blog. Which of the following would be the MOST effective at preventing the "post your comment" field from being exploited?

  A. Update the blog page to HTTPS

  B. Filter metacharacters

  C. Install HIDS on the server

  D. Patch the web application

  E. Perform client side input validation

  Correct Answer: B

  A general rule of thumb with regards to XSS is to "Never trust user input and always filter meta-characters."

• Question 186:

  A risk manager has decided to use likelihood and consequence to determine the risk of an event occurring to a company asset. Which of the following is a limitation of this approach to risk management?

  A. Subjective and based on an individual's experience.

  B. Requires a high degree of upfront work to gather environment details.

  C. Difficult to differentiate between high, medium, and low risks.

  D. Allows for cost and benefit analysis.

  E. Calculations can be extremely complex to manage.

  Correct Answer: A

  Using likelihood and consequence to determine risk is known as qualitative risk analysis. With qualitative risk analysis, the risk would be evaluated for its probability and impact using a numbered ranking system such as low, medium, and high

  or perhaps using a 1 to 10 scoring system.

  After qualitative analysis has been performed, you can then perform quantitative risk analysis. A Quantitative risk analysis is a further analysis of the highest priority risks during which a numerical or quantitative rating is assigned to the risk.

  Qualitative risk analysis is usually quick to perform and no special tools or software is required. However, qualitative risk analysis is subjective and based on the user's experience.

• Question 187:

  An assessor identifies automated methods for identifying security control compliance through validating sensors at the endpoint and at Tier 2. Which of the following practices satisfy continuous monitoring of authorized information systems?

  A. Independent verification and validation

  B. Security test and evaluation

  C. Risk assessment

  D. Ongoing authorization

  Correct Answer: D

  Ongoing assessment and authorization is often referred to as continuous monitoring. It is a process that determines whether the set of deployed security controls in an information system continue to be effective with regards to planned and

  unplanned changes that occur in the system and its environment over time.

  Continuous monitoring allows organizations to evaluate the operating effectiveness of controls on or near a real-time basis. Continuous monitoring enables the enterprise to detect control failures quickly because it transpires immediately or

  closely after events in which the key controls are utilized.

• Question 188:

  An insurance company has an online quoting system for insurance premiums. It allows potential customers to fill in certain details about their car and obtain a quote. During an investigation, the following patterns were detected:

  Pattern 1 ?Analysis of the logs identifies that insurance premium forms are being filled in but only single fields are incrementally being updated.

  Pattern 2 ?For every quote completed, a new customer number is created; due to legacy systems, customer numbers are running out.

  Which of the following is the attack type the system is susceptible to, and what is the BEST way to defend against it? (Select TWO).

  A. Apply a hidden field that triggers a SIEM alert

  B. Cross site scripting attack

  C. Resource exhaustion attack

  D. Input a blacklist of all known BOT malware IPs into the firewall

  E. SQL injection

  F. Implement an inline WAF and integrate into SIEM

  G. Distributed denial of service

  H. Implement firewall rules to block the attacking IP addresses

  Correct Answer: CF

  A resource exhaustion attack involves tying up predetermined resources on a system, thereby making the resources unavailable to others.

  Implementing an inline WAF would allow for protection from attacks, as well as log and alert admins to what's going on. Integrating in into SIEM allows for logs and other security- related documentation to be collected for analysis.

• Question 189:

  A health service provider is considering the impact of allowing doctors and nurses access to the internal email system from their personal smartphones. The Information Security Officer (ISO) has received a technical document from the security administrator explaining that the current email system is capable of enforcing security policies to personal smartphones, including screen lockout and mandatory PINs. Additionally, the system is able to remotely wipe a phone if reported lost or stolen. Which of the following should the Information Security Officer be MOST concerned with based on this scenario? (Select THREE).

  A. The email system may become unavailable due to overload.

  B. Compliance may not be supported by all smartphones.

  C. Equipment loss, theft, and data leakage.

  D. Smartphone radios can interfere with health equipment.

  E. Data usage cost could significantly increase.

  F. Not all smartphones natively support encryption.

  G. Smartphones may be used as rogue access points.

  Correct Answer: BCF

• Question 190:

  A security manager for a service provider has approved two vendors for connections to the service provider backbone. One vendor will be providing authentication services for its payment card service, and the other vendor will be providing maintenance to the service provider infrastructure sites. Which of the following business agreements is MOST relevant to the vendors and service provider's relationship?

  A. Memorandum of Agreement

  B. Interconnection Security Agreement

  C. Non-Disclosure Agreement

  D. Operating Level Agreement

  Correct Answer: B

  The Interconnection Security Agreement (ISA) is a document that identifies the requirements for connecting systems and networks and details what security controls are to be used to protect the systems and sensitive data.