CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 201:

  A firm's Chief Executive Officer (CEO) is concerned that IT staff lacks the knowledge to identify complex vulnerabilities that may exist in a payment system being internally developed. The payment system being developed will be sold to a number of organizations and is in direct competition with another leading product. The CEO highlighted that code base confidentiality is of critical importance to allow the company to exceed the competition in terms of the product's reliability, stability, and performance. Which of the following would provide the MOST thorough testing and satisfy the CEO's requirements?

  A. Sign a MOU with a marketing firm to preserve the company reputation and use in-house resources for random testing.

  B. Sign a BPA with a small software consulting firm and use the firm to perform Black box testing and address all findings.

  C. Sign a NDA with a large security consulting firm and use the firm to perform Grey box testing and address all findings.

  D. Use the most qualified and senior developers on the project to perform a variety of White box testing and code reviews.

  Correct Answer: C

  Gray box testing has limited knowledge of the system as an attacker would. The base code would remain confidential. This would further be enhanced by a Non-disclosure agreement (NDA) which is designed to protect confidential information.

• Question 202:

  A security auditor suspects two employees of having devised a scheme to steal money from the company. While one employee submits purchase orders for personal items, the other employee approves these purchase orders. The auditor has contacted the human resources director with suggestions on how to detect such illegal activities. Which of the following should the human resource director implement to identify the employees involved in these activities and reduce the risk of this activity occurring in the future?

  A. Background checks

  B. Job rotation

  C. Least privilege

  D. Employee termination procedures

  Correct Answer: B

  Job rotation can reduce fraud or misuse by preventing an individual from having too much control over an area.

• Question 203:

  The internal audit department is investigating a possible breach of security. One of the auditors is sent to interview the following employees:

  Employee A: Works in the accounts receivable office and is in charge of entering data into the finance system.

  Employee B: Works in the accounts payable office and is in charge of approving purchase orders.

  Employee C: Is the manager of the finance department, supervises Employee A and Employee B, and can perform the functions of both Employee A and Employee B.

  Which of the following should the auditor suggest be done to avoid future security breaches?

  A. All employees should have the same access level to be able to check on each others.

  B. The manager should only be able to review the data and approve purchase orders.

  C. Employee A and Employee B should rotate jobs at a set interval and cross-train.

  D. The manager should be able to both enter and approve information.

  Correct Answer: B

• Question 204:

  The network administrator at an enterprise reported a large data leak. One compromised server was used to aggregate data from several critical application servers and send it out to the Internet using HTTPS. Upon investigation, there have been no user logins over the previous week and the endpoint protection software is not reporting any issues. Which of the following BEST provides insight into where the compromised server collected the information?

  A. Review the flow data against each server's baseline communications profile.

  B. Configure the server logs to collect unusual activity including failed logins and restarted services.

  C. Correlate data loss prevention logs for anomalous communications from the server.

  D. Setup a packet capture on the firewall to collect all of the server communications.

  Correct Answer: A

  Network logging tools such as Syslog, DNS, NetFlow, behavior analytics, IP reputation, honeypots, and DLP solutions provide visibility into the entire infrastructure. This visibility is important because signature-based systems are no longer sufficient for identifying the advanced attacker that relies heavily on custom malware and zero-day exploits. Having knowledge of each host's communications, protocols, and traffic volumes as well as the content of the data in question is key to identifying zero-day and APT (advance persistent threat) malware and agents. Data intelligence allows forensic analysis to identify anomalous or suspicious communications by comparing suspected traffic patterns against normal data communication behavioral baselines. Automated network intelligence and next-generation live forensics provide insight into network events and rely on analytical decisions based on known vs. unknown behavior taking place within a corporate network.

• Question 205:

  An organization determined that each of its remote sales representatives must use a smartphone for email access. The organization provides the same centrally manageable model to each person. Which of the following mechanisms BEST protects the confidentiality of the resident data?

  A. Require dual factor authentication when connecting to the organization's email server.

  B. Require each sales representative to establish a PIN to access the smartphone and limit email storage to two weeks.

  C. Require encrypted communications when connecting to the organization's email server.

  D. Require a PIN and automatic wiping of the smartphone if someone enters a specific number of incorrect PINs.

  Correct Answer: D

• Question 206:

  The Chief Executive Officer (CEO) of a company that allows telecommuting has challenged the Chief Security Officer's (CSO) request to harden the corporate network's perimeter. The CEO argues that the company cannot protect its employees at home, so the risk at work is no different. Which of the following BEST explains why this company should proceed with protecting its corporate network boundary?

  A. The corporate network is the only network that is audited by regulators and customers.

  B. The aggregation of employees on a corporate network makes it a more valuable target for attackers.

  C. Home networks are unknown to attackers and less likely to be targeted directly.

  D. Employees are more likely to be using personal computers for general web browsing when they are at home.

  Correct Answer: B

  Data aggregation is any process in which information is gathered and expressed in a summary form, for purposes such as statistical analysis. Data aggregation increases the impact and scale of a security breach. The amount of data aggregation on the corporate network is much more that on an employee's home network, and is therefore more valuable.

• Question 207:

  The finance department for an online shopping website has discovered that a number of customers were able to purchase goods and services without any payments. Further analysis conducted by the security investigations team indicated that the website allowed customers to update a payment amount for shipping. A specially crafted value could be entered and cause a roll over, resulting in the shipping cost being subtracted from the balance and in some instances resulted in a negative balance. As a result, the system processed the negative balance as zero dollars. Which of the following BEST describes the application issue?

  A. Race condition

  B. Click-jacking

  C. Integer overflow

  D. Use after free

  E. SQL injection

  Correct Answer: C

  Integer overflow errors can occur when a program fails to account for the fact that an arithmetic operation can result in a quantity either greater than a data type's maximum value or less than its minimum value.

• Question 208:

  Which of the following activities could reduce the security benefits of mandatory vacations?

  A. Have a replacement employee run the same applications as the vacationing employee.

  B. Have a replacement employee perform tasks in a different order from the vacationing employee.

  C. Have a replacement employee perform the job from a different workstation than the vacationing employee.

  D. Have a replacement employee run several daily scripts developed by the vacationing employee.

  Correct Answer: D

• Question 209:

  A security officer is leading a lessons learned meeting. Which of the following should be components of that meeting? (Select TWO).

  A. Demonstration of IPS system

  B. Review vendor selection process

  C. Calculate the ALE for the event

  D. Discussion of event timeline

  E. Assigning of follow up items

  Correct Answer: DE

  Lessons learned process is the sixth step in the Incident Response process. Everybody that was involved in the process reviews what happened and why it happened. It is during this step that they determine what changes should be introduced to prevent future problems.

• Question 210:

  Anne, the security administrator, at a company has received a subpoena for the release of all the email received and sent by the company Chief Information Officer (CIO) for the past three years. Anne is only able to find one year's worth of email records on the server and is now concerned about the possible legal implications of not complying with the request. Which of the following should Anne check BEFORE responding to the request?

  A. The company data privacy policies

  B. The company backup logs and archives

  C. The company data retention policies and guidelines

  D. The company data retention procedures

  Correct Answer: B