CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 251:

  An enterprise must ensure that all devices that connect to its networks have been previously approved. The solution must support dual factor mutual authentication with strong identity assurance. In order to reduce costs and administrative overhead, the security architect wants to outsource identity proofing and second factor digital delivery to the third party. Which of the following solutions will address the enterprise requirements?

  A. Implementing federated network access with the third party.

  B. Using a HSM at the network perimeter to handle network device access.

  C. Using a VPN concentrator which supports dual factor via hardware tokens.

  D. Implementing 802.1x with EAP-TTLS across the infrastructure.

  Correct Answer: D

  IEEE 802.1X (also known as Dot1x) is an IEEE Standard for Port-based Network Access Control (PNAC). It is part of the IEEE 802.1 group of networking protocols. It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.

  802.1X authentication involves three parties: a supplicant, an authenticator, and an authentication server. The supplicant is a client device (such as a laptop) that wishes to attach to the LAN/WLAN - though the term 'supplicant' is also used interchangeably to refer to the software running on the client that provides credentials to the authenticator. The authenticator is a network device, such as an Ethernet switch or wireless access point; and the authentication server is typically a host running software supporting the RADIUS and EAP protocols. The authenticator acts like a security guard to a protected network. The supplicant (i.e., client device) is not allowed access through the authenticator to the protected side of the network until the supplicant's identity has been validated and authorized. An analogy to this is providing a valid visa at the airport's arrival immigration before being allowed to enter the country. With 802.1X port-based authentication, the supplicant provides credentials, such as user name/password or digital certificate, to the authenticator, and the authenticator forwards the credentials to the authentication server for verification. If the authentication server determines the credentials are valid, the supplicant (client device) is allowed to access resources located on the protected side of the network.

  EAP-TTLS (Tunneled Transport Layer Security) is designed to provide authentication that is as strong as EAP-TLS, but it does not require that each user be issued a certificate. Instead, only the authentication servers are issued certificates. User authentication is performed by password, but the password credentials are transported in a securely encrypted tunnel established based upon the server certificates.

• Question 252:

  ABC Company must achieve compliance for PCI and SOX. Which of the following would BEST allow the organization to achieve compliance and ensure security? (Select THREE).

  A. Establish a list of users that must work with each regulation

  B. Establish a list of devices that must meet each regulation

  C. Centralize management of all devices on the network

  D. Compartmentalize the network

  E. Establish a company framework

  F. Apply technical controls to meet compliance with the regulation

  Correct Answer: BDF

  Payment card industry (PCI) compliance is adherence to a set of specific security standards that were developed to protect card information during and after a financial transaction. PCI compliance is required by all card brands.

  There are six main requirements for PCI compliance. The vendor must:

  Build and maintain a secure network

  Protect cardholder data

  Maintain a vulnerability management program

  Implement strong access control measures

  Regularly monitor and test networks

  Maintain an information security policy

  To achieve PCI and SOX compliance you should:

  Establish a list of devices that must meet each regulation. List all the devices that contain the sensitive data.

  Compartmentalize the network. Compartmentalize the devices that contain the sensitive data to form a security boundary.

  Apply technical controls to meet compliance with the regulation. Secure the data as required.

• Question 253:

  An administrator has four virtual guests on a host server. Two of the servers are corporate SQL servers, one is a corporate mail server, and one is a testing web server for a small group of developers. The administrator is experiencing difficulty connecting to the host server during peak network usage times. Which of the following would allow the administrator to securely connect to and manage the host server during peak usage times?

  A. Increase the virtual RAM allocation to high I/O servers.

  B. Install a management NIC and dedicated virtual switch.

  C. Configure the high I/O virtual servers to use FCoE rather than iSCSI.

  D. Move the guest web server to another dedicated host.

  Correct Answer: B

• Question 254:

  A company runs large computing jobs only during the overnight hours. To minimize the amount of capital investment in equipment, the company relies on the elastic computing services of a major cloud computing vendor. Because the virtual resources are created and destroyed on the fly across a large pool of shared resources, the company never knows which specific hardware platforms will be used from night to night. Which of the following presents the MOST risk to confidentiality in this scenario?

  A. Loss of physical control of the servers

  B. Distribution of the job to multiple data centers

  C. Network transmission of cryptographic keys

  D. Data scraped from the hardware platforms

  Correct Answer: D

• Question 255:

  Company XYZ finds itself using more cloud-based business tools, and password management is becoming onerous. Security is important to the company; as a result, password replication and shared accounts are not acceptable. Which of the following implementations addresses the distributed login with centralized authentication and has wide compatibility among SaaS vendors?

  A. Establish a cloud-based authentication service that supports SAML.

  B. Implement a new Diameter authentication server with read-only attestation.

  C. Install a read-only Active Directory server in the corporate DMZ for federation.

  D. Allow external connections to the existing corporate RADIUS server.

  Correct Answer: A

  There is widespread adoption of SAML standards by SaaS vendors for single sign-on identity management, in response to customer demands for fast, simple and secure employee, customer and partner access to applications in their environments. By eliminating all passwords and instead using digital signatures for authentication and authorization of data access, SAML has become the Gold Standard for single sign-on into cloud applications. SAML-enabled SaaS applications are easier and quicker to user provision in complex enterprise environments, are more secure and help simplify identity management across large and diverse user communities.

  Security Assertion Markup Language (SAML) is an XML-based, open-standard data format for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. The SAML specification defines three roles: the principal (typically a user), the Identity provider (IdP), and the service provider (SP). In the use case addressed by SAML, the principal requests a service from the service provider. The service provider requests and obtains an identity assertion from the identity provider. On the basis of this assertion, the service provider can make an access control decision ?in other words it can decide whether to perform some service for the connected principal.

• Question 256:

  A bank is in the process of developing a new mobile application. The mobile client renders content and communicates back to the company servers via REST/JSON calls. The bank wants to ensure that the communication is stateless between the mobile application and the web services gateway. Which of the following controls MUST be implemented to enable stateless communication?

  A. Generate a one-time key as part of the device registration process.

  B. Require SSL between the mobile application and the web services gateway.

  C. The jsession cookie should be stored securely after authentication.

  D. Authentication assertion should be stored securely on the client.

  Correct Answer: D

  JSON Web Tokens (JWTs) are a great mechanism for persisting authentication information in a verifiable and stateless way, but that token still needs to be stored somewhere. Login forms are one of the most common attack vectors. We

  want the user to give us a username and password, so we know who they are and what they have access to. We want to remember who the user is, allowing them to use the UI without having to present those credentials a second time. And

  we want to do all that securely. How can JWTs help? The traditional solution is to put a session cookie in the user's browser. This cookie contains an identifier that references a "session" in your server, a place in your database where the

  server remembers who this user is.

  However there are some drawbacks to session identifiers:

  They're stateful. Your server has to remember that ID, and look it up for every request. This can become a burden with large systems.

  They're opaque. They have no meaning to your client or your server. Your client doesn't know what it's allowed to access, and your server has to go to a database to figure out who this session is for and if they are allowed to perform the

  requested operation.

  JWTs address all of these concerns by being a self-contained, signed, and stateless authentication assertion that can be shared amongst services with a common data format. JWTs are self-contained strings signed with a secret key. They

  contain a set of claims that assert an identity and a scope of access. They can be stored in cookies, but all those rules still apply. In fact, JWTs can replace your opaque session identifier, so it's a complete win.

  How To Store JWTs In The Browser

  Short answer: use cookies, with the HttpOnly; Secure flags. This will allow the browser to send along the token for authentication purposes, but won't expose it to the JavaScript environment.

• Question 257:

  An administrator has enabled salting for users' passwords on a UNIX box. A penetration tester must attempt to retrieve password hashes. Which of the following files must the penetration tester use to eventually obtain passwords on the system? (Select TWO).

  A. /etc/passwd

  B. /etc/shadow

  C. /etc/security

  D. /etc/password

  E. /sbin/logon

  F. /bin/bash

  Correct Answer: AB

  In cryptography, a salt is random data that is used as an additional input to a one-way function that hashes a password or passphrase. In this question, enabling salting for users' passwords means to store the passwords in an encrypted format.

  Traditional Unix systems keep user account information, including one-way encrypted passwords, in a text file called ``/etc/passwd''. As this file is used by many tools (such as ``ls'') to display file ownerships, etc. by matching user id #'s with the user's names, the file needs to be world-readable. Consequentially, this can be somewhat of a security risk. Another method of storing account information is with the shadow password format. As with the traditional method, this method stores account information in the /etc/passwd file in a compatible format. However, the password is stored as a single "x" character (ie. not actually stored in this file). A second file, called ``/etc/shadow'', contains encrypted password as well as other information such as account or password expiration values, etc.

• Question 258:

  The administrator is troubleshooting availability issues on an FCoE-based storage array that uses deduplication. The single controller in the storage array has failed, so the administrator wants to move the drives to a storage array from a different manufacturer in order to access the data. Which of the following issues may potentially occur?

  A. The data may not be in a usable format.

  B. The new storage array is not FCoE based.

  C. The data may need a file system check.

  D. The new storage array also only has a single controller.

  Correct Answer: B

  Fibre Channel over Ethernet (FCoE) is a computer network technology that encapsulates Fibre Channel frames over Ethernet networks. This allows Fibre Channel to use 10 Gigabit Ethernet networks (or higher speeds) while preserving the Fibre Channel protocol. When moving the disks to another storage array, you need to ensure that the array supports FCoE, not just regular Fiber Channel. Fiber Channel arrays and Fiber Channel over Ethernet arrays use different network connections, hardware and protocols. Fiber Channel arrays use the Fiber Channel protocol over a dedicated Fiber Channel network whereas FCoE arrays use the Fiber Channel protocol over an Ethernet network.

• Question 259:

  A user has a laptop configured with multiple operating system installations. The operating systems are all installed on a single SSD, but each has its own partition and logical volume. Which of the following is the BEST way to ensure confidentiality of individual operating system data?

  A. Encryption of each individual partition

  B. Encryption of the SSD at the file level

  C. FDE of each logical volume on the SSD

  D. FDE of the entire SSD as a single disk

  Correct Answer: A

  In this question, we have multiple operating system installations on a single disk. Some operating systems store their boot loader in the MBR of the disk. However, some operating systems install their boot loader outside the MBR especially when multiple operating systems are installed. We need to encrypt as much data as possible but we cannot encrypt the boot loaders. This would prevent the operating systems from loading. Therefore, the solution is to encrypt each individual partition separately.

• Question 260:

  An administrator wants to enable policy based flexible mandatory access controls on an open source OS to prevent abnormal application modifications or executions. Which of the following would BEST accomplish this?

  A. Access control lists

  B. SELinux

  C. IPtables firewall

  D. HIPS

  Correct Answer: B

  The most common open source operating system is LINUX. Security-Enhanced Linux (SELinux) was created by the United States National Security Agency (NSA) and is a Linux kernel security module that provides a mechanism for supporting access control security policies, including United States Department of Defense璼tyle mandatory access controls (MAC). NSA Security-enhanced Linux is a set of patches to the Linux kernel and some utilities to incorporate a strong, flexible mandatory access control (MAC) architecture into the major subsystems of the kernel. It provides an enhanced mechanism to enforce the separation of information based on confidentiality and integrity requirements, which allows threats of tampering and bypassing of application security mechanisms to be addressed and enables the confinement of damage that can be caused by malicious or flawed applications.