CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 261:

  In order for a company to boost profits by implementing cost savings on non-core business activities, the IT manager has sought approval for the corporate email system to be hosted in the cloud. The compliance officer has been tasked with ensuring that data lifecycle issues are taken into account. Which of the following BEST covers the data lifecycle end- to-end?

  A. Creation and secure destruction of mail accounts, emails, and calendar items

  B. Information classification, vendor selection, and the RFP process

  C. Data provisioning, processing, in transit, at rest, and de-provisioning

  D. Securing virtual environments, appliances, and equipment that handle email

  Correct Answer: C

• Question 262:

  A developer has implemented a piece of client-side JavaScript code to sanitize a user's provided input to a web page login screen. The code ensures that only the upper case and lower case letters are entered in the username field, and that only a 6-digit PIN is entered in the password field. A security administrator is concerned with the following web server log:

  10.235.62.11 ?- [02/Mar/2014:06:13:04] "GET /site/script.php?user=adminandpass=pass%20or%201=1 HTTP/1.1" 200 5724

  Given this log, which of the following is the security administrator concerned with and which fix should be implemented by the developer?

  A. The security administrator is concerned with nonprintable characters being used to gain administrative access, and the developer should strip all nonprintable characters.

  B. The security administrator is concerned with XSS, and the developer should normalize Unicode characters on the browser side.

  C. The security administrator is concerned with SQL injection, and the developer should implement server side input validation.

  D. The security administrator is concerned that someone may log on as the administrator, and the developer should ensure strong passwords are enforced.

  Correct Answer: C

  The code in the question is an example of a SQL Injection attack. The code `1=1' will always provide a value of true. This can be included in statement designed to return all rows in a SQL table. In this question, the administrator has implemented client-side input validation. Client-side validation can be bypassed. It is much more difficult to bypass server-side input validation.

  SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

• Question 263:

  A security administrator wants to deploy a dedicated storage solution which is inexpensive, can natively integrate with AD, allows files to be selectively encrypted and is suitable for a small number of users at a satellite office. Which of the following would BEST meet the requirement?

  A. SAN

  B. NAS

  C. Virtual SAN

  D. Virtual storage

  Correct Answer: B

  A NAS is an inexpensive storage solution suitable for small offices. Individual files can be encrypted by using the EFS (Encrypted File System) functionality provided by the NTFS file system.

  NAS typically uses a common Ethernet network and can provide storage services to any authorized devices on that network. Two primary NAS protocols are used in most environments. The choice of protocol depends largely on the type of computer or server connecting to the storage. Network File System (NFS) protocol usually used by servers to access storage in a NAS environment. Common Internet File System (CIFS), also sometimes called Server Message Block (SMB), is usually used for desktops, especially those running Microsoft Windows. Unlike DAS and SAN, NAS is a file-level storage technology. This means the NAS appliance maintains and controls the files, folder structures, permission, and attributes of the data it holds. A typical NAS deployment integrates the NAS appliance with a user database, such as Active Directory, so file permissions can be assigned based on established users and groups. With Active Directory integration, most Windows New Technology File System (NTFS) permissions can be set on the files contained on a NAS device.

• Question 264:

  A company that must comply with regulations is searching for a laptop encryption product to use for its 40,000 end points. The product must meet regulations but also be flexible enough to minimize overhead and support in regards to password resets and lockouts. Which of the following implementations would BEST meet the needs?

  A. A partition-based software encryption product with a low-level boot protection and authentication

  B. A container-based encryption product that allows the end users to select which files to encrypt

  C. A full-disk hardware-based encryption product with a low-level boot protection and authentication

  D. A file-based encryption product using profiles to target areas on the file system to encrypt

  Correct Answer: D

  The question is asking for a solution that will minimize overhead and support in regards to password resets and lockouts.

  File based encryption products operate under the context of the computer user's user account. This means that the user does not need to remember a separate password for the encryption software. If the user forgets his user account

  password or is locked out due to failed login attempts, the support department can reset his password from a central database of user accounts (such as Active Directory) without the need to visit the user's computer.

  Profiles can be used to determine areas on the file system to encrypt such as Document folders.

• Question 265:

  A security administrator was doing a packet capture and noticed a system communicating with an unauthorized address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network.

  Which of the following is the BEST course of action?

  A. Investigate the network traffic and block UDP port 3544 at the firewall

  B. Remove the system from the network and disable IPv6 at the router

  C. Locate and remove the unauthorized 6to4 relay from the network

  D. Disable the switch port and block the 2001::/32 traffic at the firewall

  Correct Answer: A

  The 2001::/32 prefix is used for Teredo tunneling. Teredo is a transition technology that gives full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 Internet but have no native connection to an IPv6 network. Unlike similar protocols,

  it can perform its function even from behind network address translation (NAT) devices such as home routers.

  Teredo provides IPv6 (Internet Protocol version 6) connectivity by encapsulating IPv6 datagram packets within IPv4 User Datagram Protocol (UDP) packets. Teredo routes these datagrams on the IPv4 Internet and through NAT devices.

  Teredo nodes elsewhere on the IPv6 network (called Teredo relays) receive the packets, decapsulate them, and pass them on. The Teredo server listens on UDP port 3544.

  Teredo clients are assigned an IPv6 address that starts with the Teredo prefix (2001::/32). In this question, the BEST course of action would be to block UDP port 3544 at the firewall. This will block the unauthorized communication. You can

  then investigate the traffic within the network.

• Question 266:

  Which of the following represents important technical controls for securing a SAN storage infrastructure? (Select TWO).

  A. Synchronous copy of data

  B. RAID configuration

  C. Data de-duplication

  D. Storage pool space allocation

  E. Port scanning

  F. LUN masking/mapping

  G. Port mapping

  Correct Answer: FG

  A logical unit number (LUN) is a unique identifier that designates individual hard disk devices or grouped devices for address by a protocol associated with a SCSI, iSCSI, Fibre Channel (FC) or similar interface. LUNs are central to the

  management of block storage arrays shared over a storage area network (SAN).

  LUN masking subdivides access to a given port. Then, even if several LUNs are accessed through the same port, the server masks can be set to limit each server's access to the appropriate LUNs. LUN masking is typically conducted at the

  host bus adapter (HBA) or switch level.

  Port mapping is used in `Zoning'. In storage networking, Fibre Channel zoning is the partitioning of a Fibre Channel fabric into smaller subsets to restrict interference, add security, and to simplify management. While a SAN makes available

  several devices and/or ports to a single device, each system connected to the SAN should only be allowed access to a controlled subset of these devices/ports. Zoning can be applied to either the switch port a device is connected to OR the

  WWN World Wide Name on the host being connected. As port based zoning restricts traffic flow based on the specific switch port a device is connected to, if the device is moved, it will lose access. Furthermore, if a different device is

  connected to the port in question, it will gain access to any resources the previous host had access to.

• Question 267:

  A company provides on-demand virtual computing for a sensitive project. The company implements a fully virtualized datacenter and terminal server access with two-factor authentication for access to sensitive data. The security administrator at the company has uncovered a breach in data confidentiality. Sensitive data was found on a hidden directory within the hypervisor. Which of the following has MOST likely occurred?

  A. A stolen two factor token and a memory mapping RAM exploit were used to move data from one virtual guest to an unauthorized similar token.

  B. An employee with administrative access to the virtual guests was able to dump the guest memory onto their mapped disk.

  C. A host server was left un-patched and an attacker was able to use a VMEscape attack to gain unauthorized access.

  D. A virtual guest was left un-patched and an attacker was able to use a privilege escalation attack to gain unauthorized access.

  Correct Answer: C

• Question 268:

  A penetration tester is inspecting traffic on a new mobile banking application and sends the following web request:

  POST http://www.example.com/resources/NewBankAccount HTTP/1.1

  Content-type: application/json

  {

  "account":

  [

  { "creditAccount":"Credit Card Rewards account"}

  { "salesLeadRef":"www.example.com/badcontent/exploitme.exe"}

  ],

  "customer":

  [

  { "name":"Joe Citizen"}

  { "custRef":"3153151"}

  ]

  }

  The banking website responds with:

  HTTP/1.1 200 OK

  {

  "newAccountDetails":

  [

  { "cardNumber":"1234123412341234"}

  { "cardExpiry":"2020-12-31"}

  { "cardCVV":"909"}

  ],

  "marketingCookieTracker":"JSESSIONID=000000001"

  "returnCode":"Account added successfully"

  }

  Which of the following are security weaknesses in this example? (Select TWO).

  A. Missing input validation on some fields

  B. Vulnerable to SQL injection

  C. Sensitive details communicated in clear-text

  D. Vulnerable to XSS

  E. Vulnerable to malware file uploads

  F. JSON/REST is not as secure as XML

  Correct Answer: AC

  The SalesLeadRef field has no input validation. The penetration tester should not be able to enter "www.example.com/badcontent/exploitme.exe" in this field. The credit card numbers are communicated in clear text which makes it vulnerable to an attacker. This kind of information should be encrypted.

• Question 269:

  A data processing server uses a Linux based file system to remotely mount physical disks on a shared SAN. The server administrator reports problems related to processing of files where the file appears to be incompletely written to the disk. The network administration team has conducted a thorough review of all network infrastructure and devices and found everything running at optimal performance. Other SAN customers are unaffected. The data being processed consists of millions of small files being written to disk from a network source one file at a time. These files are then accessed by a local Java program for processing before being transferred over the network to a SELinux host for processing. Which of the following is the MOST likely cause of the processing problem?

  A. The administrator has a PERL script running which disrupts the NIC by restarting the CRON process every 65 seconds.

  B. The Java developers accounted for network latency only for the read portion of the processing and not the write process.

  C. The virtual file system on the SAN is experiencing a race condition between the reads and writes of network files.

  D. The Linux file system in use cannot write files as fast as they can be read by the Java program resulting in the errors.

  Correct Answer: D

• Question 270:

  The risk manager has requested a security solution that is centrally managed, can easily be updated, and protects end users' workstations from both known and unknown malicious attacks when connected to either the office or home network. Which of the following would BEST meet this requirement?

  A. HIPS

  B. UTM

  C. Antivirus

  D. NIPS

  E. DLP

  Correct Answer: A

  In this question, we need to protect the workstations when connected to either the office or home network. Therefore, we need a solution that stays with the workstation when the user takes the computer home.

  A HIPS (Host Intrusion Prevention System) is software installed on a host which monitors the host for suspicious activity by analyzing events occurring within that host with the aim of detecting and preventing intrusion.

  Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion

  prevention systems are to identify malicious activity, log information about this activity, attempt to block/stop it, and report it.

  Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems,

  intrusion prevention systems are placed in-line and are able to actively prevent/block intrusions that are detected. More specifically, IPS can take such actions as sending an alarm, dropping the malicious packets, resetting the connection and/

  or blocking the traffic from the offending IP address.