CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 271:

  A security tester is testing a website and performs the following manual query:

  https://www.comptia.com/cookies.jsp?products=5%20and%201=1

  The following response is received in the payload:

  "ORA-000001: SQL command not properly ended"

  Which of the following is the response an example of?

  A. Fingerprinting

  B. Cross-site scripting

  C. SQL injection

  D. Privilege escalation

  Correct Answer: A

  This is an example of Fingerprinting. The response to the code entered includes "ORA- 000001" which tells the attacker that the database software being used is Oracle. Fingerprinting can be used as a means of ascertaining the operating system of a remote computer on a network. Fingerprinting is more generally used to detect specific versions of applications or protocols that are run on network servers. Fingerprinting can be accomplished "passively" by sniffing network packets passing between hosts, or it can be accomplished "actively" by transmitting specially created packets to the target machine and analyzing the response.

• Question 272:

  A security administrator wants to prevent sensitive data residing on corporate laptops and desktops from leaking outside of the corporate network. The company has already implemented full-disk encryption and has disabled all peripheral devices on its desktops and laptops. Which of the following additional controls MUST be implemented to minimize the risk of data leakage? (Select TWO).

  A. A full-system backup should be implemented to a third-party provider with strong encryption for data in transit.

  B. A DLP gateway should be installed at the company border.

  C. Strong authentication should be implemented via external biometric devices.

  D. Full-tunnel VPN should be required for all network communication.

  E. Full-drive file hashing should be implemented with hashes stored on separate storage.

  F. Split-tunnel VPN should be enforced when transferring sensitive data.

  Correct Answer: BD

  Web mail, Instant Messaging and personal networking sites are some of the most common means by which corporate data is leaked.

  Data loss prevention (DLP) is a strategy for making sure that end users do not send sensitive or critical information outside the corporate network. The term is also used to describe software products that help a network administrator control

  what data end users can transfer.

  DLP software products use business rules to classify and protect confidential and critical information so that unauthorized end users cannot accidentally or maliciously share data whose disclosure could put the organization at risk. For

  example, if an employee tried to forward a business email outside the corporate domain or upload a corporate file to a consumer cloud storage service like Dropbox, the employee would be denied permission.

  Full-tunnel VPN should be required for all network communication. This will ensure that all data transmitted over the network is encrypted which would prevent a malicious user accessing the data by using packet sniffing.

• Question 273:

  An educational institution would like to make computer labs available to remote students. The labs are used for various IT networking, security, and programming courses. The requirements are:

  Each lab must be on a separate network segment.

  Labs must have access to the Internet, but not other lab networks. Student devices must have network access, not simple access to hosts on the lab networks.

  Students must have a private certificate installed before gaining access.

  Servers must have a private certificate installed locally to provide assurance to the students.

  All students must use the same VPN connection profile.

  Which of the following components should be used to achieve the design in conjunction with directory services?

  A. L2TP VPN over TLS for remote connectivity, SAML for federated authentication, firewalls between each lab segment

  B. SSL VPN for remote connectivity, directory services groups for each lab group, ACLs on routing equipment

  C. IPSec VPN with mutual authentication for remote connectivity, RADIUS for authentication, ACLs on network equipment

  D. Cloud service remote access tool for remote connectivity, OAuth for authentication, ACL on routing equipment

  Correct Answer: C

  IPSec VPN with mutual authentication meets the certificates requirements.

  RADIUS can be used with the directory service for the user authentication. ACLs (access control lists) are the best solution for restricting access to network hosts.

• Question 274:

  A network engineer wants to deploy user-based authentication across the company's wired and wireless infrastructure at layer 2 of the OSI model. Company policies require that users be centrally managed and authenticated and that each user's network access be controlled based on the user's role within the company. Additionally, the central authentication system must support hierarchical trust and the ability to natively authenticate mobile devices and workstations. Which of the following are needed to implement these requirements? (Select TWO).

  A. SAML

  B. WAYF

  C. LDAP

  D. RADIUS

  E. Shibboleth

  F. PKI

  Correct Answer: CD

  RADIUS is commonly used for the authentication of WiFi connections. We can use LDAP and RADIUS for the authentication of users and devices. LDAP and RADIUS have something in common. They`re both mainly protocols (more than a database) which uses attributes to carry information back and forth. They`re clearly defined in RFC documents so you can expect products from different vendors to be able to function properly together. RADIUS is NOT a database. It's a protocol for asking intelligent questions to a user database. LDAP is just a database. In recent offerings it contains a bit of intelligence (like Roles, Class of Service and so on) but it still is mainly just a rather stupid database. RADIUS (actually RADIUS servers like FreeRADIUS) provide the administrator the tools to not only perform user authentication but also to authorize users based on extremely complex checks and logic. For instance you can allow access on a specific NAS only if the user belongs to a certain category, is a member of a specific group and an outside script allows access. There's no way to perform any type of such complex decisions in a user database.

• Question 275:

  An organization uses IP address block 203.0.113.0/24 on its internal network. At the border router, the network administrator sets up rules to deny packets with a source address in this subnet from entering the network, and to deny packets with a destination address in this subnet from leaving the network. Which of the following is the administrator attempting to prevent?

  A. BGP route hijacking attacks

  B. Bogon IP network traffic

  C. IP spoofing attacks

  D. Man-in-the-middle attacks

  E. Amplified DDoS attacks

  Correct Answer: C

  The IP address block 203.0.113.0/24 is used on the internal network. Therefore, there should be no traffic coming into the network claiming to be from an address in the 203.0.113.0/24 range. Similarly, there should be no outbound traffic destined for an address in the 203.0.113.0/24 range. So this has been blocked at the firewall. This is to protect against IP spoofing attacks where an attacker external to the network sends data claiming to be from an internal computer with an address in the 203.0.113.0/24 range. IP spoofing, also known as IP address forgery or a host file hijack, is a hijacking technique in which a cracker masquerades as a trusted host to conceal his identity, spoof a Web site, hijack browsers, or gain access to a network. Here's how it works: The hijacker obtains the IP address of a legitimate host and alters packet headers so that the legitimate host appears to be the source. When IP spoofing is used to hijack a browser, a visitor who types in the URL (Uniform Resource Locator) of a legitimate site is taken to a fraudulent Web page created by the hijacker. For example, if the hijacker spoofed the Library of Congress Web site, then any Internet user who typed in the URL www.loc.gov would see spoofed content created by the hijacker. If a user interacts with dynamic content on a spoofed page, the hijacker can gain access to sensitive information or computer or network resources. He could steal or alter sensitive data, such as a credit card number or password, or install malware. The hijacker would also be able to take control of a compromised computer to use it as part of a zombie army in order to send out spam.

• Question 276:

  Joe, a hacker, has discovered he can specifically craft a webpage that when viewed in a browser crashes the browser and then allows him to gain remote code execution in the context of the victim's privilege level. The browser crashes due to an exception error when a heap memory that is unused is accessed. Which of the following BEST describes the application issue?

  A. Integer overflow

  B. Click-jacking

  C. Race condition

  D. SQL injection

  E. Use after free

  F. Input validation

  Correct Answer: E

  Use-After-Free vulnerabilities are a type of memory corruption flaw that can be leveraged by hackers to execute arbitrary code.

  Use After Free specifically refers to the attempt to access memory after it has been freed, which can cause a program to crash or, in the case of a Use-After-Free flaw, can potentially result in the execution of arbitrary code or even enable full

  remote code execution capabilities.

  According to the Use After Free definition on the Common Weakness Enumeration (CWE) website, a Use After Free scenario can occur when "the memory in question is allocated to another pointer validly at some point after it has been

  freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process."

• Question 277:

  A security administrator notices the following line in a server's security log:

  ') + "';

  The administrator is concerned that it will take the developer a lot of time to fix the application that is running on the server. Which of the following should the security administrator implement to prevent this particular attack?

  A. WAF

  B. Input validation

  C. SIEM

  D. Sandboxing

  E. DAM

  Correct Answer: A

  The attack in this question is an XSS (Cross Site Scripting) attack. We can prevent this attack by using a Web Application Firewall.

  A WAF (Web Application Firewall) protects a Web application by controlling its input and output and the access to and from the application. Running as an appliance, server plug-in or cloud-based service, a WAF inspects every HTML,

  HTTPS, SOAP and XML-RPC data packet. Through customizable inspection, it is able to prevent attacks such as XSS, SQL injection, session hijacking and buffer overflows, which network firewalls and intrusion detection systems are often

  not capable of doing. A WAF is also able to detect and prevent new unknown attacks by watching for unfamiliar patterns in the traffic data. A WAF can be either network-based or host-based and is typically deployed through a proxy and

  placed in front of one or more Web applications. In real time or near-real time, it monitors traffic before it reaches the Web application, analyzing all requests using a rule base to filter out potentially harmful traffic or traffic patterns. Web

  application firewalls are a common security control used by enterprises to protect Web applications against zero-day exploits, impersonation and known vulnerabilities and attackers.

• Question 278:

  A vulnerability scanner report shows that a client-server host monitoring solution operating in the credit card corporate environment is managing SSL sessions with a weak algorithm which does not meet corporate policy. Which of the following are true statements? (Select TWO).

  A. The X509 V3 certificate was issued by a non trusted public CA.

  B. The client-server handshake could not negotiate strong ciphers.

  C. The client-server handshake is configured with a wrong priority.

  D. The client-server handshake is based on TLS authentication.

  E. The X509 V3 certificate is expired.

  F. The client-server implements client-server mutual authentication with different certificates.

  Correct Answer: BC

  The client-server handshake could not negotiate strong ciphers. This means that the system is not configured to support the strong ciphers provided by later versions of the SSL protocol. For example, if the system is configured to support

  only SSL version 1.1, then only a weak cipher will be supported.

  The client-server handshake is configured with a wrong priority. The client sends a list of SSL versions it supports and priority should be given to the highest version it supports. For example, if the client supports SSL versions 1.1, 2 and 3,

  then the server should use version 3. If the priority is not configured correctly (if it uses the lowest version) then version 1.1 with its weak algorithm will be used.

• Question 279:

  ABC Corporation uses multiple security zones to protect systems and information, and all of the VM hosts are part of a consolidated VM infrastructure. Each zone has different VM administrators. Which of the following restricts different zone administrators from directly accessing the console of a VM host from another zone?

  A. Ensure hypervisor layer firewalling between all VM hosts regardless of security zone.

  B. Maintain a separate virtual switch for each security zone and ensure VM hosts bind to only the correct virtual NIC(s).

  C. Organize VM hosts into containers based on security zone and restrict access using an ACL.

  D. Require multi-factor authentication when accessing the console at the physical VM host.

  Correct Answer: C

  Access Control Lists (ACLs) are used to restrict access to the console of a virtual host. Virtual hosts are often managed by centralized management servers (for example: VMware vCenter Server). You can create logical containers that can contain multiple hosts and you can configure ACLs on the containers to provide access to the hosts within the container.

• Question 280:

  Which of the following describes a risk and mitigation associated with cloud data storage?

  A. Risk: Shared hardware caused data leakage Mitigation: Strong encryption at rest

  B. Risk: Offsite replication Mitigation: Multi-site backups

  C. Risk: Data loss from de-duplication Mitigation: Dynamic host bus addressing

  D. Risk: Combined data archiving Mitigation: Two-factor administrator authentication

  Correct Answer: A

  With cloud data storage, the storage provider will have large enterprise SANs providing large pools of storage capacity. Portions of the storage pools are assigned to customers. The risk is that multiple customers are storing their data on the same physical hardware storage devices. This presents a risk (usually a very small risk, but a risk all the same) of other customers using the same cloud storage hardware being able to view your data. The mitigation of the risk is to encrypt your data stored on the SAN. Then the data would be unreadable even if another customer was able to access it.