CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 51:

  A small retail company recently deployed a new point of sale (POS) system to all 67 stores. The core of the POS is an extranet site, accessible only from retail stores and the corporate office over a split-tunnel VPN. An additional split-tunnel VPN provides bi-directional connectivity back to the main office, which provides voice connectivity for store VoIP phones. Each store offers guest wireless functionality, as well as employee wireless. Only the staff wireless network has access to the POS VPN. Recently, stores are reporting poor response times when accessing the POS application from store computers as well as degraded voice quality when making phone calls. Upon investigation, it is determined that three store PCs are hosting malware, which is generating excessive network traffic. After malware removal, the information security department is asked to review the configuration and suggest changes to prevent this from happening again. Which of the following denotes the BEST way to mitigate future malware risk?

  A. Deploy new perimeter firewalls at all stores with UTM functionality.

  B. Change antivirus vendors at the store and the corporate office.

  C. Move to a VDI solution that runs offsite from the same data center that hosts the new POS solution.

  D. Deploy a proxy server with content filtering at the corporate office and route all traffic through it.

  Correct Answer: A

  A perimeter firewall is located between the local network and the Internet where it can screen network traffic flowing in and out of the organization. A firewall with unified threat management (UTM) functionalities includes anti-malware capabilities.

• Question 52:

  Several business units have requested the ability to use collaborative web-based meeting places with third party vendors. Generally these require user registration, installation of client-based ActiveX or Java applets, and also the ability for the user to share their desktop in read-only or read-write mode. In order to ensure that information security is not compromised, which of the following controls is BEST suited to this situation?

  A. Disallow the use of web-based meetings as this could lead to vulnerable client-side components being installed, or a malicious third party gaining read-write control over an internal workstation.

  B. Hire an outside consultant firm to perform both a quantitative and a qualitative risk- based assessment. Based on the outcomes, if any risks are identified then do not allow web-based meetings. If no risks are identified then go forward and allow for these meetings to occur.

  C. Allow the use of web-based meetings, but put controls in place to ensure that the use of these meetings is logged and tracked.

  D. Evaluate several meeting providers. Ensure that client-side components do not introduce undue security risks. Ensure that the read-write desktop mode can either be prevented or strongly audited.

  Correct Answer: D

• Question 53:

  A team of security engineers has applied regulatory and corporate guidance to the design of a corporate network. The engineers have generated an SRTM based on their work and a thorough analysis of the complete set of functional and performance requirements in the network specification. Which of the following BEST describes the purpose of an SRTM in this scenario?

  A. To ensure the security of the network is documented prior to customer delivery

  B. To document the source of all functional requirements applicable to the network

  C. To facilitate the creation of performance testing metrics and test plans

  D. To allow certifiers to verify the network meets applicable security requirements

  Correct Answer: D

• Question 54:

  An employee is performing a review of the organization's security functions and noticed that there is some cross over responsibility between the IT security team and the financial fraud team. Which of the following security documents should be used to clarify the roles and responsibilities between the teams?

  A. BPA

  B. BIA

  C. MOU

  D. OLA

  Correct Answer: C

  A memorandum of understanding (MOU) documents conditions and applied terms for teams that must share data and information resources.

• Question 55:

  A company has decided to change its current business direction and refocus on core business. Consequently, several company sub-businesses are in the process of being sold-off. A security consultant has been engaged to advise on residual information security concerns with a de-merger. From a high-level perspective, which of the following BEST provides the procedure that the consultant should follow?

  A. Perform a penetration test for the current state of the company. Perform another penetration test after the de-merger. Identify the gaps between the two tests.

  B. Duplicate security-based assets should be sold off for commercial gain to ensure that the security posture of the company does not decline.

  C. Explain that security consultants are not trained to offer advice on company acquisitions or demergers. This needs to be handled by legal representatives well versed in corporate law.

  D. Identify the current state from a security viewpoint. Based on the demerger, assess what the security gaps will be from a physical, technical, DR, and policy/awareness perspective.

  Correct Answer: D

  When the businesses are sold off, the company will be losing buildings, infrastructure (including IT and security infrastructure) and staff. From a security perspective, by selling off sections of IT infrastructure you will be losing capacity (network, servers, storage, security devices etc.) that could leave the remaining infrastructure vulnerable either to attacks or to hardware failure. Therefore, you need to plan and assess the impact that the reduced assets will have on the remainder of the company.

• Question 56:

  A mature organization with legacy information systems has incorporated numerous new processes and dependencies to manage security as its networks and infrastructure are modernized. The Chief Information Office has become increasingly frustrated with frequent releases, stating that the organization needs everything to work completely, and the vendor should already have those desires built into the software product. The vendor has been in constant communication with personnel and groups within the organization to understand its business process and capture new software requirements from users. Which of the following methods of software development is this organization's configuration management process using?

  A. Agile

  B. SDL

  C. Waterfall

  D. Joint application development

  Correct Answer: A

  In agile software development, teams of programmers and business experts work closely together, using an iterative approach.

• Question 57:

  A finance manager says that the company needs to ensure that the new system can "replay" data, up to the minute, for every exchange being tracked by the investment departments. The finance manager also states that the company's transactions need to be tracked against this data for a period of five years for compliance. How would a security engineer BEST interpret the finance manager's needs?

  A. Compliance standards

  B. User requirements

  C. Data elements

  D. Data storage

  E. Acceptance testing

  F. Information digest

  G. System requirements

  Correct Answer: B

  User requirements are used to specify what the USER expects an application or system to do.

  In this question, the finance manager has stated what he wants the system to do. Therefore, the answer to this question is `user requirements'.

• Question 58:

  A company Chief Information Officer (CIO) is unsure which set of standards should govern the company's IT policy. The CIO has hired consultants to develop use cases to test against various government and industry security standards. The CIO is convinced that there is large overlap between the configuration checks and security controls governing each set of standards. Which of the following selections represent the BEST option for the CIO?

  A. Issue a RFQ for vendors to quote a complete vulnerability and risk management solution to the company.

  B. Issue a policy that requires only the most stringent security standards be implemented throughout the company.

  C. Issue a policy specifying best practice security standards and a baseline to be implemented across the company.

  D. Issue a RFI for vendors to determine which set of security standards is best for the company.

  Correct Answer: C

  There is large overlap between the configuration checks and security controls governing each set of standards (government standards and industry security standards). In other words, different sets of standards have many of the same requirements. A baseline implemented across the company that meets the overlapping requirements would meet the requirements of both sets of standards without the need for duplicate checks and controls. Therefore, you should create a policy specifying best practice security standards along with the baseline.

• Question 59:

  A firm's Chief Executive Officer (CEO) is concerned that IT staff lacks the knowledge to identify complex vulnerabilities that may exist in a payment system being internally developed. The payment system being developed will be sold to a number of organizations and is in direct competition with another leading product. The CEO highlighted that code base confidentiality is of critical importance to allow the company to exceed the competition in terms of the product's reliability, stability, and performance. Which of the following would provide the MOST thorough testing and satisfy the CEO's requirements?

  A. Sign a MOU with a marketing firm to preserve the company reputation and use in-house resources for random testing.

  B. Sign a BPA with a small software consulting firm and use the firm to perform Black box testing and address all findings.

  C. Sign a NDA with a large security consulting firm and use the firm to perform Grey box testing and address all findings.

  D. Use the most qualified and senior developers on the project to perform a variety of White box testing and code reviews.

  Correct Answer: C

  Gray box testing has limited knowledge of the system as an attacker would. The base code would remain confidential. This would further be enhanced by a Non-disclosure agreement (NDA) which is designed to protect confidential information.

• Question 60:

  A business unit of a large enterprise has outsourced the hosting and development of a new external website which will be accessed by premium customers, in order to speed up the time to market timeline. Which of the following is the MOST appropriate?

  A. The external party providing the hosting and website development should be obligated under contract to provide a secure service which is regularly tested (vulnerability and penetration). SLAs should be in place for the resolution of newly identified vulnerabilities and a guaranteed uptime.

  B. The use of external organizations to provide hosting and web development services is not recommended as the costs are typically higher than what can be achieved internally. In addition, compliance with privacy regulations becomes more complex and guaranteed uptimes are difficult to track and measure.

  C. Outsourcing transfers all the risk to the third party. An SLA should be in place for the resolution of newly identified vulnerabilities and penetration / vulnerability testing should be conducted regularly.

  D. Outsourcing transfers the risk to the third party, thereby minimizing the cost and any legal obligations. An MOU should be in place for the resolution of newly identified vulnerabilities and penetration / vulnerability testing should be conducted regularly.

  Correct Answer: A

  A service level agreement (SLA) guarantees the level of service the partner is agreeing to provide. It specifies the uptime, response time, and maximum outage time that the partner is agreeing to.