CompTIA CompTIA Advanced Security Practitioner RC0-C02 Questions & Answers

• Question 61:

  An IT auditor is reviewing the data classification for a sensitive system. The company has classified the data stored in the sensitive system according to the following matrix: DATA TYPECONFIDENTIALITYINTEGRITYAVAILABILITY

  FinancialHIGHHIGHLOW Client nameMEDIUMMEDIUMHIGH Client addressLOWMEDIUMLOW

  AGGREGATEMEDIUMMEDIUMMEDIUM

  The auditor is advising the company to review the aggregate score and submit it to senior management. Which of the following should be the revised aggregate score?

  A. HIGH, MEDIUM, LOW

  B. MEDIUM, MEDIUM, LOW

  C. HIGH, HIGH, HIGH

  D. MEDIUM, MEDIUM, MEDIUM

  Correct Answer: C

  The aggregate is incorrectly calculated as the average classification in this output. An aggregate is the sum of all items. As high is the highest level, and is present in all three categories, the aggregate should be high, high, high.

• Question 62:

  A project manager working for a large city government is required to plan and build a WAN, which will be required to host official business and public access. It is also anticipated that the city's emergency and first response communication systems will be required to operate across the same network. The project manager has experience with enterprise IT projects, but feels this project has an increased complexity as a result of the mixed business / public use and the critical infrastructure it will provide. Which of the following should the project manager release to the public, academia, and private industry to ensure the city provides due care in considering all project factors prior to building its new WAN?

  A. NDA

  B. RFI

  C. RFP

  D. RFQ

  Correct Answer: B

  A request for information (RFI) seeks information from suppliers for a specific purpose. One big difference is that companies and suppliers are not obligated to respond.

• Question 63:

  The Linux server at Company A hosts a graphical application widely used by the company designers. One designer regularly connects to the server from a Mac laptop in the designer's office down the hall. When the security engineer learns of this it is discovered the connection is not secured and the password can easily be obtained via network sniffing. Which of the following would the security engineer MOST likely implement to secure this connection? Linux Server: 192.168.10.10/24 Mac Laptop: 192.168.10.200/24

  A. From the server, establish an SSH tunnel to the Mac and VPN to 192.168.10.200.

  B. From the Mac, establish a remote desktop connection to 192.168.10.10 using Network Layer Authentication and the CredSSP security provider.

  C. From the Mac, establish a VPN to the Linux server and connect the VNC to 127.0.0.1.

  D. From the Mac, establish a SSH tunnel to the Linux server and connect the VNC to 127.0.0.1.

  Correct Answer: D

• Question 64:

  Statement: "The system shall implement measures to notify system administrators prior to a security incident occurring." Which of the following BEST restates the above statement to allow it to be implemented by a team of software developers?

  A. The system shall cease processing data when certain configurable events occur.

  B. The system shall continue processing in the event of an error and email the security administrator the error logs.

  C. The system shall halt on error.

  D. The system shall throw an error when specified incidents pass a configurable threshold.

  Correct Answer: D

• Question 65:

  A Security Manager is part of a team selecting web conferencing systems for internal use. The system will only be used for internal employee collaboration. Which of the following are the MAIN concerns of the security manager? (Select THREE).

  A. Security of data storage

  B. The cost of the solution

  C. System availability

  D. User authentication strategy

  E. PBX integration of the service

  F. Operating system compatibility

  Correct Answer: ACD

• Question 66:

  An intruder was recently discovered inside the data center, a highly sensitive area. To gain access, the intruder circumvented numerous layers of physical and electronic security measures. Company leadership has asked for a thorough review of physical security controls to prevent this from happening again. Which of the following departments are the MOST heavily invested in rectifying the problem? (Select THREE).

  A. Facilities management

  B. Human resources

  C. Research and development

  D. Programming

  E. Data center operations

  F. Marketing

  G. Information technology

  Correct Answer: AEG

  A: Facilities management is responsible for the physical security measures in a facility or building.

  E: The breach occurred in the data center, therefore the Data center operations would be greatly concerned.

  G: Data centers are important aspects of information technology (IT) in large corporations. Therefore the IT department would be greatly concerned.

• Question 67:

  A web developer is responsible for a simple web application that books holiday accommodations. The front-facing web server offers an HTML form, which asks for a user's age. This input gets placed into a signed integer variable and is then checked to ensure that the user is in the adult age range.

  Users have reported that the website is not functioning correctly. The web developer has inspected log files and sees that a very large number (in the billions) was submitted just before the issue started occurring. Which of the following is the MOST likely situation that has occurred?

  A. The age variable stored the large number and filled up disk space which stopped the application from continuing to function. Improper error handling prevented the application from recovering.

  B. The age variable has had an integer overflow and was assigned a very small negative number which led to unpredictable application behavior. Improper error handling prevented the application from recovering.

  C. Computers are able to store numbers well above "billions" in size. Therefore, the website issues are not related to the large number being input.

  D. The application has crashed because a very large integer has led to a "divide by zero". Improper error handling prevented the application from recovering.

  Correct Answer: B

  The age variable was configured to expect a number (an age); probably a number less than 100... or three digits. If someone entered a very large number (billions) with many digits, an integer overflow can occur which can cause the value to

  recorded as a negative number.

  In computer programming, an integer overflow occurs when an arithmetic operation attempts to create a numeric value that is too large to be represented within the available storage space.

  In some situations, a program may make the assumption that a variable always contains a positive value. If the variable has a signed integer type, an overflow can cause its value to wrap and become negative. This overflow violates the

  program's assumption and may lead to unintended behavior.

• Question 68:

  A software development manager is taking over an existing software development project. The team currently suffers from poor communication due to a long delay between requirements documentation and feature delivery. This gap is resulting in an above average number of security-related bugs making it into production. Which of the following development methodologies is the team MOST likely using now?

  A. Agile

  B. Waterfall

  C. Scrum

  D. Spiral

  Correct Answer: B

• Question 69:

  A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security into the application deployment. The board is primarily concerned with the applications' compliance with federal assessment and authorization standards. The security engineer asks for a timeline to determine when a security assessment of both applications should occur and does not attend subsequent configuration board meetings. If the security engineer is only going to perform a security assessment, which of the following steps in system authorization has the security engineer omitted?

  A. Establish the security control baseline

  B. Build the application according to software development security standards

  C. Review the results of user acceptance testing

  D. Consult with the stakeholders to determine which standards can be omitted

  Correct Answer: A

  A security baseline is the minimum level of security that a system, network, or device must adhere to. It is the initial point of reference for security and the document against which assessments would be done.

• Question 70:

  ODBC access to a database on a network-connected host is required. The host does not have a security mechanism to authenticate the incoming ODBC connection, and the application requires that the connection have read/write permissions. In order to further secure the data, a nonstandard configuration would need to be implemented. The information in the database is not sensitive, but was not readily accessible prior to the implementation of the ODBC connection. Which of the following actions should be taken by the security analyst?

  A. Accept the risk in order to keep the system within the company's standard security configuration.

  B. Explain the risks to the data owner and aid in the decision to accept the risk versus choosing a nonstandard solution.

  C. Secure the data despite the need to use a security control or solution that is not within company standards.

  D. Do not allow the connection to be made to avoid unnecessary risk and avoid deviating from the standard security configuration.

  Correct Answer: B

  We need to decide whether to accept the risks associated with a non-standard security solution or to allow the application to have unauthenticated Read/Write access to the data. The data is not sensitive so allowing unauthenticated Read/ Write access could be an option but this would make the data readily available. We should let the owner of the data decide whether he wants to allow unauthenticated access or allow only authenticated access but with a non-standard security solution. We should explain the risks of both options so the owner of the data can make an informed decision.