Vivid of CAS-002 torrent materials and item pool for CompTIA certification for client, Real Success Guaranteed with Updated CAS-002 pdf dumps vce Materials. 100% PASS CompTIA Advanced Security Practitioner (CASP) exam Today!

Q61. - (Topic 5) 

An administrator is trying to categorize the security impact of a database server in the case of a security event. There are three databases on the server. 

Current Financial Data = High level of damage if data is disclosed. Moderate damage if the system goes offline 

Archived Financial Data = No need for the database to be online. Low damage for integrity loss 

Public Website Data = Low damage if the site goes down. Moderate damage if the data is corrupted 

Given these security categorizations of each database, which of the following is the aggregate security categorization of the database server? 

A. Database server = {(Confidentiality HIGH),(Integrity High),(Availability High)} 

B. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Moderate)} 

C. Database server = {(Confidentiality HIGH),(Integrity Moderate),(Availability Low)} 

D. Database server = {(Confidentiality Moderate),(Integrity Moderate),(Availability Moderate)} 


Q62. - (Topic 4) 

A sensitive database needs its cryptographic integrity upheld. Which of the following controls meets this goal? (Select TWO). 

A. Data signing 

B. Encryption 

C. Perfect forward secrecy 

D. Steganography 

E. Data vaulting 


G. Lock and key 

Answer: A,F 

Q63. - (Topic 3) 

Which of the following should be used to identify overflow vulnerabilities? 

A. Fuzzing 

B. Input validation 

C. Privilege escalation 

D. Secure coding standards 


Q64. - (Topic 3) 

A health service provider is considering the impact of allowing doctors and nurses access to the internal email system from their personal smartphones. The Information Security Officer (ISO) has received a technical document from the security administrator explaining that the current email system is capable of enforcing security policies to personal smartphones, including screen lockout and mandatory PINs. Additionally, the system is able to remotely wipe a phone if reported lost or stolen. Which of the following should the Information Security Officer be MOST concerned with based on this scenario? (Select THREE). 

A. The email system may become unavailable due to overload. 

B. Compliance may not be supported by all smartphones. 

C. Equipment loss, theft, and data leakage. 

D. Smartphone radios can interfere with health equipment. 

E. Data usage cost could significantly increase. 

F. Not all smartphones natively support encryption. 

G. Smartphones may be used as rogue access points. 

Answer: B,C,F 

Q65. - (Topic 1) 

A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security into the application deployment. The board is primarily concerned with the applications’ compliance with federal assessment and authorization standards. The security engineer asks for a timeline to determine when a security assessment of both applications should occur and does not attend subsequent configuration board meetings. If the security engineer is only going to perform a security assessment, which of the following steps in system authorization has the security engineer omitted? 

A. Establish the security control baseline 

B. Build the application according to software development security standards 

C. Review the results of user acceptance testing 

D. Consult with the stakeholders to determine which standards can be omitted 


Q66. - (Topic 2) 

A senior network security engineer has been tasked to decrease the attack surface of the corporate network. Which of the following actions would protect the external network interfaces from external attackers performing network scanning? 

A. Remove contact details from the domain name registrar to prevent social engineering attacks. 

B. Test external interfaces to see how they function when they process fragmented IP packets. 

C. Enable a honeynet to capture and facilitate future analysis of malicious attack vectors. 

D. Filter all internal ICMP message traffic, forcing attackers to use full-blown TCP port scans against external network interfaces. 


Q67. - (Topic 1) 

The Chief Executive Officer (CEO) of an Internet service provider (ISP) has decided to limit the company’s contribution to worldwide Distributed Denial of Service (DDoS) attacks. Which of the following should the ISP implement? (Select TWO). 

A. Block traffic from the ISP’s networks destined for blacklisted IPs. 

B. Prevent the ISP’s customers from querying DNS servers other than those hosted by the ISP. 

C. Scan the ISP’s customer networks using an up-to-date vulnerability scanner. 

D. Notify customers when services they run are involved in an attack. 

E. Block traffic with an IP source not allocated to customers from exiting the ISP's network. 

Answer: D,E 

Q68. - (Topic 5) 

The Chief Information Officer (CIO) is focused on improving IT governance within the organization to reduce system downtime. The CIO has mandated that the following improvements be implemented: 

-All business units must now identify IT risks and include them in their business risk profiles. 

-Key controls must be identified and monitored. 

-Incidents and events must be recorded and reported with management oversight. 

-Exemptions to the information security policy must be formally recorded, approved, and managed. 

-IT strategy will be reviewed to ensure it is aligned with the businesses strategy and objectives. 

In addition to the above, which of the following would BEST help the CIO meet the requirements? 

A. Establish a register of core systems and identify technical service owners 

B. Establish a formal change management process 

C. Develop a security requirement traceability matrix 

D. Document legacy systems to be decommissioned and the disposal process 


Q69. DRAG DROP - (Topic 2) 

A manufacturer is planning to build a segregated network. There are requirements to segregate development and test infrastructure from production and the need to support multiple entry points into the network depending on the service being accessed. There are also strict rules in place to only permit user access from within the same zone. Currently, the following access requirements have been identified: 

1. Developers have the ability to perform technical validation of development applications. 

2. End users have the ability to access internal web applications. 

3. Third-party vendors have the ability to support applications. 

In order to meet segregation and access requirements, drag and drop the appropriate network zone that the user would be accessing and the access mechanism to meet the above criteria. Options may be used once or not at all. All placeholders must be filled. 


Q70. - (Topic 5) 

A company has decided to move to an agile software development methodology. The company gives all of its developers security training. After a year of agile, a management review finds that the number of items on a vulnerability scan has actually increased since the methodology change. Which of the following best practices has MOST likely been overlooked in the agile implementation? 

A. Penetration tests should be performed after each sprint. 

B. A security engineer should be paired with a developer during each cycle. 

C. The security requirements should be introduced during the implementation phase. 

D. The security requirements definition phase should be added to each sprint.