Can You Pass This CompTIA CASP Certification Test? Trivia Quiz

30 Questions

Settings
Can You Pass This CompTIA CASP Certification Test? Trivia Quiz

CASP? 61-90


Questions and Answers
  • 1. 
    • A. 

      A corporate policy to prevent sensitive information from residing on a mobile device and antivirus software.

    • B. 

      Encryption of the non-volatile memory and a corporate policy to prevent sensitive information from residing on a mobile device.

    • C. 

      Encryption of the non-volatile memory and a password or PIN to access the device.

    • D. 

      A password or PIN to access the device and a corporate policy to prevent sensitive information from residing on a mobile device.

  • 2. 
    62. The Chief Executive Officer (CEO) of a corporation decided to move all email to a cloud computing environment. The Chief Information Security Officer (CISO) was told to research the risk involved in this environment. Which of the following measures should be implemented to minimize the risk of hosting email in the cloud?
    • A. 

      Remind users that all emails with sensitive information need be encrypted and physically inspect the cloud computing.

    • B. 

      Ensure logins are over an encrypted channel and obtain an NDA and an SLA from the cloud provider.

    • C. 

      Ensure logins are over an encrypted channel and remind users to encrypt all emails that contain sensitive information.

    • D. 

      Obtain an NDA from the cloud provider and remind users that all emails with sensitive information need be encrypted.

  • 3. 
    • A. 

      Mitigate and Transfer

    • B. 

      Accept and Transfer

    • C. 

      Transfer and Avoid

    • D. 

      Avoid and Mitigate

  • 4. 
    64. The Chief Executive Officer (CEO) of a corporation purchased the latest mobile device and connected it to the internal network. The CEO proceeded to download sensitive financial documents through their email. The device was then lost in transit to a conference. The CEO notified the company helpdesk about the lost device and another one was shipped out, after which the helpdesk ticket was closed stating the issue was resolved. This data breach was not properly reported due to insufficient training surrounding which of the following processes?
    • A. 

      E-Discovery

    • B. 

      Data handling

    • C. 

      Incident response

    • D. 

      Data recovery and storage

  • 5. 
    65. An employee was terminated and promptly escorted to their exit interview, after which the employee left the building. It was later discovered that this employee had started a consulting business using screen shots of their work at the company which included live customer data. This information had been removed through the use of a USB device. After this incident, it was determined a process review must be conducted to ensure this issue does not recur. Which of the following business areas should primarily be involved in this discussion? (Select TWO).
    • A. 

      Database Administrator

    • B. 

      Human Resources

    • C. 

      Finance

    • D. 

      Network Administrator

    • E. 

      IT Management

  • 6. 
    66. A technician states that workstations that are on the network in location B are unable to validate certificates, while workstations that are on the main location A’s network are having no issues. Which of the following methods allows a certificate to be validated by a single server that returns the validity of that certificate?
    • A. 

      XACML

    • B. 

      OCSP

    • C. 

      ACL

    • D. 

      CRL

  • 7. 
    67. A system administrator needs to develop a policy for when an application server is no longer needed. Which of the following policies would need to be developed?
    • A. 

      Backup policy

    • B. 

      De-provisioning policy

    • C. 

      Data retention policy

    • D. 

      Provisioning policy

  • 8. 
    68. A web administrator develops a web form for users to respond to the company via a web page. Which of the following should be practiced to avoid a security risk?
    • A. 

      SQL injection

    • B. 

      XSS scripting

    • C. 

      Click jacking

    • D. 

      Input validation

  • 9. 
    69. A user reports that the workstation’s mouse pointer is moving and files are opening automatically. Which of the following should the user perform?
    • A. 

      Unplug the network cable to avoid network activity.

    • B. 

      Reboot the workstation to see if problem occurs again.

    • C. 

      Turn off the computer to avoid any more issues.

    • D. 

      Contact the incident response team for direction.

  • 10. 
    70. A system designer needs to factor in CIA requirements for a new SAN. Which of the CIA requirements is BEST met by multipathing?
    • A. 

      Confidentiality

    • B. 

      Authentication

    • C. 

      Integrity

    • D. 

      Availability

  • 11. 
    71. An internal employee has sold a copy of the production customer database that was being used for upgrade testing to outside parties via HTTP file upload. The Chief Information Officer (CIO) has resigned and the Chief Executive Officer (CEO) has tasked the incoming CIO with putting effective controls in place to help prevent this from occurring again in the future. Which of the following controls is the MOST effective in preventing this threat from re-occurring?
    • A. 

      Network-based intrusion prevention system

    • B. 

      Data loss prevention

    • C. 

      Host-based intrusion detection system

    • D. 

      Web application firewall

  • 12. 
    72. A security manager has provided a Statement of Work (SOW) to an external penetration testing firm for a web application security test. The web application starts with a very simple HTML survey form with two components: a country selection dropdown list and a submit button. The penetration testers are required to provide their test cases for this survey form in advance. In order to adequately test the input validation of the survey form, which of the following tools would be the BEST tool for the technician to use?
    • A. 

      HTTP interceptor

    • B. 

      Vulnerability scanner

    • C. 

      Port scanner

    • D. 

      Fuzzer

  • 13. 
    • A. 

      Penetration test across the application with accounts of varying access levels (i.e. nonauthenticated, authenticated, and administrative users).

    • B. 

      Code review across critical modules to ensure that security defects, Trojans, and backdoors are not present.

    • C. 

      Vulnerability assessment across all of the online banking servers to ascertain host and container configuration lock-down and patch levels.

    • D. 

      Fingerprinting across all of the online banking servers to ascertain open ports and services.

    • E. 

      Black box code review across the entire code base to ensure that there are no security defects present.

  • 14. 
    74. Within a large organization, the corporate security policy states that personal electronic devices are not allowed to be placed on the company network. There is considerable pressure from the company board to allow smartphones to connect and synchronize email and calendar items of board members and company executives. Which of the following options BEST balances the security and usability requirements of the executive management team?
    • A. 

      Allow only the executive management team the ability to use personal devices on the company network, as they have important responsibilities and need convenient access.

    • B. 

      Review the security policy. Perform a risk evaluation of allowing devices that can be centrally managed, remotely disabled, and have device-level encryption of sensitive data.

    • C. 

      Stand firm on disallowing non-company assets from connecting to the network as the assets may lead to undesirable security consequences, such as sensitive emails being leaked outside the company.

    • D. 

      Allow only certain devices that are known to have the ability of being centrally managed. Do not allow any other smartphones until the device is proven to be centrally managed.

  • 15. 
    75. A replacement CRM has had its business case approved. In preparation for a requirements workshop, an architect is working with a business analyst to ensure that appropriate security requirements have been captured. Which of the following documents BEST captures the security requirements?
    • A. 

      Business requirements document

    • B. 

      Requirements traceability matrix document

    • C. 

      Use case and viewpoints document

    • D. 

      Solution overview document

  • 16. 
    76. Which of the following BEST defines the term e-discovery?
    • A. 

      A product that provides IT-specific governance, risk management, and compliance.

    • B. 

      A form of reconnaissance used by penetration testers to discover listening hosts.

    • C. 

      A synonymous term for computer emergency response and incident handling.

    • D. 

      A process of producing electronically stored information for use as evidence.

  • 17. 
    77. A new project initiative involves replacing a legacy core HR system, and is expected to touch many major operational systems in the company. A security administrator is engaged in the project to provide security consulting advice. In addition, there are database, network, application, HR, and transformation management consultants engaged on the project as well. The administrator has established the security requirements. Which of the following is the NEXT logical step?
    • A. 

      Document the security requirements in an email and move on to the next most urgent task.

    • B. 

      Organize for a requirements workshop with the non-technical project members, being the HR and transformation management consultants.

    • C. 

      Communicate the security requirements with all stakeholders for discussion and buy-in.

    • D. 

      Organize for a requirements workshop with the technical project members, being the database, network, and application consultants.

  • 18. 
    • A. 

      Requirements workshop

    • B. 

      Security development lifecycle (SDL)

    • C. 

      Security requirements traceability matrix (SRTM)

    • D. 

      Secure code review and penetration test

  • 19. 
    79. An IT administrator has installed new DNS name servers (Primary and Secondary), which are used to host the company MX records and resolve the web server’s public address. In order to secure the zone transfer between the primary and secondary server, the administrator uses only server ACLs. Which of the following attacks could the secondary DNS server still be susceptible to?
    • A. 

      Email spamming

    • B. 

      IP spoofing

    • C. 

      Clickjacking

    • D. 

      DNS replication

  • 20. 
    80. The Chief Executive Officer (CEO) has decided to outsource systems which are not core business functions; however, a recent review by the risk officer has indicated that core business functions are dependent on the outsourced systems. The risk officer has requested that the IT department calculates the priority of restoration for all systems and applications under the new business model. Which of the following is the BEST tool to achieve this?
    • A. 

      Business impact analysis

    • B. 

      Annualized loss expectancy analysis

    • C. 

      TCO analysis

    • D. 

      Residual risk and gap analysis

  • 21. 
    81. A data breach occurred which impacted the HR and payroll system. It is believed that an attack from within the organization resulted in the data breach. Which of the following should be performed FIRST after the data breach occurred?
    • A. 

      Assess system status

    • B. 

      Restore from backup tapes

    • C. 

      Conduct a business impact analysis

    • D. 

      Review NIDS logs

  • 22. 
    82. A production server has been compromised. Which of the following is the BEST way to preserve the non-volatile evidence?
    • A. 

      Shut the server down and image the hard drive.

    • B. 

      Remove all power sources from the server.

    • C. 

      Install remote backup software and copy data to write-once media.

    • D. 

      Login remotely and perform a full backup of the server.

  • 23. 
    83. A project has been established in a large bank to develop a new secure online banking platform. Half way through the development it was discovered that a key piece of software used as part of the base platform is now susceptible to recently published exploits. Who should be contacted FIRST by the project team to discuss potential changes to the platform requirements?
    • A. 

      Engineers

    • B. 

      Facilities Manager

    • C. 

      Stakeholders

    • D. 

      Human Resources

  • 24. 
    84. The IT department of a large telecommunications company has developed and finalized a set of security solutions and policies which have been approved by upper management for deployment within the company. During the development of the security solutions and policies, the FIRST thing the IT department should have done was:
    • A. 

      Contact vendor management so the RFI and RFP process can be started as soon as possible. user accounts and reviews of system logs.

    • B. 

      Contact an independent consultant who can tell them what policies and solutions they need. through a SSL portal. Perform regular audits of user accounts and reviews of system logs.

    • C. 

      Discuss requirements with stakeholders from the various internal departments. active hostile threats.

    • D. 

      Involve facilities management early in the project so they can plan for the new security hardware in the data center. Regularly perform user revalidation.

  • 25. 
    85. Employees have recently requested remote access to corporate email and shared drives. Remote access has never been offered; however, the need to improve productivity and rapidly responding to customer demands means staff now requires remote access. Which of the following controls will BEST protect the corporate network?
    • A. 

      Develop a security policy that defines remote access requirements. Perform regular audits of user accounts and reviews of system logs.

    • B. 

      Secure remote access systems to ensure shared drives are read only and access is provided through a SSL portal. Perform regular audits of user accounts and reviews of system logs.

    • C. 

      Plan and develop security policies based on the assumption that external environments have active hostile threats.

    • D. 

      Implement a DLP program to log data accessed by users connecting via remote access. Regularly perform user revalidation.

  • 26. 
    86. A manufacturing company is having issues with unauthorized access and modification of the controls operating the production equipment. A communication requirement is to allow the free flow of data between all network segments at the site. Which of the following BEST remediates the issue?
    • A. 

      Implement SCADA security measures.

    • B. 

      Implement NIPS to prevent the unauthorized activity.

    • C. 

      Implement an AAA solution.

    • D. 

      Implement a firewall to restrict access to only a single management station.

  • 27. 
    • A. 

      Implement NIPS inline between the web server and the firewall.

    • B. 

      Implement a web application firewall inline between the web server and the firewall.

    • C. 

      Implement host intrusion prevention on all machines at the bank.

    • D. 

      Configure the firewall policy to only allow communication with the web server using SSL.

  • 28. 
    • A. 

      Require a digital signature on all outgoing emails.

    • B. 

      Sanitize outgoing content.

    • C. 

      Implement a data classification policy.

    • D. 

      Implement a SPAM filter.

  • 29. 
    • A. 

      Conduct web server load tests.

    • B. 

      Conduct static code analysis.

    • C. 

      Conduct fuzzing attacks.

    • D. 

      Conduct SQL injection and XSS attacks.

  • 30. 
    90. An organization must comply with a new regulation that requires the organization to determine if an external attacker is able to gain access to its systems from outside the network. Which of the following should the company conduct to meet the regulation’s criteria?
    • A. 

      Conduct a compliance review

    • B. 

      Conduct a vulnerability assessment

    • C. 

      Conduct a vulnerability assessment

    • D. 

      Conduct a full system audit