CASP ? 181-210 Network Diagrams

30 Questions | Total Attempts: 273

SettingsSettingsSettings
CASP ? 181-210 Network Diagrams

CASP? 181-210 Network Diagrams


Questions and Answers
  • 1. 
    Which of the following are security components provided by an application security library orframework? (Select THREE).
    • A. 

      Directory services

    • B. 

      Encryption and decryption

    • C. 

      Authorization database

    • D. 

      Fault injection

    • E. 

      Input validation

    • F. 

      Secure logging

  • 2. 
    Which of the following potential vulnerabilities exists in the following code snippet?var myEmail = document.getElementById(“formInputEmail”).value;if (xmlhttp.readyState==4 && xmlhttp.status==200){Document.getElementById(“profileBox”).innerHTML = “Emails will be sent to “ + myEmail +xmlhttp.responseText;}
    • A. 

      Javascript buffer overflow

    • B. 

      AJAX XHR weaknesses

    • C. 

      DOM-based XSS

    • D. 

      JSON weaknesses

  • 3. 
    The Chief Information Security Officer (CISO) has just returned from attending a securityconference and now wants to implement a Security Operations Center (SOC) to improve andcoordinate the detection of unauthorized access to the enterprise. The CISO’s biggest concern isthe increased number of attacks that the current infrastructure cannot detect. Which of thefollowing is MOST likely to be used in a SOC to address the CISO’s concerns?
    • A. 

      DLP, Analytics, SIEM, Forensics, NIPS, HIPS, WIPS and eGRC

    • B. 

      Forensics, White box testing, Log correlation, HIDS, and SSO

    • C. 

      Vulnerability assessments, NIDP, HIDS, SCAP, Analytics and SIEM

    • D. 

      EGRC, WIPS, Federated ID, Network enumerator, NIPS and Port Scanners

  • 4. 
    The IT Manager has mandated that an extensible markup language be implemented which can beused to exchange provisioning requests and responses for account creation. Which of thefollowing is BEST able to achieve this?
    • A. 

      XACML

    • B. 

      SAML

    • C. 

      SOAP

    • D. 

      SPML

  • 5. 
    A company is planning to deploy an in-house Security Operations Center (SOC).One of the new requirements is to deploy a NIPS solution into the Internet facing environment.The SOC highlighted the following requirements:Perform fingerprinting on unfiltered inbound traffic to the companyMonitor all inbound and outbound traffic to the DMZ'sIn which of the following places should the NIPS be placed in the network?
    • A. 

      In front of the Internet firewall and in front of the DMZs

    • B. 

      In front of the Internet firewall and in front of the internal firewall

    • C. 

      In front of the Internet firewall and behind the internal firewall

    • D. 

      Behind the Internet firewall and in front of the DMZs

  • 6. 
    A company recently experienced a malware outbreak. It was caused by a vendor using anapproved non-company device on the company’s corporate network that impacted manufacturinglines, causing a week of downtime to recover from the attack. Which of the following reduces thisthreat and minimizes potential impact on the manufacturing lines?
    • A. 

      Disable remote access capabilities on manufacturing SCADA systems.

    • B. 

      Require a NIPS for all communications to and from manufacturing SCADA systems.

    • C. 

      Add anti-virus and client firewall capabilities to the manufacturing SCADA systems.

    • D. 

      Deploy an ACL that restricts access from the corporate network to the manufacturing SCADA systems.

  • 7. 
    Capital Reconnaissance, LLC is building a brand new research and testing location, and thephysical security manager wants to deploy IP-based access control and video surveillance. Thesetwo systems are essential for keeping the building open for operations. Which of the followingcontrols should the security administrator recommend to determine new threats against the newIP-based access control and video surveillance systems?
    • A. 

      Develop a network traffic baseline for each of the physical security systems.

    • B. 

      Air gap the physical security networks from the administrative and operational networks.

    • C. 

      Require separate non-VLANed networks and NIPS for each physical security system network.

    • D. 

      Have the Network Operations Center (NOC) review logs and create a CERT to respond to breaches.

  • 8. 
    A company has recently implemented a video conference solution that uses the H.323 protocol.The security engineer is asked to make recommendations on how to secure video conferences toprotect confidentiality. Which of the following should the security engineer recommend?
    • A. 

      Implement H.235 extensions with DES to secure the audio and video transport.

    • B. 

      Recommend moving to SIP and RTP as those protocols are inherently secure.

    • C. 

      Recommend implementing G.711 for the audio channel and H.264 for the video.

    • D. 

      Encapsulate the audio channel in the G.711 codec rather than the unsecured Speex.

  • 9. 
    A healthcare company recently purchased the building next door located on the same campus.The building previously did not have any IT infrastructure. The building manager has selected fourpotential locations to place IT equipment consisting of a half height open server rack with fiveswitches, a router, a firewall, and two servers. Given the descriptions below, where would thesecurity engineer MOST likely recommend placing the rack?The Boiler Room: The rack can be placed 5 feet (1.5 meters) up on the wall, between the secondand third boiler. The room is locked and only maintenance has access to it.The Reception AreA. The reception area is an open area right as customers enter. There is acloset 5 feet by 5 feet (1.5 meters by 1.5 meters) that the rack will be placed in with floor mounts.There is a 3 digit PIN lock that the receptionist sets.The Rehabilitation AreA. The rack needs to be out of the way from patients using the whirlpoolbath, so it will be wall mounted 8 feet (2.4 meters) up as the area has high ceilings. The rehabarea is staffed full time and admittance is by key card only.The Finance AreA. There is an unused office in the corner of the area that can be used for theserver rack. The rack will be floor mounted. The finance area is locked and alarmed at night.
    • A. 

      The Rehabilitation Area

    • B. 

      The Reception Area

    • C. 

      The Boiler Room

    • D. 

      The Finance Area

  • 10. 
    A network security engineer would like to allow authorized groups to access network devices witha shell restricted to only show information while still authenticating the administrator's group to anunrestricted shell. Which of the following can be configured to authenticate and enforce these shellrestrictions? (Select TWO).
    • A. 

      Single Sign On

    • B. 

      Active Directory

    • C. 

      Kerberos

    • D. 

      NIS+

    • E. 

      RADIUS

    • F. 

      TACACS+

  • 11. 
    An administrator is unable to connect to a server via VNC. Upon investigating the host firewallconfiguration, the administrator sees the following lines:A INPUT -m state --state NEW -m tcp -p tcp --dport 3389 -j DENYA INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j DENYA INPUT -m state --state NEW -m tcp -p tcp --dport 10000 -j ACCEPTA INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j DENYA INPUT -m state --state NEW -m tcp -p tcp --sport 3389 -j ACCEPTWhich of the following should occur to allow VNC access to the server?
    • A. 

      DENY needs to be changed to ACCEPT on one line.

    • B. 

      A line needs to be added.

    • C. 

      A line needs to be removed.

    • D. 

      Fix the typo in one line.

  • 12. 
    Company A is trying to implement controls to reduce costs and time spent on litigation. Toaccomplish this, Company A has established several goals:Prevent data breaches from lost/stolen assetsReduce time to fulfill e-discovery requestsPrevent PII from leaving the networkLessen the network perimeter attack surfaceReduce internal fraudWhich of the following solutions accomplishes the MOST of these goals?
    • A. 

      Implement separation of duties; enable full encryption on USB devices and cell phones, allow cell phones to remotely connect to e-mail and network VPN, enforce a 90 day data retention policy.

    • B. 

      Eliminate VPN access from remote devices. Restrict junior administrators to read-only shell access on network devices. Install virus scanning and SPAM filtering. Harden all servers with trusted OS extensions.

    • C. 

      Create a change control process with stakeholder review board, implement separation of duties and mandatory vacation, create regular SAN snapshots, enable GPS tracking on all cell phones and laptops, and fully encrypt all email in transport.

    • D. 

      Implement outgoing mail sanitation and incoming SPAM filtering. Allow VPN for mobile devices; cross train managers in multiple disciplines, ensure all corporate USB drives are provided by Company A and de-duplicate all server storage.

  • 13. 
    A security architect is seeking to outsource company server resources to a commercial cloudservice provider. The provider under consideration has a reputation for poorly controlling physicalaccess to datacenters and has been the victim of multiple social engineering attacks. The serviceprovider regularly assigns VMs from multiple clients to the same physical resources. Whenconducting the final risk assessment which of the following should the security architect take intoconsideration?
    • A. 

      The ability to implement user training programs for the purpose of educating internal staff about the dangers of social engineering.

    • B. 

      The cost of resources required to relocate services in the event of resource exhaustion on a particular VM.

    • C. 

      The likelihood a malicious user will obtain proprietary information by gaining local access to the hypervisor platform.

    • D. 

      Annual loss expectancy resulting from social engineering attacks against the cloud service provider affecting corporate network infrastructure.

  • 14. 
    The root cause analysis of a recent security incident reveals that an attacker accessed a printerfrom the Internet. The attacker then accessed the print server, using the printer as a launch padfor a shell exploit. The print server logs show that the attacker was able to exploit multipleaccounts, ultimately launching a successful DoS attack on the domain controller. Defendingagainst which of the following attacks should form the basis of the incident mitigation plan?
    • A. 

      DDoS

    • B. 

      SYN flood

    • C. 

      Buffer overflow

    • D. 

      Privilege escalation

  • 15. 
    An existing enterprise architecture included an enclave where sensitive research and developmentwork was conducted. This network enclave also served as a storage location for proprietarycorporate data and records. The initial security architect chose to protect the enclave by restrictingaccess to a single physical port on a firewall. All downstream network devices were isolated fromthe rest of the network and communicated solely through the single 100mbps firewall port. Overtime, researchers connected devices on the protected enclave directly to external resources andcorporate data stores. Mobile and wireless devices were also added to the enclave to support highspeed data research. Which of the following BEST describes the process which weakened thesecurity posture of the enclave?
    • A. 

      Emerging business requirements led to the de-perimiterization of the network.

    • B. 

      Emerging security threats rendered the existing architecture obsolete.

    • C. 

      The single firewall port was oversaturated with network packets.

    • D. 

      The shrinking of an overall attack surface due to the additional access.

  • 16. 
    At one time, security architecture best practices led to networks with a limited number (1-3) ofnetwork access points. This restriction allowed for the concentration of security resources andresulted in a well defined attack surface. The introduction of wireless networks, highly portablenetwork devices, and cloud service providers has rendered the network boundary and attacksurface increasingly porous. This evolution of the security architecture has led to which of the following?
    • A. 

      Increased security capabilities, the same amount of security risks and a higher TCO but a smaller corporate data center on average.

    • B. 

      Increased business capabilities and increased security risks with a lower TCO and smaller physical footprint on the corporate network.

    • C. 

      Increased business capabilities and increased security risks with a higher TCO and a larger physical footprint.

    • D. 

      Decreased business capabilities and increased security risks with a lower TCO and increased logical footprint due to virtualization.

  • 17. 
    An administrator notices the following file in the Linux server’s /tmp directory.-rwsr-xr-x. 4 root root 234223 Jun 6 22:52 bash*Which of the following should be done to prevent further attacks of this nature?
    • A. 

      Never mount the /tmp directory over NFS

    • B. 

      Stop the rpcidmapd service from running

    • C. 

      Mount all tmp directories nosuid, noexec

    • D. 

      Restrict access to the /tmp directory

  • 18. 
    Company ABC has entered into a marketing agreement with Company XYZ, whereby ABC willshare some of its customer information with XYZ. However, XYZ can only contact ABC customerswho explicitly agreed to being contacted by third parties. Which of the following documents wouldcontain the details of this marketing agreement?
    • A. 

      BPA

    • B. 

      ISA

    • C. 

      NDA

    • D. 

      SLA

  • 19. 
    Company ABC has a 100Mbps fiber connection from headquarters to a remote office 200km (123miles) away. This connection is provided by the local cable television company. ABC would like toextend a secure VLAN to the remote office, but the cable company says this is impossible sincethey already use VLANs on their internal network. Which of the following protocols should thecable company be using to allow their customers to establish VLANs to other sites?
    • A. 

      IS-IS

    • B. 

      EIGRP

    • C. 

      MPLS

    • D. 

      802.1q

  • 20. 
    An ecommerce application on a Linux server does not properly track the number of incomingconnections to the server and may leave the server vulnerable to which of following?
    • A. 

      Buffer Overflow Attack

    • B. 

      Storage Consumption Attack

    • C. 

      Denial of Service Attack

    • D. 

      Race Condition

  • 21. 
    Company A has a remote work force that often includes independent contractors and out of statefull time employees. Company A's security engineer has been asked to implement a solution allowing these users to collaborate on projects with the following goals:-All communications between parties need to be encrypted in transportUsers must all have the same application sets at the same versionAll data must remain at Company A's siteAll users must not access the system between 12:00 and 1:00 as that is the maintenancewindowEasy to maintain, patch and change application environmentWhich of the following solutions should the security engineer recommend to meet the MOSTgoals?
    • A. 

      Create an SSL reverse proxy to a collaboration workspace. Use remote installation service to maintain application version. Have users use full desktop encryption. Schedule server downtime from 12:00 to 1:00 PM.

    • B. 

      Install an SSL VPN to Company A's datacenter, have users connect to a standard virtual workstation image, set workstation time of day restrictions.

    • C. 

      Create an extranet web portal using third party web based office applications. Ensure that Company A maintains the administrative access.

    • D. 

      Schedule server downtime from 12:00 to 1:00 PM, implement a Terminal Server Gateway, use remote installation services to standardize application on user’s laptops.

  • 22. 
    • A. 

      Option 1

    • B. 

      Option 2

    • C. 

      Option 3

    • D. 

      Option 4

  • 23. 
    • A. 

      Answer: You need to check the hash value of download software with md5 utility.

    • B. 

      Option 2

  • 24. 
    Compliance with company policy requires a quarterly review of firewall rules. A new administrator is asked to conduct this review on the internal firewall sitting between several internal networks. The intent of this firewall is to make traffic more restrictive. Given the following information answer the questions below.User Subnet 192.168.1.0/24Server Subnet 192.168.2.0/24Finance Subnet 192.168.3.0/24Instructions: To perform the necessary tasks, please modify the DST port, Protocol, Action and/or rule order columns, Firewall ACLs and read from the top down administrator added a rule to allow their machine terminal server access to the sever subnet. This is not working. Identify this rule and correct this web servers have been changed to communicate soley over SSL. Modify the appropriate rule to allow communications. Administrator added a rule to block access to the SQL server from anywhere on the network. This rule is not working. Identify and correct this issue. Other than allowing all hosts to do network time and SSL, modify a rule to ensure that no other traffic is allowed.
    • A. 

      Option 4

    • B. 

      192.18.1.0/24 any 192.168.20.0/24 3389 any

  • 25. 
    The IDS has detected abnormal behavior on this network. Click on the network devices to view device information. Based on this information, the following tasks need to be completed.1. Select the server that is a victim of a SQL injection attack.2. Select the source of the buffer overflow attack.3. Modify the access control list (ACL) on the routers to ONLY block the buffer overflow attack.
    • A. 
    • B. 

      Answer: Follow the Steps as 1) Click on the server and find the SQL Server then Note the ip address of the server 2)click on the host machine and find the attacker then note the ip adddress of the host 3)check the host machine ip address in router ac source field and SQL Server ip in destination field and check the deny and uncheck the permit

Related Topics
Back to Top Back to top