Free CompTIA CAS-002 Exam Dumps Questions & Answers

The IT Security Analyst for a small organization is working on a customer's system and identifies a possible intrusion in a database that contains PII. Since PII is involved, the analyst wants to get the issue addressed as soon as possible. Which of the following is the FIRST step the analyst should take in mitigating the impact of the potential intrusion?

• A.  Refer the issue to management for handling according to the incident response process.
• B.  Disable the front-end web server and notify the customer by email to determine how the customer would like to proceed.
• C.  Contact the local authorities so an investigation can be started as quickly as possible.
• D.  Shut down the production network interfaces on the server and change all of the DBMS account passwords.

The Information Security Officer (ISO) believes that the company has been targeted by cybercriminals and it is under a cyber attack. Internal services that are normally available to the public via the Internet are inaccessible, and employees in the office are unable to browse the Internet. The senior security engineer starts by reviewing the bandwidth at the border router, and notices that the incoming bandwidth on the router's external interface is maxed out. The security engineer then inspects the following piece of log to try and determine the reason for the downtime, focusing on the company's external router's IP which is 128.20.176.19:
11:16:22.110343 IP 90.237.31.27.19 > 128.20.176.19.19: UDP, length 1400
11:16:22.110351 IP 23.27.112.200.19 > 128.20.176.19.19: UDP, length 1400
11:16:22.110358 IP 192.200.132.213.19 > 128.20.176.19.19: UDP, length 1400
11:16:22.110402 IP 70.192.2.55.19 > 128.20.176.19.19: UDP, length 1400
11:16:22.110406 IP 112.201.7.39.19 > 128.20.176.19.19: UDP, length 1400 Which of the following describes the findings the senior security engineer should report to the ISO and the BEST solution for service restoration?

• A.  After the senior engineer used a packet capture to identify an active Smurf attack, an ACL should be placed on the company's external router to block incoming UDP port 19 traffic.
• B.  After the senior engineer used a network analyzer to identify an active Fraggle attack, the company's ISP should be contacted and instructed to block the malicious packets.
• C.  After the senior engineer used the above IPS logs to detect the ongoing DDOS attack, an IPS filter should be enabled to block the attack and restore communication.
• D.  After the senior engineer used a mirror port to capture the ongoing amplification attack, a BGP sinkhole should be configured to drop traffic at the source networks.

A bank now has a major initiative to virtualize as many servers as possible, due to power and rack space capacity at both data centers. The bank has prioritized by virtualizing older servers first as the hardware is nearing end-of-life.
The two initial migrations include:
Windows 2000 hosts: domain controllers and front-facing web servers RHEL3 hosts: front- facing web servers Which of the following should the security consultant recommend based on best practices?

• A.  One virtual environment should be present at each data center, each housing a combination of the converted Windows 2000 and RHEL3 virtual machines.
• B.  Each data center should contain one virtual environment housing converted Windows
  2000 virtual machines and converted RHEL3 virtual machines.
• C.  Each data center should contain one virtual environment for the web servers and another virtual environment for the domain controllers.
• D.  One data center should host virtualized web servers and the second data center should host the virtualized domain controllers.

During a software development project review, the cryptographic engineer advises the project manager that security can be greatly improved by significantly slowing down the runtime of a hashing algorithm and increasing the entropy by passing the input and salt back during each iteration. Which of the following BEST describes what the engineer is trying to achieve?

• A.  Diffusion
• B.  Key stretching
• C.  Monoalphabetic cipher
• D.  Root of trust
• E.  Confusion

A company Chief Information Officer (CIO) is unsure which set of standards should govern the company's IT policy. The CIO has hired consultants to develop use cases to test against various government and industry security standards. The CIO is convinced that there is large overlap between the configuration checks and security controls governing each set of standards. Which of the following selections represent the BEST option for the CIO?

• A.  Issue a policy that requires only the most stringent security standards be implemented throughout the company.
• B.  Issue a policy specifying best practice security standards and a baseline to be implemented across the company.
• C.  Issue a RFQ for vendors to quote a complete vulnerability and risk management solution to the company.
• D.  Issue a RFI for vendors to determine which set of security standards is best for the company.