Free CompTIA CAS-002 Exam Dumps Questions & Answers

The sales team is considering the deployment of a new CRM solution within the enterprise.
The IT and Security teams are members of the project; however, neither team has expertise or experience with the proposed system. Which of the following activities should be performed FIRST?

• A.  Contact the top vendor, assign IT and Security to work together to implement a demo and pen test the system.
• B.  Work with Finance to do a second ROI calculation before continuing further with the project.
• C.  Research the market, select the top vendors and solicit RFPs from those vendors.
• D.  Visit a company who already has the technology, sign an NDA, and read their latest risk assessment.

A large financial company has a team of security-focused architects and designers that contribute into broader IT architecture and design solutions. Concerns have been raised due to the security contributions having varying levels of quality and consistency. It has been agreed that a more formalized methodology is needed that can take business drivers, capabilities, baselines, and re-usable patterns into account. Which of the following would BEST help to achieve these objectives?

• A.  Construct a library of re-usable security patterns
• B.  Construct a security control library
• C.  Include SRTM in the SDLC
• D.  Introduce an ESA framework

A company is in the process of implementing a new front end user interface for its customers, the goal is to provide them with more self service functionality. The application has been written by developers over the last six months and the project is currently in the test phase.
Which of the following security activities should be implemented as part of the SDL in order to provide the MOST security coverage over the solution? (Select TWO).

• A.  Perform static code review over the front end source code
• B.  Perform unit testing of the binary code
• C.  Perform black box penetration testing over the solution
• D.  Perform code review over a sampling of the front end source code
• E.  Perform grey box penetration testing over the solution

The lead systems architect on a software development project developed a design which is optimized for a distributed computing environment. The security architect assigned to the project has concerns about the integrity of the system, if it is deployed in a commercial cloud. Due to poor communication within the team, the security risks of the proposed design are not being given any attention. A network engineer on the project has a security background and is concerned about the overall success of the project. Which of the following is the BEST course of action for the network engineer to take?

• A.  Address the security concerns through the network design and security controls.
• B.  Develop a proposal for an alternative architecture that does not leverage cloud computing and present it to the lead architect.
• C.  Document mitigations to the security concerns and facilitate a meeting between the architects and the project manager.
• D.  Implement mitigations to the security risks and address the poor communications on the team with the project manager.

Continuous monitoring is a popular risk reduction technique in many large organizations with formal certification processes for IT projects. In order to implement continuous monitoring in an effective manner which of the following is correct?

• A.  All logs must be centrally managed and access to the logs restricted only to data storage staff.
• B.  Only security related alerts should be forwarded to the network team for resolution.
• C.  Critical logs must be monitored hourly and adequate staff must be assigned to the network team.
• D.  Logging must be set appropriately and alerts delivered to security staff in a timely manner.