Exam Code: CAS-002 (Practice Exam Latest Test Questions VCE PDF)
Exam Name: CompTIA Advanced Security Practitioner (CASP)
Certification Provider: CompTIA
Free Today! Guaranteed Training- Pass CAS-002 Exam.

2021 Jan CAS-002 exam guide

Q21. - (Topic 5) 

The manager of the firewall team is getting complaints from various IT teams that firewall changes are causing issues. Which of the following should the manager recommend to BEST address these issues? 

A. Set up a weekly review for relevant teams to discuss upcoming changes likely to have a broad impact. 

B. Update the change request form so that requesting teams can provide additional details about the requested changes. 

C. Require every new firewall rule go through a secondary firewall administrator for review before pushing the firewall policy. 

D. Require the firewall team to verify the change with the requesting team before pushing the updated firewall policy. 

Answer: A 


Q22. - (Topic 4) 

Which of the following are components defined within an Enterprise Security Architecture Framework? (Select THREE). 

A. Implementation run-sheets 

B. Solution designs 

C. Business capabilities 

D. Solution architectures 

E. Business requirements documents 

F. Reference models 

G. Business cases 

H. Business vision and drivers 

Answer: C,F,H 


Q23. - (Topic 3) 

A database administrator comes across the below records in one of the databases during an internal audit of the payment system: 

UserIDAddressCredit Card No.Password 

jsmith123 fake street55XX-XXX-XXXX-1397Password100 

jqdoe234 fake street42XX-XXX-XXXX-202717DEC12 

From a security perspective, which of the following should be the administrator’s GREATEST concern, and what will correct the concern? 

A. Concern: Passwords are stored in plain text. Correction: Require a minimum of 8 alphanumeric characters and hash the password. 

B. Concern: User IDs are also usernames, and could be enumerated, thereby disclosing sensitive account information. Correction: Require user IDs to be more complex by using alphanumeric characters and hash the UserIDs. 

C. Concern: User IDs are confidential private information. Correction: Require encryption of user IDs. 

D. Concern: More than four digits within a credit card number are stored. Correction: Only store the last four digits of a credit card to protect sensitive financial information. 

Answer: A 


Q24. - (Topic 2) 

A company has noticed recently that its corporate information has ended up on an online forum. An investigation has identified that internal employees are sharing confidential corporate information on a daily basis. Which of the following are the MOST effective security controls that can be implemented to stop the above problem? (Select TWO). 

A. Implement a URL filter to block the online forum 

B. Implement NIDS on the desktop and DMZ networks 

C. Security awareness compliance training for all employees 

D. Implement DLP on the desktop, email gateway, and web proxies 

E. Review of security policies and procedures 

Answer: C,D 


Q25. - (Topic 1) 

A security administrator was doing a packet capture and noticed a system communicating with an unauthorized address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network. Which of the following is the BEST course of action? 

A. Investigate the network traffic and block UDP port 3544 at the firewall 

B. Remove the system from the network and disable IPv6 at the router 

C. Locate and remove the unauthorized 6to4 relay from the network 

D. Disable the switch port and block the 2001::/32 traffic at the firewall 

Answer: A 


Improve CAS-002 simulations:

Q26. - (Topic 2) 

During an incident involving the company main database, a team of forensics experts is hired to respond to the breach. The team is in charge of collecting forensics evidence from the company’s database server. Which of the following is the correct order in which the forensics team should engage? 

A. Notify senior management, secure the scene, capture volatile storage, capture non-volatile storage, implement chain of custody, and analyze original media. 

B. Take inventory, secure the scene, capture RAM, capture had drive, implement chain of custody, document, and analyze the data. 

C. Implement chain of custody, take inventory, secure the scene, capture volatile and non-volatile storage, and document the findings. 

D. Secure the scene, take inventory, capture volatile storage, capture non-volatile storage, document, and implement chain of custody. 

Answer: D 


Q27. - (Topic 1) 

A completely new class of web-based vulnerabilities has been discovered. Claims have been made that all common web-based development frameworks are susceptible to attack. Proof-of-concept details have emerged on the Internet. A security advisor within a company has been asked to provide recommendations on how to respond quickly to these vulnerabilities. Which of the following BEST describes how the security advisor should respond? 

A. Assess the reliability of the information source, likelihood of exploitability, and impact to hosted data. Attempt to exploit via the proof-of-concept code. Consider remediation options. 

B. Hire an independent security consulting agency to perform a penetration test of the web servers. Advise management of any ‘high’ or ‘critical’ penetration test findings and put forward recommendations for mitigation. 

C. Review vulnerability write-ups posted on the Internet. Respond to management with a recommendation to wait until the news has been independently verified by software vendors providing the web application software. 

D. Notify all customers about the threat to their hosted data. Bring the web servers down into “maintenance mode” until the vulnerability can be reliably mitigated through a vendor patch. 

Answer: A 


Q28. - (Topic 4) 

The senior security administrator wants to redesign the company DMZ to minimize the risks associated with both external and internal threats. The DMZ design must support security in depth, change management and configuration processes, and support incident reconstruction. Which of the following designs BEST supports the given requirements? 

A. A dual firewall DMZ with remote logging where each firewall is managed by a separate administrator. 

B. A single firewall DMZ where each firewall interface is managed by a separate administrator and logging to the cloud. 

C. A SaaS based firewall which logs to the company’s local storage via SSL, and is managed by the change control team. 

D. A virtualized firewall, where each virtual instance is managed by a separate administrator and logging to the same hardware. 

Answer: A 


Q29. - (Topic 2) 

A trucking company delivers products all over the country. The executives at the company would like to have better insight into the location of their drivers to ensure the shipments are following secure routes. Which of the following would BEST help the executives meet this goal? 

A. Install GSM tracking on each product for end-to-end delivery visibility. 

B. Implement geo-fencing to track products. 

C. Require drivers to geo-tag documentation at each delivery location. 

D. Equip each truck with an RFID tag for location services. 

Answer: B 


Q30. - (Topic 4) 

Which of the following BEST explains SAML? 

A. A security attestation model built on XML and SOAP-based services, which allows for the exchange of A&A data between systems and supports Federated Identity Management. 

B. An XML and SOAP-based protocol, which enables the use of PKI for code signing and SSO by using SSL and SSH to establish a trust model. 

C. A security model built on the transfer of assertions over XML and SOAP-based protocols, which allows for seamless SSO and the open exchange of data. 

D. A security verification model built on SSO and SSL-based services, which allows for the exchange of PKI data between users and supports XACML. 

Answer: A