Act now and download your CompTIA CAS-002 test today! Do not waste time for the worthless CompTIA CAS-002 tutorials. Download Avant-garde CompTIA CompTIA Advanced Security Practitioner (CASP) exam with real questions and answers and begin to learn CompTIA CAS-002 with a classic professional.

2021 Jan CAS-002 real exam

Q61. - (Topic 3) 

Which of the following is the BEST place to contractually document security priorities, responsibilities, guarantees, and warranties when dealing with outsourcing providers? 

A. NDA 

B. OLA 

C. MOU 

D. SLA 

Answer: D 


Q62. - (Topic 4) 

A retail bank has had a number of issues in regards to the integrity of sensitive information across all of its customer databases. This has resulted in the bank’s share price decreasing in value by 50% and regulatory intervention and monitoring. 

The new Chief Information Security Officer (CISO) as a result has initiated a program of work to solve the issues. 

The business has specified that the solution needs to be enterprise grade and meet the following requirements: 

In order to solve this problem, which of the following security solutions will BEST meet the above requirements? (Select THREE). 

A. Implement a security operations center to provide real time monitoring and incident response with self service reporting capability. 

B. Implement an aggregation based SIEM solution to be deployed on the log servers of the major platforms, applications, and infrastructure. 

C. Implement a security operations center to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capability. 

D. Ensure that the network operations center has the tools to provide real time monitoring and incident response and an event correlation dashboard with self service reporting capabilities. 

E. Implement an agent only based SIEM solution to be deployed on all major platforms, applications, and infrastructures. 

F. Ensure appropriate auditing is enabled to capture the required information. 

G. Manually pull the logs from the major platforms, applications, and infrastructures to a central secure server. 

Answer: B,C,F 


Q63. - (Topic 1) 

Joe, a hacker, has discovered he can specifically craft a webpage that when viewed in a browser crashes the browser and then allows him to gain remote code execution in the context of the victim’s privilege level. The browser crashes due to an exception error when a heap memory that is unused is accessed. Which of the following BEST describes the application issue? 

A. Integer overflow 

B. Click-jacking 

C. Race condition 

D. SQL injection 

E. Use after free 

F. Input validation 

Answer: E 


Q64. - (Topic 4) 

A systems administrator establishes a CIFS share on a Unix device to share data to windows systems. The security authentication on the windows domain is set to the highest level. Windows users are stating that they cannot authenticate to the Unix share. Which of the following settings on the Unix server is the cause of this problem? 

A. Refuse LM and only accept NTLMv2 

B. Accept only LM 

C. Refuse NTLMv2 and accept LM 

D. Accept only NTLM 

Answer: A 


Q65. - (Topic 5) 

Which of the following is the information owner responsible for? 

A. Developing policies, standards, and baselines. 

B. Determining the proper classification levels for data within the system. 

C. Integrating security considerations into application and system purchasing decisions. 

D. Implementing and evaluating security controls by validating the integrity of the data. 

Answer: B 


Leading CAS-002 exam price:

Q66. - (Topic 4) 

An audit at a popular on-line shopping site reveals that a flaw in the website allows customers to purchase goods at a discounted rate. To improve security the Chief Information Security Officer (CISO) has requested that the web based shopping cart application undergo testing to validate user input in both free form text fields and drop down boxes. 

Which of the following is the BEST combination of tools and / or methods to use? 

A. Blackbox testing and fingerprinting 

B. Code review and packet analyzer 

C. Fuzzer and HTTP interceptor 

D. Enumerator and vulnerability assessment 

Answer: C 


Q67. - (Topic 1) 

A security policy states that all applications on the network must have a password length of eight characters. There are three legacy applications on the network that cannot meet this policy. One system will be upgraded in six months, and two are not expected to be upgraded or removed from the network. Which of the following processes should be followed? 

A. Establish a risk matrix 

B. Inherit the risk for six months 

C. Provide a business justification to avoid the risk 

D. Provide a business justification for a risk exception 

Answer: D 


Q68. - (Topic 5) 

A security engineer has inherited an authentication project which integrates 1024-bit PKI certificates into the company infrastructure and now has a new requirement to integrate 2048-bit PKI certificates so that the entire company will be interoperable with its vendors when the project is completed. The project is now 25% complete, with 15% of the company staff being issued 1024-bit certificates. The provisioning of network based accounts has not occurred yet due to other project delays. The project is now expected to be over budget and behind its original schedule. Termination of the existing project and beginning a new project is a consideration because of the change in scope. Which of the following is the security engineer’s MOST serious concern with implementing this solution? 

A. Succession planning 

B. Performance 

C. Maintainability 

D. Availability 

Answer: C 


Q69. - (Topic 2) 

A company that must comply with regulations is searching for a laptop encryption product to use for its 40,000 end points. The product must meet regulations but also be flexible enough to minimize overhead and support in regards to password resets and lockouts. Which of the following implementations would BEST meet the needs? 

A. A partition-based software encryption product with a low-level boot protection and authentication 

B. A container-based encryption product that allows the end users to select which files to encrypt 

C. A full-disk hardware-based encryption product with a low-level boot protection and authentication 

D. A file-based encryption product using profiles to target areas on the file system to encrypt 

Answer: D 


Q70. - (Topic 4) 

A large international business has completed the acquisition of a small business and it is now in the process of integrating the small business’ IT department. Both parties have agreed that the large business will retain 95% of the smaller business’ IT staff. Additionally, the larger business has a strong interest in specific processes that the smaller business has in place to handle its regional interests. Which of the following IT security related objectives should the small business’ IT staff consider reviewing during the integration process? (Select TWO). 

A. How the large business operational procedures are implemented. 

B. The memorandum of understanding between the two businesses. 

C. New regulatory compliance requirements. 

D. Service level agreements between the small and the large business. 

E. The initial request for proposal drafted during the merger. 

F. The business continuity plan in place at the small business. 

Answer: A,C