How Does Pass4sure CompTIA CAS-002 free practice questions Work?

New Questions 9

Part of the procedure for decommissioning a database server is to wipe all local disks, as well as SAN LUNs allocated to the server, even though the SAN itself is not being decommissioned. Which of the following is the reason for wiping the SAN LUNs?

A. LUN masking will prevent the next server from accessing the LUNs.

B. The data may be replicated to other sites that are not as secure.

C. Data remnants remain on the LUN that could be read by other servers.

D. The data is not encrypted during transport.

New Questions 10

The manager of the firewall team is getting complaints from various IT teams that firewall changes are causing issues. Which of the following should the manager recommend to BEST address these issues?

A. Set up a weekly review for relevant teams to discuss upcoming changes likely to have a broad impact.

B. Update the change request form so that requesting teams can provide additional details about the requested changes.

C. Require every new firewall rule go through a secondary firewall administrator for review before pushing the firewall policy.

D. Require the firewall team to verify the change with the requesting team before pushing the updated firewall policy.

New Questions 11

The security administrator is reviewing the business continuity plan which consists of virtual infrastructures at corporate headquarters and at the backup site. The administrator is concerned that the VLAN used to perform live migrations of virtual machines to the backup site is across the network provideru2021s MPLS network. This is a concern due to which of the following?

A. The hypervisor virtual switches only support Q-in-Q VLANS, not MPLS. This may cause live migrations to the backup site to fail.

B. VLANs are not compatible with MPLS, which may cause intermittent failures while performing live migrations virtual machines during a disaster.

C. Passwords are stored unencrypted in memory, which are then transported across the MPLS network.

D. Transport encryption is being used during the live migration of virtual machines which will impact the performance of the MPLS network.

New Questions 12

A security administrator needs to deploy a remote access solution for both staff and contractors. Management favors remote desktop due to ease of use. The current risk assessment suggests protecting Windows as much as possible from direct ingress traffic exposure. Which of the following solutions should be selected?

A. Deploy a remote desktop server on your internal LAN, and require an active directory integrated SSL connection for access.

B. Change remote desktop to a non-standard port, and implement password complexity for the entire active directory domain.

C. Distribute new IPSec VPN client software to applicable parties. Virtualize remote desktop services functionality.

A. D. Place the remote desktop server(s) on a screened subnet, and implement two-factor authentication.

New Questions 13

A penetration tester is assessing a mobile banking application. Man-in-the-middle attempts via a HTTP intercepting proxy are failing with SSL errors. Which of the following controls has likely been implemented by the developers?

A. SSL certificate revocation

B. SSL certificate pinning

A. C. Mobile device root-kit detection

D. Extended Validation certificates

New Questions 14

A forensic analyst receives a hard drive containing malware quarantined by the antivirus application. After creating an image and determining the directory location of the malware file, which of the following helps to determine when the system became infected?

A. The malware fileu2021s modify, access, change time properties.

B. The timeline analysis of the file system.

C. The time stamp of the malware in the swap file.

D. The date/time stamp of the malware detection in the antivirus logs.

New Questions 15

A security engineer has inherited an authentication project which integrates 1024-bit PKI certificates into the company infrastructure and now has a new requirement to integrate 2048-bit PKI certificates so that the entire company will be interoperable with its vendors when the project is completed. The project is now 25% complete, with 15% of the company staff being issued 1024-bit certificates. The provisioning of network based accounts has not occurred yet due to other project delays. The project is now expected to be over budget and behind its original schedule. Termination of the existing project and beginning a new project is a consideration because of the change in scope. Which of the following is the security engineeru2021s MOST serious concern with implementing this solution?

A. Succession planning

B. Performance

C. Maintainability

A. D. Availability

New Questions 16

A large organization that builds and configures every data center against distinct requirements loses efficiency, which results in slow response time to resolve issues. However, total uniformity presents other problems. Which of the following presents the GREATEST risk when consolidating to a single vendor or design solution?

A. Competitors gain an advantage by increasing their service offerings.

B. Vendor lock in may prevent negotiation of lower rates or prices.

C. Design constraints violate the principle of open design.

D. Lack of diversity increases the impact of specific events or attacks.

New Questions 17

The organization has an IT driver on cloud computing to improve delivery times for IT solution provisioning. Separate to this initiative, a business case has been approved for replacing the existing banking platform for credit card processing with a newer offering. It is the security practitioneru2021s responsibility to evaluate whether the new credit card processing platform can be hosted within a cloud environment. Which of the following BEST balances the security risk and IT drivers for cloud computing?

A. A third-party cloud computing platform makes sense for new IT solutions. This should be endorsed going forward so as to align with the IT strategy. However, the security practitioner will need to ensure that the third-party cloud provider does regular penetration tests to ensure that all data is secure.

B. Using a third-party cloud computing environment should be endorsed going forward. This aligns with the organizationu2021s strategic direction. It also helps to shift any risk and regulatory compliance concerns away from the companyu2021s internal IT department. The next step will be to evaluate each of the cloud computing vendors, so that a vendor can then be selected for hosting the new credit card processing platform.

C. There may be regulatory restrictions with credit cards being processed out of country or processed by shared hosting providers. A private cloud within the company should be considered. An options paper should be created which outlines the risks, advantages, disadvantages of relevant choices and it should recommended a way forward.

D. Cloud computing should rarely be considered an option for any processes that need to be significantly secured. The security practitioner needs to convince the stakeholders that the new platform can only be delivered internally on physical infrastructure.

New Questions 18

A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security into the application deployment. The board is primarily concerned with the applicationsu2021 compliance with federal assessment and authorization standards. The security engineer asks for a timeline to determine when a security assessment of both applications should occur and does not attend subsequent configuration board meetings. If the security engineer is only going to perform a security assessment, which of the following steps in system authorization has the security engineer omitted? (Select TWO).

A. Establish the security control baseline to be assessed

B. Build the application according to software development security standards

C. Write the systems functionality requirements into the security requirements traceability matrix

D. Review the results of user acceptance testing

E. Categorize the applications according to use

F. Consult with the stakeholders to determine which standards can be omitted