CAS-002 Exam Questions

A newly-hired Chief Information Security Officer (CISO) is faced with improving security for a company with low morale and numerous disgruntled employees. After reviewing the situa...

A new vendor product has been acquired to replace a legacy perimeter security product. There are significant time constraints due to the existing solution nearing end-of-life with...

The security administrator reports that the physical security of the Ethernet network has been breached, but the fibre channel storage network was not breached. Why might this stil...

When Company A and Company B merged, the network security administrator for Company A was tasked with joining the two networks. Which of the following should be done FIRST?

An organization recently upgraded its wireless infrastructure to support WPA2 and requires all clients to use this method. After the upgrade, several critical wireless clients fail...

A software vendor has had several zero-day attacks against its software, due to previously unknown security defects being exploited by attackers. The attackers have been able to pe...

The helpdesk department desires to roll out a remote support application for internal use on all company computers. This tool should allow remote desktop sharing, system log gather...

A mature organization with legacy information systems has incorporated numerous new processes and dependencies to manage security as its networks and infrastructure are modernized....

Noticing latency issues at its connection to the Internet, a company suspects that it is being targeted in a Distributed Denial of Service attack. A security analyst discovers nume...

A network administrator with a company's NSP has received a CERT alert for targeted adversarial behavior at the company. In addition to the company's physical security, which of th...

A company has decided to move to an agile software development methodology. The company gives all of its developers security training. After a year of agile, a management review fi...

A security administrator was recently hired in a start-up company to represent the interest of security and to assist the network team in improving security in the company. The sal...

A company wishes to purchase a new security appliance. A security administrator has extensively researched the appliances, and after presenting security choices to the company's ma...

A security company is developing a new cloud-based log analytics platform. Its purpose is to allow: - Customers to upload their log files to the "big data" platform - Customers to...

A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the followin...

A large hospital has implemented BYOD to allow doctors and specialists the ability to access patient medical records on their tablets. The doctors and specialists access patient re...

Which of the following is a set of interactive telecommunication technologies which allow two or more locations to interact via two-way video and audio transmissions simultaneously...

In which of the following attacks does an attacker intercept call-signaling SIP message traffic and masquerade as the calling party to the called party and vice-versa?

Consider the following scenario. A user receive an email with a link to a video about a news item, but another valid page, for instance a product page on ebay.com, can be hidden on...

Which of the following statements are true about OCSP and CRL? Each correct answer represents a complete solution. Choose all that apply.

An organization s network uses public keys for message encryption. Which of the following manages security credentials in the network and issues certificates to confirm the identit...

Which of the following protocols is used extensively in communication and entertainment systems that involve streaming media, such as telephony, video teleconference applications a...

Which of the following is an approximate of the average or mean time until a component's first failure or disruption in the operation of the product, process, procedure, or design...

The Security Development Lifecycle (SDL) consists of various security practices that are grouped under seven phases. Which of the following security practices are included in the R...

Which of the following components of a VoIP network is frequently used to bridge video conferencing connections?

Which technology can be used to help ensure the efficient transport of VoIP traffic?

An administrator wants to enable policy based flexible mandatory access controls on an open source OS to prevent abnormal application modifications or executions. Which of the foll...

A user has a laptop configured with multiple operating system installations. The operating systems are all installed on a single SSD, but each has its own partition and logical vol...

After being notified of an issue with the online shopping cart, where customers are able to arbitrarily change the price of listed items, a programmer analyzes the following piece...

The administrator is troubleshooting availability issues on an FCoE-based storage array that uses deduplication. The single controller in the storage array has failed, so the admin...

A security administrator notices the following line in a server's security log: <input name='credentials' type='TEXT' value='" + ='document.cookie</scri pt>') + "'; The administrat...

A popular commercial virtualization platform allows for the creation of virtual hardware. To virtual machines, this virtual hardware is indistinguishable from real hardware. By imp...

An organization is concerned with potential data loss in the event of a disaster, and created a backup datacenter as a mitigation strategy. The current storage method is a single N...

An application present on the majority of an organization's 1,000 systems is vulnerable to a buffer overflow attack. Which of the following is the MOST comprehensive way to resolve...

A security administrator wants to deploy a dedicated storage solution which is inexpensive, can natively integrate with AD, allows files to be selectively encrypted and is suitable...

A security administrator wants to prevent sensitive data residing on corporate laptops and desktops from leaking outside of the corporate network. The company has already implement...

Which of the following describes a risk and mitigation associated with cloud data storage?

An insurance company is looking to purchase a smaller company in another country. Which of the following tasks would the security administrator perform as part of the security due...

A new piece of ransomware got installed on a company's backup server which encrypted the hard drives containing the OS and backup application configuration but did not affect the d...

A security analyst has been asked to develop a quantitative risk analysis and risk assessment for the company's online shopping application. Based on heuristic information from the...

A security manager for a service provider has approved two vendors for connections to the service provider backbone. One vendor will be providing authentication services for its pa...

A large enterprise acquires another company which uses antivirus from a different vendor. The CISO has requested that data feeds from the two different antivirus platforms be combi...

Which of the following provides the BEST risk calculation methodology?

An assessor identifies automated methods for identifying security control compliance through validating sensors at the endpoint and at Tier 2. Which of the following practices sati...

The source workstation image for new accounting PCs has begun blue-screening. A technician notices that the date/time stamp of the image source appears to have changed. The desktop...

The technology steering committee is struggling with increased requirements stemming from an increase in telecommuting. The organization has not addressed telecommuting in the past...

A company is facing penalties for failing to effectively comply with e-discovery requests. Which of the following could reduce the overall risk to the company from this issue?

There have been some failures of the company's internal facing website. A security engineer has found the WAF to be the root cause of the failures. System logs show that the WAF ha...

A security firm is writing a response to an RFP from a customer that is building a new network based software product. The firm's expertise is in penetration testing corporate netw...

An external penetration tester compromised one of the client organization's authentication servers and retrieved the password database. Which of the following methods allows the pe...