CAS-002 Exam Questions
884 real CAS-002 exam questions with expert-verified answers and explanations. Page 16 of 18.
- Question #763Technical Integration of Enterprise Components
A web services company is planning a one-time high-profile event to be hosted on the corporate website. An outage, due to an attack, would be publicly embarrassing, so Joe, the Chi...
DDoS mitigationscrubbing servicesavailabilityweb hosting security - Question #764Research and Analysis
A security engineer is responsible for monitoring company applications for known vulnerabilities. Which of the following is a way to stay current on exploits and information securi...
vulnerability monitoringsecurity mailing liststhreat intelligencepatch management - Question #765Integration of Computing, Communications and Business Disciplines
The Chief Executive Officer (CEO) of a small start-up company wants to set up offices around the country for the sales staff to generate business. The company needs an effective co...
social media policybusiness communicationssecurity policycorporate communications - Question #767Integration of Computing, Communications and Business Disciplines
A security administrator wants to calculate the ROI of a security design which includes the purchase of new equipment. The equipment costs $50,000 and it will take 50 hours to inst...
ROI calculationsecurity investmentcost-benefit analysisfinancial metrics - Question #768Research and Analysis
A security consultant is conducting a network assessment and wishes to discover any legacy backup Internet connections the network may have. Where would the consultant find this in...
network reconnaissanceBGP routing tablesbackup connectionsnetwork assessment - Question #769Enterprise Security
A network administrator with a company's NSP has received a CERT alert for targeted adversarial behavior at the company. In addition to the company's physical security, which of th...
HIDSprotocol analyzerinsider threat detectionintrusion detection - Question #770Integration of Computing, Communications and Business Disciplines
A human resources manager at a software development company has been tasked with recruiting personnel for a new cyber defense division in the company. This division will require pe...
workforce recruitmentprofessional developmentindustry knowledgecyber workforce - Question #771Research and Analysis
A small company's Chief Executive Officer (CEO) has asked its Chief Security Officer (CSO) to improve the company's security posture quickly with regard to targeted attacks. Which...
threat intelligencethreat feedstargeted attackssecurity posture - Question #772Technical Integration of Enterprise Components
A security engineer is working on a large software development project. As part of the design of the project, various stakeholder requirements were gathered and decomposed to an im...
SRTMsecurity requirementsrequirements traceabilitySDLC - Question #773Enterprise Security
A security engineer is a new member to a configuration board at the request of management. The company has two new major IT projects starting this year and wants to plan security i...
security assessmentNIST RMFfederal complianceconfiguration management - Question #774Enterprise Security
An analyst connects to a company web conference hosted on allowed to join, without providing identifying information. The topics covered during the web conference are considered pr...
guest accessunauthenticated usersweb conferencingconfidentiality - Question #775Research and Analysis
A completely new class of web-based vulnerabilities has been discovered. Claims have been made that all common web-based development frameworks are susceptible to attack. Proof-of-...
vulnerability managementthreat assessmentweb securityrisk analysis - Question #776Integration of Computing, Communications and Business Disciplines
A company sales manager received a memo from the company's financial department which stated that the company would not be putting its software products through the same security t...
legal complianceSLA obligationssoftware security testingcontractual risk - Question #777Enterprise Security
A member of the software development team has requested advice from the security team to implement a new secure lab for testing malware. Which of the following is the NEXT step tha...
malware labproject approvalsecurity governancelab design - Question #778Integration of Computing, Communications and Business Disciplines
A company has issued a new mobile device policy permitting BYOD and company-issued devices. The company-issued device has a managed middleware client that restricts the application...
BYODmobile device managementIT governancemiddleware policy - Question #779Integration of Computing, Communications and Business Disciplines
A security engineer on a large enterprise network needs to schedule maintenance within a fixed window of time. A total outage period of four hours is permitted for servers. Worksta...
operating level agreementMOUmaintenance windowsservice management - Question #780Technical Integration of Enterprise Components
A company has received the contract to begin developing a new suite of software tools to replace an aging collaboration solution. The original collaboration solution has been in pl...
SDLCwaterfall modelsoftware development lifecyclephase-gate review - Question #781Technical Integration of Enterprise Components
An attacker attempts to create a DoS event against the VoIP system of a company. The attacker uses a tool to flood the network with a large number of SIP INVITE traffic. Which of t...
VoIP securitySIP flood DoSQoSVLAN segmentation - Question #782Integration of Computing, Communications and Business Disciplines
A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalabi...
community cloudchain of custodye-discoverycloud governance - Question #783Technical Integration of Enterprise Components
A company is deploying a new iSCSI-based SAN. The requirements are as follows: - SAN nodes must authenticate each other. - Shared keys must NOT be used. - Do NOT use encryption in...
iSCSI SANCHAP authenticationIPSec AHPKI certificates - Question #784Technical Integration of Enterprise Components
A university requires a significant increase in web and database server resources for one week, twice a year, to handle student registration. The web servers remain idle for the re...
elastic cloudhybrid cloudcost optimizationdatabase security - Question #785Technical Integration of Enterprise Components
Which of the following BEST constitutes the basis for protecting VMs from attacks from other VMs hosted on the same physical platform?
VM isolationhypervisor securitypatch managementvirtualization - Question #786Research and Analysis
A company with 2000 workstations is considering purchasing a HIPS to minimize the impact of a system compromise from malware. Currently, the company projects a total cost of $50,00...
HIPSTCO analysissecurity ROIcost-benefit analysis - Question #787Technical Integration of Enterprise Components
Customers are receiving emails containing a link to malicious software. These emails are subverting spam filters. The email reads as follows: Delivered-To: [email protected] Rec...
email securitySMTP relayspam filter bypassunauthorized mail server - Question #788Enterprise Security
A web developer is responsible for a simple web application that books holiday accommodations. The front-facing web server offers an HTML form, which asks for a user's age. This in...
integer overflowinput validationsigned integersweb application security - Question #789Integration of Computing, Communications and Business Disciplines
A company has decided to change its current business direction and refocus on core business. Consequently, several company sub-businesses are in the process of being sold-off. A se...
de-merger securitysecurity governancerisk assessmentsecurity consulting - Question #790Enterprise Security
It has come to the IT administrator's attention that the "post your comment" field on the company blog page has been exploited, resulting in cross-site scripting attacks against cu...
XSS preventioninput validationmetacharacter filteringweb application security - Question #791Integration of Computing, Communications and Business Disciplines
A business unit of a large enterprise has outsourced the hosting and development of a new external website which will be accessed by premium customers, in order to speed up the tim...
third-party riskoutsourcingvendor managementSLA - Question #792Technical Integration of Enterprise Components
An administrator is tasked with securing several website domains on a web server. administrator to secure those domains with a single issued certificate?
SAN certificateSubject Alternative Namesmulti-domain SSLPKI - Question #793Research and Analysis
An administrator wishes to replace a legacy clinical software product as it has become a security risk. The legacy product generates $10,000 in revenue a month. The new software pr...
ROI calculationsecurity investmentsoftware lifecycle costingcost analysis - Question #794Integration of Computing, Communications and Business Disciplines
A large company is preparing to merge with a smaller company. The smaller company has been very profitable, but the smaller company's main applications were created in-house. Which...
merger securitysecurity assessmentrisk integrationdue diligence - Question #795Technical Integration of Enterprise Components
Which of the following technologies prevents an unauthorized HBA from viewing iSCSI target information?
LUN maskingiSCSISAN access controlstorage security - Question #796Technical Integration of Enterprise Components
Company ABC is hiring customer service representatives from Company XYZ. The representatives reside at Company XYZ's headquarters. Which of the following BEST prevents Company XYZ...
VDIthird-party access controlremote accessnetwork segmentation - Question #797Research and Analysis
A Chief Information Security Officer (CISO) has requested that a SIEM solution be implemented. The CISO wants to know upfront what the projected TCO would be before looking further...
SIEMTCO comparisonoutsourcing vs in-houselog management - Question #798Technical Integration of Enterprise Components
A port in a fibre channel switch failed, causing a costly downtime on the company's primary website. Which of the following is the MOST likely cause of the downtime?
SANmultipathingfibre channelhigh availability - Question #799Integration of Computing, Communications and Business Disciplines
An internal development team has migrated away from Waterfall development to use Agile development. Overall, this has been viewed as a successful initiative by the stakeholders as...
Agile SDLCWaterfallsecurity methodologyDevSecOps - Question #800Enterprise Security
A vulnerability scanner report shows that a client-server host monitoring solution operating in the credit card corporate environment is managing SSL sessions with a weak algorithm...
SSL/TLS cipher negotiationweak algorithmsPCI compliancecryptographic configuration - Question #801Technical Integration of Enterprise Components
Which of the following represents important technical controls for securing a SAN storage infrastructure? (Select TWO).
SAN securityLUN maskingport mappingstorage infrastructure - Question #802Enterprise Security
An enterprise must ensure that all devices that connect to its networks have been previously approved. The solution must support dual factor mutual authentication with strong ident...
802.1xEAP-TTLSmutual authenticationnetwork access control - Question #803Technical Integration of Enterprise Components
A security administrator is performing VDI traffic data collection on a virtual server which migrates from one host to another. While reviewing the data collected by the protocol a...
VM live migrationVLAN isolationVDI securitydata confidentiality - Question #804Research and Analysis
Joe is a security architect who is tasked with choosing a new NIPS platform that has the ability to perform SSL inspection, analyze up to 10Gbps of traffic, can be centrally manage...
NIPSSSL inspectionvendor evaluationRFP process - Question #805Enterprise Security
A penetration tester is inspecting traffic on a new mobile banking application and sends the following web request: Content-type: application/json { "account": [ { "creditAccount":...
API securitymobile bankingsensitive data exposureREST security - Question #806Enterprise Security
Joe, a penetration tester, is tasked with testing the security robustness of the protocol between a mobile web application and a RESTful application server. Which of the following...
penetration testingHTTP interceptormobile securityvulnerability scanning - Question #807Enterprise Security
Ann is testing the robustness of a marketing website through an intercepting proxy. She has intercepted the following HTTP request: POST /login.aspx HTTP/1.1 Host: comptia.org Cont...
authentication bypassintercepting proxyHTTP parameter manipulationweb app testing - Question #808Integration of Computing, Communications and Business Disciplines
An organization has implemented an Agile development process for front end web application development. A new security architect has just joined the company and wants to integrate...
Agile securitySDLC integrationstatic analysispenetration testing - Question #809Technical Integration of Enterprise Components
ABC Corporation uses multiple security zones to protect systems and information, and all of the VM hosts are part of a consolidated VM infrastructure. Each zone has different VM ad...
VM isolationhypervisor securityACLvirtualization zones - Question #810Enterprise Security
A security administrator has been asked to select a cryptographic algorithm to meet the criteria of a new application. The application utilizes streaming video that can be viewed b...
cryptographyRC4AES counter modestream cipher performance - Question #811Enterprise Security
ABC Company must achieve compliance for PCI and SOX. Which of the following would BEST allow the organization to achieve compliance and ensure security? (Select THREE).
PCI DSSSOX compliancenetwork segmentationregulatory framework - Question #812Enterprise Security
A pentester must attempt to crack passwords on a windows domain that enforces strong complex passwords. Which of the following would crack the MOST passwords in the shortest time p...
password crackingrainbow tableshash attacksWindows authentication - Question #813Research and Analysis
A security analyst, Ann, states that she believes Internet facing file transfer servers are being attacked. Which of the following is evidence that would aid Ann in making a case t...
baseline analysisnetwork monitoringincident responsethreat evidence