★ Pass on Your First TRY ★ 100% Money Back Guarantee ★ Realistic Practice Exam Questions

Free Instant Download NEW CAS-002 Exam Dumps (PDF & VCE):
Available on: https://www.certleader.com/CAS-002-dumps.html


It is more faster and easier to pass the CompTIA CAS-002 exam by using Pinpoint CompTIA CompTIA Advanced Security Practitioner (CASP) questuins and answers. Immediate access to the Renovate CAS-002 Exam and find the same core area CAS-002 questions with professionally verified answers, then PASS your exam with a high score now.

2021 Oct certainteed cas-002:

Q361. - (Topic 1) 

The Information Security Officer (ISO) believes that the company has been targeted by cybercriminals and it is under a cyber attack. Internal services that are normally available to the public via the Internet are inaccessible, and employees in the office are unable to browse the Internet. The senior security engineer starts by reviewing the bandwidth at the border router, and notices that the incoming bandwidth on the router’s external interface is maxed out. The security engineer then inspects the following piece of log to try and determine the reason for the downtime, focusing on the company’s external router’s IP which is 128.20.176.19: 

11:16:22.110343 IP 90.237.31.27.19 > 128.20.176.19.19: UDP, length 1400 

11:16:22.110351 IP 23.27.112.200.19 > 128.20.176.19.19: UDP, length 1400 

11:16:22.110358 IP 192.200.132.213.19 > 128.20.176.19.19: UDP, length 1400 

11:16:22.110402 IP 70.192.2.55.19 > 128.20.176.19.19: UDP, length 1400 

11:16:22.110406 IP 112.201.7.39.19 > 128.20.176.19.19: UDP, length 1400 

Which of the following describes the findings the senior security engineer should report to the ISO and the BEST solution for service restoration? 

A. After the senior engineer used a network analyzer to identify an active Fraggle attack, the company’s ISP should be contacted and instructed to block the malicious packets. 

B. After the senior engineer used the above IPS logs to detect the ongoing DDOS attack, an IPS filter should be enabled to block the attack and restore communication. 

C. After the senior engineer used a mirror port to capture the ongoing amplification attack, a BGP sinkhole should be configured to drop traffic at the source networks. 

D. After the senior engineer used a packet capture to identify an active Smurf attack, an ACL should be placed on the company’s external router to block incoming UDP port 19 traffic. 

Answer: A 


Q362. - (Topic 1) 

A web services company is planning a one-time high-profile event to be hosted on the corporate website. An outage, due to an attack, would be publicly embarrassing, so Joe, the Chief Executive Officer (CEO), has requested that his security engineers put temporary preventive controls in place. Which of the following would MOST appropriately address Joe's concerns? 

A. Ensure web services hosting the event use TCP cookies and deny_hosts. 

B. Configure an intrusion prevention system that blocks IPs after detecting too many incomplete sessions. 

C. Contract and configure scrubbing services with third-party DDoS mitigation providers. 

D. Purchase additional bandwidth from the company’s Internet service provider. 

Answer: C 


Q363. - (Topic 3) 

A team of security engineers has applied regulatory and corporate guidance to the design of a corporate network. The engineers have generated an SRTM based on their work and a thorough analysis of the complete set of functional and performance requirements in the network specification. Which of the following BEST describes the purpose of an SRTM in this scenario? 

A. To ensure the security of the network is documented prior to customer delivery 

B. To document the source of all functional requirements applicable to the network 

C. To facilitate the creation of performance testing metrics and test plans 

D. To allow certifiers to verify the network meets applicable security requirements 

Answer: D 


Q364. - (Topic 3) 

The security manager of a company has hired an external consultant to conduct a security assessment of the company network. The contract stipulates that the consultant is not allowed to transmit any data on the company network while performing wired and wireless security assessments. Which of the following technical means can the consultant use to determine the manufacturer and likely operating system of the company wireless and wired network devices, as well as the computers connected to the company network? 

A. Social engineering 

B. Protocol analyzer 

C. Port scanner 

D. Grey box testing 

Answer: B 


Q365. - (Topic 1) 

A developer is determining the best way to improve security within the code being developed. The developer is focusing on input fields where customers enter their credit card details. Which of the following techniques, if implemented in the code, would be the MOST effective in protecting the fields from malformed input? 

A. Client side input validation 

B. Stored procedure 

C. Encrypting credit card details 

D. Regular expression matching 

Answer: D 


Replace comptia casp cas-002:

Q366. - (Topic 1) 

A security manager has received the following email from the Chief Financial Officer (CFO): 

“While I am concerned about the security of the proprietary financial data in our ERP application, we have had a lot of turnover in the accounting group and I am having a difficult time meeting our monthly performance targets. As things currently stand, we do not allow employees to work from home but this is something I am willing to allow so we can get back on track. What should we do first to securely enable this capability for my group?” 

Based on the information provided, which of the following would be the MOST appropriate response to the CFO? 

A. Remote access to the ERP tool introduces additional security vulnerabilities and should not be allowed. 

B. Allow VNC access to corporate desktops from personal computers for the users working from home. 

C. Allow terminal services access from personal computers after the CFO provides a list of the users working from home. 

D. Work with the executive management team to revise policies before allowing any remote access. 

Answer: D 


Q367. - (Topic 5) 

Noticing latency issues at its connection to the Internet, a company suspects that it is being targeted in a Distributed Denial of Service attack. A security analyst discovers numerous inbound monlist requests coming to the company’s NTP servers. Which of the following mitigates this activity with the LEAST impact to existing operations? 

A. Block in-bound connections to the company’s NTP servers. 

B. Block IPs making monlist requests. 

C. Disable the company’s NTP servers. 

D. Disable monlist on the company’s NTP servers. 

Answer: D 


Q368. - (Topic 1) 

A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalability to adequately serve their clients. Since it is an e-discovery firm where chain of custody is important, which of the following scenarios should they consider? 

A. Offload some data processing to a public cloud 

B. Aligning their client intake with the resources available 

C. Using a community cloud with adequate controls 

D. Outsourcing the service to a third party cloud provider 

Answer: C 


Q369. - (Topic 5) 

A company has migrated its data and application hosting to a cloud service provider (CSP). 

To meet its future needs, the company considers an IdP. Why might the company want to select an IdP that is separate from its CSP? (Select TWO). 

A. A circle of trust can be formed with all domains authorized to delegate trust to an IdP 

B. Identity verification can occur outside the circle of trust if specified or delegated 

C. Replication of data occurs between the CSP and IdP before a verification occurs 

D. Greater security can be provided if the circle of trust is formed within multiple CSP domains 

E. Faster connections can occur between the CSP and IdP without the use of SAML 

Answer: A,D 


Q370. - (Topic 3) 

A security consultant is called into a small advertising business to recommend which security policies and procedures would be most helpful to the business. The business is comprised of 20 employees, operating off of two shared servers. One server houses employee data and the other houses client data. All machines are on the same local network. Often these employees must work remotely from client sites, but do not access either of the servers remotely. Assuming no security policies or procedures are in place right now, which of the following would be the MOST applicable for implementation? (Select TWO). 

A. Password Policy 

B. Data Classification Policy 

C. Wireless Access Procedure 

D. VPN Policy 

E. Database Administrative Procedure 

Answer: A,B