Free CompTIA CAS-002 Exam Dumps Questions & Answers

A security engineer at a bank has detected a Zeus variant, which relies on covert communication channels to receive new instructions and updates from the malware developers. As a result, NIPS and AV systems did not detect the configuration files received by staff in emails that appeared as normal files. Which of the following BEST describes the technique used by the malware developers?

• A.Perfect forward secrecy
• B.Stenography
• C.Confusion
• D.Diffusion
• E.Transport encryption

Company XYZ provides hosting services for hundreds of companies across multiple industries including healthcare, education, and manufacturing. The security architect for company XYZ is reviewing a vendor proposal to reduce company XYZ's hardware costs by combining multiple physical hosts through the use of virtualization technologies. The security architect notes concerns about data separation, confidentiality, regulatory requirements concerning PII, and administrative complexity on the proposal. Which of the following BEST describes the core concerns of the security architect?

• A.Company XYZ could be liable for disclosure of sensitive data from one hosted customer when accessed by a malicious user who has gained access to the virtual machine of another hosted customer.
• B.The availability requirements in SLAs with each hosted customer would have to be re- written to account for the transfer of virtual machines between physical platforms for regular maintenance.
• C.Most of company XYZ's customers are willing to accept the risks of unauthorized disclosure and access to information by outside users.
• D.Not all of company XYZ's customers require the same level of security and the administrative complexity of maintaining multiple security postures on a single hypervisor negates hardware cost savings.

A company has been purchased by another agency and the new security architect has identified new security goals for the organization. The current location has video surveillance throughout the building and entryways. The following requirements must be met:
1. Ability to log entry of all employees in and out of specific areas
2 . Access control into and out of all sensitive areas
3 . Two-factor authentication
Which of the following would MOST likely be implemented to meet the above requirements and provide a secure solution? (Select TWO).

• A.Visitor logs
• B.Motion detection sensors
• C.Mantrap
• D.Biometric readers
• E.Proximity readers

A security administrator is redesigning, and implementing a service-oriented architecture to replace an old, in-house software processing system, tied to a corporate sales website.
After performing the business process analysis, the administrator decides the services need to operate in a dynamic fashion. The company has also been the victim of data injection attacks in the past and needs to build in mitigation features. Based on these requirements and past vulnerabilities, which of the following needs to be incorporated into the SOA?

• A.Cryptographic hashes of all data transferred between services.
• B.Two-factor authentication and signed code.
• C.Service to service authentication for all workflows.
• D.Point to point VPNs for all corporate intranet users.

A small company is developing a new Internet-facing web application. The security requirements are:
1. Users of the web application must be uniquely identified and authenticated.
2. Users of the web application will not be added to the company's directory services.
3. Passwords must not be stored in the code.
Which of the following meets these requirements?

• A.Use Kerberos and browsers that support SAML.
• B.Use SAML with federated directory services.
• C.Use OpenID and allow a third party to authenticate users.
• D.Use TLS with a shared client certificate for all users.