Free CompTIA CAS-002 Exam Dumps Questions & Answers

An organization has decided to reduce labor costs by outsourcing back office processing of credit applications to a provider located in another country. Data sovereignty and privacy concerns raised by the security team resulted in the third-party provider only accessing and processing the data via remote desktop sessions. To facilitate communications and improve productivity, staff at the third party has been provided with corporate email accounts that are only accessible via the remote desktop sessions. Email forwarding is blocked and staff at the third party can only communicate with staff within the organization.
Which of the following additional controls should be implemented to prevent data loss?
(Select THREE).

• A.Implement hashing of data in transit
• B.Monitor approved credit accounts
• C.User access audit reviews
• D.Session recording and capture
• E.Source IP whitelisting
• F.Disable cross session cut and paste

A bank is in the process of developing a new mobile application. The mobile client renders content and communicates back to the company servers via REST/JSON calls. The bank wants to ensure that the communication is stateless between the mobile application and the web services gateway. Which of the following controls MUST be implemented to enable stateless communication?

• A.Generate a one-time key as part of the device registration process.
• B.The jsession cookie should be stored securely after authentication.
• C.Authentication assertion should be stored securely on the client.
• D.Require SSL between the mobile application and the web services gateway.

A software development manager is taking over an existing software development project.
The team currently suffers from poor communication due to a long delay between requirements documentation and feature delivery. This gap is resulting in an above average number of security-related bugs making it into production. Which of the following development methodologies is the team MOST likely using now?

• A.Agile
• B.Scrum
• C.Spiral
• D.Waterfall

An administrator has enabled salting for users' passwords on a UNIX box. A penetration tester must attempt to retrieve password hashes. Which of the following files must the penetration tester use to eventually obtain passwords on the system? (Select TWO).

• A./etc/password
• B./etc/passwd
• C./etc/shadow
• D./bin/bash
• E./sbin/logon
• F./etc/security

In an effort to reduce internal email administration costs, a company is determining whether to outsource its email to a managed service provider that provides email, spam, and malware protection. The security manager is asked to provide input regarding any security implications of this change.
Which of the following BEST addresses risks associated with disclosure of intellectual property?

• A.Require the managed service provider to implement additional data separation.
• B.Enable data loss protection to minimize emailing PII and confidential data.
• C.Require encrypted communications when accessing email.
• D.Establish an acceptable use policy and incident response policy.