Ucertify offers free demo for CAS-002 exam. "CompTIA Advanced Security Practitioner (CASP)", also known as CAS-002 exam, is a CompTIA Certification. This set of posts, Passing the CompTIA CAS-002 exam, will help you answer those questions. The CAS-002 Questions & Answers covers all the knowledge points of the real exam. 100% real CompTIA CAS-002 exams and revised by experts!

Q161. - (Topic 1) 

A software project manager has been provided with a requirement from the customer to place limits on the types of transactions a given user can initiate without external interaction from another user with elevated privileges. This requirement is BEST described as an implementation of: 

A. an administrative control 

B. dual control 

C. separation of duties 

D. least privilege 

E. collusion 

Answer:


Q162. - (Topic 2) 

An accountant at a small business is trying to understand the value of a server to determine if the business can afford to buy another server for DR. The risk manager only provided the accountant with the SLE of $24,000, ARO of 20% and the exposure factor of 25%. Which of the following is the correct asset value calculated by the accountant? 

A. $4,800 

B. $24,000 

C. $96,000 

D. $120,000 

Answer:


Q163. - (Topic 5) 

A developer is determining the best way to improve security within the code being developed. The developer is focusing on input fields where customers enter their credit card details. Which of the following techniques, if implemented in the code, would be the MOST effective in protecting the fields from malformed input? 

A. Client side input validation 

B. Stored procedure 

C. Encrypting credit card details 

D. Regular expression matching 

Answer:


Q164. - (Topic 4) 

The Chief Information Security Officer (CISO) at a software development company is concerned about the lack of introspection during a testing cycle of the company’s flagship product. Testing was conducted by a small offshore consulting firm and the report by the consulting firm clearly indicates that limited test cases were used and many of the code paths remained untested. 

The CISO raised concerns about the testing results at the monthly risk committee meeting, highlighting the need to get to the bottom of the product behaving unexpectedly in only some large enterprise deployments. 

The Security Assurance and Development teams highlighted their availability to redo the testing if required. 

Which of the following will provide the MOST thorough testing? 

A. Have the small consulting firm redo the Black box testing. 

B. Use the internal teams to perform Grey box testing. 

C. Use the internal team to perform Black box testing. 

D. Use the internal teams to perform White box testing. 

E. Use a larger consulting firm to perform Black box testing. 

Answer:


Q165. - (Topic 1) 

A security administrator was doing a packet capture and noticed a system communicating with an unauthorized address within the 2001::/32 prefix. The network administrator confirms there is no IPv6 routing into or out of the network. Which of the following is the BEST course of action? 

A. Investigate the network traffic and block UDP port 3544 at the firewall 

B. Remove the system from the network and disable IPv6 at the router 

C. Locate and remove the unauthorized 6to4 relay from the network 

D. Disable the switch port and block the 2001::/32 traffic at the firewall 

Answer:


Q166. - (Topic 2) 

A web developer is responsible for a simple web application that books holiday accommodations. The front-facing web server offers an HTML form, which asks for a user’s age. This input gets placed into a signed integer variable and is then checked to ensure that the user is in the adult age range. 

Users have reported that the website is not functioning correctly. The web developer has inspected log files and sees that a very large number (in the billions) was submitted just before the issue started occurring. Which of the following is the MOST likely situation that has occurred? 

A. The age variable stored the large number and filled up disk space which stopped the application from continuing to function. Improper error handling prevented the application from recovering. 

B. The age variable has had an integer overflow and was assigned a very small negative number which led to unpredictable application behavior. Improper error handling prevented the application from recovering. 

C. Computers are able to store numbers well above “billions” in size. Therefore, the website issues are not related to the large number being input. 

D. The application has crashed because a very large integer has lead to a “divide by zero”. Improper error handling prevented the application from recovering. 

Answer:


Q167. - (Topic 5) 

A large organization has recently suffered a massive credit card breach. During the months of Incident Response, there were multiple attempts to assign blame as to whose fault it was that the incident occurred. In which part of the incident response phase would this be addressed in a controlled and productive manner? 

A. During the Identification Phase 

B. During the Lessons Learned phase 

C. During the Containment Phase 

D. During the Preparation Phase 

Answer:


Q168. - (Topic 5) 

An IT administrator has been tasked by the Chief Executive Officer with implementing security using a single device based on the following requirements: 

1. Selective sandboxing of suspicious code to determine malicious intent. 

2. VoIP handling for SIP and H.323 connections. 

3. Block potentially unwanted applications. 

Which of the following devices would BEST meet all of these requirements? 

A. UTM 

B. HIDS 

C. NIDS 

D. WAF 

E. HSM 

Answer:


Q169. - (Topic 4) 

A system administrator has installed a new Internet facing secure web application that consists of a Linux web server and Windows SQL server into a new corporate site. The administrator wants to place the servers in the most logical network security zones and implement the appropriate security controls. Which of the following scenarios BEST accomplishes this goal? 

A. Create an Internet zone, DMZ, and Internal zone on the firewall. Place the web server in the DMZ. Configure IPtables to allow TCP 80 and 443. Set SELinux to permissive. Place the SQL server in the internal zone. Configure the Windows firewall to allow TCP 80 and 

443. Configure the Internet zone with ACLs of allow 80 and 443 destination DMZ. 

B. Create an Internet zone, DMZ, and Internal zone on the firewall. Place the web server in the DMZ. Configure IPtables to allow TCP 443. Set enforcement threshold on SELinux to one. Place the SQL server in the internal zone. Configure the Windows firewall to allow TCP 1433 and 1443. Configure the Internet zone with ACLs of allow 443 destination DMZ. 

C. Create an Internet zone and two DMZ zones on the firewall. Place the web server in the DMZ one. Set the enforcement threshold on SELinux to 100, and configure IPtables to allow TCP 80 and 443. Place the SQL server in DMZ two. Configure the Windows firewall to allow TCP 80 and 443. Configure the Internet zone with an ACL of allow 443 destination ANY. 

D. Create an Internet zone and two DMZ zones on the firewall. Place the web server in DMZ one. Set enforcement threshold on SELinux to zero, and configure IPtables to allow TCP 80 and 443. Place the SQL server in DMZ two. Configure the Internet zone ACLs with allow 80, 443, 1433, and 1443 destination ANY. 

Answer:


Q170. - (Topic 1) 

A company has received the contract to begin developing a new suite of software tools to replace an aging collaboration solution. The original collaboration solution has been in place for nine years, contains over a million lines of code, and took over two years to develop originally. The SDLC has been broken up into eight primary stages, with each stage requiring an in-depth risk analysis before moving on to the next phase. Which of the following software development methods is MOST applicable? 

A. Spiral model 

B. Incremental model 

C. Waterfall model 

D. Agile model 

Answer: