Question 1

A product manager is concerned about the unintentional sharing of the company's intellectual property through employees' use of social media. Which of the following would BEST mitigate this risk?

Accepted Answer

A)  Virtual desktop environment 
B)  Network segmentation 
C)  Web application firewall 
D)  Web content filter

Question 2

Management is reviewing the results of a recent risk assessment of the organization's policies and procedures. During the risk assessment it is determined that procedures associated with background checks have not been effectively implemented. In response to this risk, the organization elects to revise policies and procedures related to background checks and use a third-party to perform background checks on all new employees. Which of the following risk management strategies has the organization employed?

Accepted Answer

A)  Transfer 
B)  Mitigate 
C)  Accept 
D)  Avoid 
E)  Reject

Question 3

First responders, who are part of a core incident response team, have been working to contain an outbreak of ransomware that also led to data loss in a rush to isolate the three hosts that were calling out to the NAS to encrypt whole directories, the hosts were shut down immediately without investigation and then isolated. Which of the following were missed? (Choose two.)

Accepted Answer

A)  CPU, process state tables, and main memory dumps 
B)  Essential information needed to perform data restoration to a known clean state 
C)  Temporary file system and swap space 
D)  Indicators of compromise to determine ransomware encryption 
E)  Chain of custody information needed for investigation

Question 4

The Chief Information Security Officer (CISO) has asked the security team to determine whether the organization is susceptible to a zero-day exploit utilized in the banking industry and whether attribution is possible. The CISO has asked what process would be utilized to gather the information, and then wants to apply signatureless controls to stop these kinds of attacks in the future. Which of the following are the MOST appropriate ordered steps to take to meet the CISO's request?

Accepted Answer

A)  1. Perform the ongoing research of the best practices 2. Determine current vulnerabilities and threats 3. Apply Big Data techniques 4. Use antivirus control 
B)  1. Apply artificial intelligence algorithms for detection 2. Inform the CERT team 3. Research threat intelligence and potential adversaries 4. Utilize threat intelligence to apply Big Data techniques 
C)  1. Obtain the latest IOCs from the open source repositories 2. Perform a sweep across the network to identify positive matches 3. Sandbox any suspicious files 4. Notify the CERT team to apply a future proof threat model 
D)  1. Analyze the current threat intelligence 2. Utilize information sharing to obtain the latest industry IOCs 3. Perform a sweep across the network to identify positive matches 4. Apply machine learning algorithms

Question 5

The Chief Information Officer (CIO) wants to increase security and accessibility among the organization's cloud SaaS applications. The applications are configured to use passwords, and two-factor authentication is not provided natively. Which of the following would BEST address the CIO's concerns?

Accepted Answer

A)  Procure a password manager for the employees to use with the cloud applications. 
B)  Create a VPN tunnel between the on-premises environment and the cloud providers. 
C)  Deploy applications internally and migrate away from SaaS applications. 
D)  Implement an IdP that supports SAML and time-based, one-time passwords.

Question 6

A vendor develops a mobile application for global customers. The mobile application supports advanced encryption of data between the source (the mobile device) and the destination (the organization's ERP system). As part of the vendor's compliance program, which of the following would be important to take into account?

Accepted Answer

A)  Mobile tokenization 
B)  Export controls 
C)  Device containerization 
D)  Privacy policies

Question 7

An organization's network engineering team recently deployed a new software encryption solution to ensure the confidentiality of data at rest, which was found to add 300ms of latency to data read-write requests in storage, impacting business operations. Which of the following alternative approaches would BEST address performance requirements while meeting the intended security objective?

Accepted Answer

A)  Employ hardware FDE or SED solutions. 
B)  Utilize a more efficient cryptographic hash function. 
C)  Replace HDDs with SSD arrays. 
D)  Use a FIFO pipe a multithreaded software solution.

Question 8

A penetration testing manager is contributing to an RFP for the purchase of a new platform. The manager has provided the following requirements: Must be able to MITM web-based protocols Must be able to find common misconfigurations and security holes Which of the following types of testing should be included in the testing platform? (Choose two.)

Accepted Answer

A)  Reverse engineering tool 
B)  HTTP intercepting proxy 
C)  Vulnerability scanner 
D)  File integrity monitor 
E)  Password cracker
F) Fuzzer

Question 9

A breach was caused by an insider threat in which customer PII was compromised. Following the breach, a lead security analyst is asked to determine which vulnerabilities the attacker used to access company resources. Which of the following should the analyst use to remediate the vulnerabilities?

Accepted Answer

A)  Protocol analyzer 
B)  Root cause analysis 
C)  Behavioral analytics 
D)  Data leak prevention

Question 10

An organization wants to arm its cybersecurity defensive suite automatically with intelligence on zero-day threats shortly after they emerge. Acquiring tools and services that support which of the following data standards would BEST enable the organization to meet this objective?

Accepted Answer

A)  XCCDF 
B)  OVAL 
C)  STIX 
D)  CWE 
E)  CVE

Question 11

The Chief Information Security Officer (CISO) of an e-retailer, which has an established security department, identifies a customer who has been using a fraudulent credit card. The CISO calls the local authorities, and when they arrive on-site, the authorities ask a security engineer to create a point-in-time copy of the running database in their presence. This is an example of:

Accepted Answer

A)  creating a forensic image 
B)  deploying fraud monitoring 
C)  following a chain of custody 
D)  analyzing the order of volatility

Question 12

A company is migrating systems from an on-premises facility to a third-party managed datacenter. For continuity of operations and business agility, remote access to all hardware platforms must be available at all times. Access controls need to be very robust and provide an audit trail. Which of the following security controls will meet the company's objectives? (Choose two.)

Accepted Answer

A)  Integrated platform management interfaces are configured to allow access only via SSH 
B)  Access to hardware platforms is restricted to the systems administrator's IP address 
C)  Access is captured in event logs that include source address, time stamp, and outcome 
D)  The IP addresses of server management interfaces are located within the company's extranet 
E)  Access is limited to interactive logins on the VDi
F) Application logs are hashed cryptographically and sent to the SIEM

Question 13

As a result of an acquisition, a new development team is being integrated into the company. The development team has BYOD laptops with IDEs installed, build servers, and code repositories that utilize SaaS. To have the team up and running effectively, a separate Internet connection has been procured. A stand up has identified the following additional requirements: 1. Reuse of the existing network infrastructure 2. Acceptable use policies to be enforced 3. Protection of sensitive files 4. Access to the corporate applications Which of the following solution components should be deployed to BEST meet the requirements? (Select three.)

Accepted Answer

A)  IPSec VPN 
B)  HIDS 
C)  Wireless controller 
D)  Rights management 
E)  SSL VPN
F) NAC
G) WAF
H) Load balancer

Question 14

A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command:  However, the analyst is unable to find any evidence of the running shell. Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?

Accepted Answer

A)  The NX bit is enabled 
B)  The system uses ASLR 
C)  The shell is obfuscated 
D)  The code uses dynamic libraries

Question 15

A security analyst is classifying data based on input from data owners and other stakeholders. The analyst has identified three data types: Financially sensitive data Project data Sensitive project data The analyst proposes that the data be protected in two major groups, with further access control separating the financially sensitive data from the sensitive project data. The normal project data will be stored in a separate, less secure location. Some stakeholders are concerned about the recommended approach and insist that commingling data from different sensitive projects would leave them vulnerable to industrial espionage. Which of the following is the BEST course of action for the analyst to recommend?

Accepted Answer

A)  Conduct a quantitative evaluation of the risks associated with commingling the data and reject or accept the concerns raised by the stakeholders. 
B)  Meet with the affected stakeholders and determine which security controls would be sufficient to address the newly raised risks. 
C)  Use qualitative methods to determine aggregate risk scores for each project and use the derived scores to more finely segregate the data. 
D)  Increase the number of available data storage devices to provide enough capacity for physical separation of non-sensitive project data.

Question 16

A company has decided to lower costs by conducting an internal assessment on specific devices and various internal and external subnets. The assessment will be done during regular office hours, but it must not affect any production servers. Which of the following would MOST likely be used to complete the assessment? (Choose two.)

Accepted Answer

A)  Agent-based vulnerability scan 
B)  Black-box penetration testing 
C)  Configuration review 
D)  Social engineering 
E)  Malware sandboxing
F) Tabletop exercise

Question 17

An electric car company hires an IT consulting company to improve the cybersecurity of its vehicles. Which of the following should achieve the BEST long-term result for the company?

Accepted Answer

A)  Designing and developing add-on security components for fielded vehicles 
B)  Reviewing proposed designs and prototypes for cybersecurity vulnerabilities 
C)  Performing a cyber risk assessment on production vehicles 
D)  Reviewing and influencing requirements for an early development vehicle

Question 18

A systems administrator has deployed the latest patches for Windows-based machines. However, the users on the network are experiencing exploits from various threat actors, which the patches should have corrected. Which of the following is the MOST likely scenario?

Accepted Answer

A)  The machines were infected with malware. 
B)  The users did not reboot the computer after the patches were deployed. 
C)  The systems administrator used invalid credentials to deploy the patches. 
D)  The patches were deployed on non-Windows-based machines.

Question 19

A newly hired Chief Information Security Officer (CISO) is reviewing the organization's security budget from the previous year. The CISO notices $100,000 worth of fines were paid for not properly encrypting outbound email messages. The CISO expects next year's costs associated with fines to double and the volume of messages to increase by 100%. The organization sent out approximately 25,000 messages per year over the last three years. Given the table below:  Which of the following would be BEST for the CISO to include in this year's budget?

Accepted Answer

A)  A budget line for DLP Vendor A 
B)  A budget line for DLP Vendor B 
C)  A budget line for DLP Vendor C 
D)  A budget line for DLP Vendor D 
E)  A budget line for paying future fines

Question 20

A penetration test is being scoped for a set of web services with API endpoints. The APIs will be hosted on existing web application servers. Some of the new APIs will be available to unauthenticated users, but some will only be available to authenticated users. Which of the following tools or activities would the penetration tester MOST likely use or do during the engagement? (Choose two.)

Accepted Answer

A)  Static code analyzer 
B)  Intercepting proxy 
C)  Port scanner 
D)  Reverse engineering 
E)  Reconnaissance gathering
F) User acceptance testing

Exam 3: CompTIA Advanced Security Practitioner (CASP+) CAS-003