Mohamed Fnayou
Quiz by , created more than 1 year ago

Quizes about CASP examS

81
1
0
Mohamed Fnayou
Created by Mohamed Fnayou about 8 years ago
Close

In-Class Quizzes

Question 1 of 35

1

You are moving to a new location and have been asked to assess the security
additions required in the new location. Which of the following concerns could
be addressed with a mantrap?

Select one of the following:

  • need to log all visitors

  • prevention of tailgating

  • dim lighting in the parking lot

  • contractors connecting to open ports

Explanation

Question 2 of 35

1

You work for a cable company that utilizes VLANs in its internal network
and provides customers with connections between locations. If the company were to
offer MPLS, what additional service would the company be able to offer customers
that it currently cannot offer?

Select one of the following:

  • metro Ethernet

  • establishment of VLANs between sites

  • cable TV and Internet service

  • transport encryption

Explanation

Question 3 of 35

1

What port number does HTTPS use?

Select one of the following:

  • 80

  • 23

  • 443

  • 69

Explanation

Question 4 of 35

1

Network access control (NAC) is a service that goes beyond authentication
of the user and includes an examination of the state of the computer?

Select one of the following:

  • True

  • False

Explanation

Question 5 of 35

1

RAID 3 requires at least three drives, writes the data across all drives, and
then writes parity information across all drives as well, so there is no single
point of failure?

Select one of the following:

  • True

  • False

Explanation

Question 6 of 35

1

Your company, a healthcare provider, is considering outsourcing its messaging
system to a managed service provider. The proposal presented makes no
mention of a DLP functionality. If this is not present, which of the following are
you in danger of experiencing?

Select one of the following:

  • poor messaging performance
    Correct!

  • loss of PII

  • open email relay

  • unauthenticated sessions

Explanation

Question 7 of 35

1

Your organization recently deployed a standard operating system image
to all desktop systems and is now scanning the computers weekly against a security
baseline. Which of the following cannot be learned by scanning against the
baseline?

Select one of the following:

  • whether security settings have been changed

  • whether user data has been deleted

  • whether security policies have been disabled

  • whether antimalware software has been removed

Explanation

Question 8 of 35

1

Input validation is a technique used to prevent which of the following application
attacks?

Select one of the following:

  • A. memory leaks

  • B. privilege escalation

  • C. improper error handling

  • D. SQL injection

Explanation

Question 9 of 35

1

One of the disadvantages when using sandboxing is the incompatibility issues with the
many different types of applications and other utilities?

Select one of the following:

  • True
  • False

Explanation

Question 10 of 35

1

Bluesnarfing is when an unsolicited message is sent to a Bluetooth-enabled device, often
for the purpose of adding a business card to the victim’s contact list?

Select one of the following:

  • True
  • False

Explanation

Question 11 of 35

1

The following code is an example of what type of attack?

#include
char *code = "AAAABBBBCCCCDDD"; //including the character '\0'
size = 16 bytes
void main()
{char buf[8];
strcpy(buf, code);
}

Select one of the following:

  • SQL injection

  • buffer overflow

  • cross-site scripting

  • integer overflow

Explanation

Question 12 of 35

1

In the following raw HTTP request, which part is problematic?

GET /disp_reports.php?SectionEntered=57&GroupEntered=-
1&report_type=alerts&to_date=01-
01-0101&Run=
Run&UserEntered=dsmith&SessionID=5f04189bc&from_date=31-10-
2010&TypesEntered=1
HTTP/1.1
Host: test.example.net
Accept: */*
Accept-Language: en
Connection: close
Cookie: java14=1; java15=1; java16=1; js=1292192278001;

Select one of the following:

  • A. Host: test.example.net

  • B. Connection: close

  • C. Run&UserEntered=dsmith&SessionID=5f04189

  • D. Accept: */*

Explanation

Question 13 of 35

1

You have been asked to improve the quality of the code produced by the
software development team, so you are creating a secure coding standard document.
Which of the following is NOT a topic that should be covered in the document?

Select one of the following:

  • A. error handling

  • B. input validation

  • C. memory use and reuse

  • D. performance metrics

Explanation

Question 14 of 35

1

The WASC is the organization that maintains a list of top 10 attacks on an ongoing basis?

Select one of the following:

  • True

  • False

Explanation

Question 15 of 35

1

Fuzzing is used for testing how an application reacts when injecting invalid or unexpected inputs?

Select one of the following:

  • True
  • False

Explanation

Question 16 of 35

1

Companies A and B are merging, with the security administrator for
Company A becoming head of IT. In which of the following scenarios would the
first step be to perform a vulnerability assessment of Company B’s network?

Select one of the following:

  • A. The two networks must be joined.

  • B. An application used by Company B must be integrated by Company A.

  • C. The two networks have overlapping IP address ranges.

  • D. An attack is under way in Company A’s network.

Explanation

Question 17 of 35

1

Company E has a contract with a smaller company. The smaller company
provides security at a high-security location. Company E discovers that the smaller
company has subcontracted some of the functions. What is the minimum step that
Company E must take in reaction to this situation?

A. Do nothing. It is shielded from liability.
B. Execute a new contract that includes the subcontractor.
C. Require the security contractor to execute a service agreement with the subcontractor.
D. Fire the security consulting company.

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 18 of 35

1

Which of the following refers to responsibilities that an organization has due to partnerships with other organizations and customers?

A. Due process
B. Downstream liability
C. Due diligence
D. Indirect costs

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 19 of 35

1

Generally speaking, an increase in security measures in a network is accompanied by an increase in performance?

Select one of the following:

  • True
  • False

Explanation

Question 20 of 35

1

Due care is when an organization understands the security risks it faces and has taken reasonable measures to meet those risks?

Select one of the following:

  • True
  • False

Explanation

Question 21 of 35

1

Your organization has recently implemented several new security policies
in response to a recent risk analysis. One of the new policies states that controls
must be configured to protect files from unauthorized or accidental deletion. Which
aspect of security does this new policy address?

A. confidentiality
B. integrity
C. availability
D. authorization

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 22 of 35

1

Your company completes a risk analysis. After the analysis, management
requests that you deploy security controls that will mitigate any of the identified
risks. What is risk mitigation?

A. risk that is left over after safeguards have been implemented
B. terminating the activity that causes a risk or choosing an alternative that is not as risky
C. passing the risk on to a third party
D. defining the acceptable risk level the organization can tolerate and reducing the risk to that level

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 23 of 35

1

An organization has a research server farm with a value of $12,000. The exposure factor
for a complete power failure is 10%. The annualized rate of occurrence that this will occur
is 5%. What is the ALE for this event?

A. $1,200
B. $12,000
C. $60
D. $600

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 24 of 35

1

You have been asked to document the different threats to an internal file server.
As part of that documentation, you need to include the monetary impact of each
threat occurrence. You should determine the SLE for each threat occurrence?

Select one of the following:

  • True
  • False

Explanation

Question 25 of 35

1

Standards often include step-by-step lists on how polices, guidelines, and procedures are implemented?

Select one of the following:

  • True
  • False

Explanation

Question 26 of 35

1

Your company recently had a third party review all internal procedures.
As a result of this review, the third party made several recommendations for procedural
changes. One of the recommendations is that critical financial transactions
should be split between two independent parties. Of which principle is this an
example?

A. job rotation
B. separation of duties
C. least privilege
D. mandatory vacation

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 27 of 35

1

As part of the process of conducting a business impact analysis (BIA), you
perform the MTD, MTTR, and MTBF calculations. Which step of the BIA are you
performing?

A. Identify critical processes and resources.
B. Identify resource requirements.
C. Identify outage impacts, and estimate downtime.
D. Identify recovery priorities.

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 28 of 35

1

Which of the following describes the average amount of time it will take to get a device fixed and back online?

A. MTBF
B. MTTR
C. RTO
D. RPO

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 29 of 35

1

To identify vulnerabilities and threats is the first step of a risk assessment?

Select one of the following:

  • True
  • False

Explanation

Question 30 of 35

1

Several invalid password attempts for multiple users is considered an incident?

Select one of the following:

  • True
  • False

Explanation

Question 31 of 35

1

The company you work for has implemented the following security controls:
■ All workstations have the latest patches and antivirus.
■ All sensitive data is encrypted in transit.
■ Dual-factor user authentication is used.
■ A firewall at the edge of the network is implemented.
What is missing from this security posture?
A. no local encryption
B. weak user authentication
C. insufficient edge control
D. exposure to viruses

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 32 of 35

1

If you implement FCoE in your storage network, which of the following
security issues should concern you?

A. a breach of the Fibre Channel network
B. a breach of the Ethernet network
C. the use of iSCSI commands
D. the inability to use encryption

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 33 of 35

1

Placing older data on low-cost, low-performance storage while keeping
more active data on faster storage systems is called what?

A. multipathing
B. tiering
C. consolidating
D. masking

Select one of the following:

  • A

  • B

  • C

  • D

Explanation

Question 34 of 35

1

A community cloud is a solution owned and managed by one company solely for that company’s use?

Select one of the following:

  • True
  • False

Explanation

Question 35 of 35

1

Synchronous replication provides near-real-time replication but uses more bandwidth and cannot tolerate latency?

Select one of the following:

  • True
  • False

Explanation

Previous
Check answer
Next