Want to Pass CAS-002 Exam In Next HOURS? Download Now →
May 10, 2018

Top Tips Of CAS-002 courses

Free Instant Download NEW CAS-002 Exam Dumps (PDF & VCE):
Available on: https://www.certshared.com/exam/CAS-002/

P.S. Validated CAS-002 free demo are available on Google Drive, GET MORE: https://drive.google.com/open?id=1MWxVvRqKw5P-3mL6Zi7QlXk_26ObOJ_y

New CompTIA CAS-002 Exam Dumps Collection (Question 11 - Question 20)

New Questions 11

A security consultant is hired by a company to determine if an internally developed web application is vulnerable to attacks. The consultant spent two weeks testing the application, and determines that no vulnerabilities are present. Based on the results of the tools and tests available, which of the following statements BEST reflects the security status of the application?

A. The companyu2019s software lifecycle management improved the security of the application.

B. There are no vulnerabilities in the application.

C. The company should deploy a web application firewall to ensure extra security.

D. There are no known vulnerabilities at this time.

Answer: D

New Questions 12

New zero-day attacks are announced on a regular basis against a broad range of technology systems. Which of the following best practices should a security manager do to manage the risks of these attack vectors? (Select TWO).

A. Establish an emergency response call tree.

B. Create an inventory of applications.

C. Backup the router and firewall configurations.

D. Maintain a list of critical systems.

E. Update all network diagrams.

Answer: B,D

New Questions 13

An organization did not know its internal customer and financial databases were compromised until the attacker published sensitive portions of the database on several popular attacker websites. The organization was unable to determine when, how, or who conducted the attacks but rebuilt, restored, and updated the compromised database server to continue operations.

Which of the following is MOST likely the cause for the organizationu2019s inability to determine what really occurred?

A. Too few layers of protection between the Internet and internal network

B. Lack of a defined security auditing methodology

C. Poor intrusion prevention system placement and maintenance

D. Insufficient logging and mechanisms for review

Answer: D

New Questions 14

An organization determined that each of its remote sales representatives must use a smartphone for email access.

The organization provides the same centrally manageable model to each person.

Which of the following mechanisms BEST protects the confidentiality of the resident data?

A. Require dual factor authentication when connecting to the organizationu2019s email server.

B. Require each sales representative to establish a PIN to access the smartphone and limit email storage to two weeks.

C. Require encrypted communications when connecting to the organizationu2019s email server.

D. Require a PIN and automatic wiping of the smartphone if someone enters a specific number of incorrect PINs.

Answer: D

New Questions 15

A finance manager says that the company needs to ensure that the new system can u201creplayu201d data, up to the minute, for every exchange being tracked by the investment departments. The finance manager also states that the companyu2019s transactions need to be tracked against this data for a period of five years for compliance. How would a security engineer BEST interpret the finance manageru2019s needs?

A. Compliance standards

B. User requirements

C. Data elements

D. Data storage

E. Acceptance testing

F. Information digest

G. System requirements

Answer: B

New Questions 16

Three companies want to allow their employees to seamlessly connect to each otheru2019s wireless corporate networks while keeping one consistent wireless client configuration. Each company wants to maintain its own authentication infrastructure and wants to ensure

that an employee who is visiting the other two companies is authenticated by the home office when connecting to the other companiesu2019 wireless network. All three companies have agreed to standardize on 802.1x EAP-PEAP-MSCHAPv2 for client configuration. Which of the following should the three companies implement?

A. The three companies should agree on a single SSID and configure a hierarchical RADIUS system which implements trust delegation.

B. The three companies should implement federated authentication through Shibboleth connected to an LDAP backend and agree on a single SSID.

C. The three companies should implement a central portal-based single sign-on and agree to use the same CA when issuing client certificates.

D. All three companies should use the same wireless vendor to facilitate the use of a shared cloud based wireless controller.

Answer: A

New Questions 17

A hosting company provides inexpensive guest virtual machines to low-margin customers. Customers manage their own guest virtual machines. Some customers want basic guarantees of logical separation from other customers and it has been indicated that some customers would like to have configuration control of this separation; whereas others want this provided as a value-added service by the hosting company. Which of the following BEST meets these requirements?

A. The hosting company should install a hypervisor-based firewall and allow customers to manage this on an as-needed basis.

B. The hosting company should manage the hypervisor-based firewall; while allowing customers to configure their own host-based firewall.

C. Customers should purchase physical firewalls to protect their guest hosts and have the hosting company manage these if requested.

D. The hosting company should install a host-based firewall on customer guest hosts and offer to administer host firewalls for customers if requested.

Answer: B

New Questions 18

Company XYZ has transferred all of the corporate servers, including web servers, to a cloud hosting provider to reduce costs. All of the servers are running unpatched, outdated versions of Apache. Furthermore, the corporate financial data is also hosted by the cloud services provider, but it is encrypted when not in use. Only the DNS server is configured to audit user and administrator actions and logging is disabled on the other virtual machines. Given this scenario, which of the following is the MOST significant risk to the system?

A. All servers are unpatched and running old versions.

B. Financial data is processed without being encrypted.

C. Logging is disabled on critical servers.

D. Server services have been virtualized and outsourced.

Answer: A

New Questions 19

An Association is preparing to upgrade their firewalls at five locations around the United States. Each of the three vendoru2019s RFP responses is in-line with the security and other requirements. Which of the following should the security administrator do to ensure the firewall platform is appropriate for the Association?

A. Correlate current industry research with the RFP responses to ensure validity.

B. Create a lab environment to evaluate each of the three firewall platforms.

C. Benchmark each firewall platformu2019s capabilities and experiences with similar sized companies.

D. Develop criteria and rate each firewall platform based on information in the RFP responses.

Answer: B

New Questions 20

A Security Manager is part of a team selecting web conferencing systems for internal use. The system will only be used for internal employee collaboration. Which of the following are the MAIN concerns of the security manager? (Select THREE).

A. Security of data storage

B. The cost of the solution

C. System availability

D. User authentication strategy

E. PBX integration of the service

F. Operating system compatibility

Answer: A,C,D

100% Improved CompTIA CAS-002 Questions & Answers shared by Dumpscollection, Get HERE: http://www.dumpscollection.net/dumps/CAS-002/ (New 532 Q&As)