Implementing Secure Network Protocols and Practices | Exams Advanced Education

CASP Exam A Complete Questions And Answers Graded A+

Which characteristic of PGP is different from the use of formal trust certificates?

✔✔The establishment of a web of trust between the users

Your organization has implemented a PKI for issuing certificates. Your organization

issued several certificates to a partner organization. You revoked the certificates today.

Management is concerned that the revocation request grace period will prevent the

certificates from being revoked in a timely manner. ✔✔It relates to the maximum

response time taken by the CA for a revocation

Your organization has implemented a PKI. You need to ensure that each user's browser

automatically checks the status of the user's certificate. What should you implement?

✔✔OCSP\n

Your organization has implemented a VPN that allows branch offices to connect to the

main office. You have discovered that the key used on the VPN has been compromised.

You need to ensure that the key is not compromised in the future. ✔✔Enable PFS on

the main office and branch offices' ends of the VPN

Your organization has decided to implement a VPN so that remote employees can

connect to the internal network. You decide to implement the VPN using L2TP over

IPSec. Which statements are true of IPSec? ✔✔IPSec can work in either tunnel or

transport mode \n\nIPSec uses encapsulation security payload (ESP) & authentication

headers (AH) as security protocols for encapsulation\n\nIPSec framework is used in a

VPN implementation to secure transmissions

Your organization needs to use a pseudo-random number generator (PRNG). You need

to decide on which PRNG to use. What should your primary security consideration be?

✔✔The entropy of the PRNG

All of the following are security risks associated with cloud computing except ✔✔False

positives

Your organization uses an Ethernet LAN and multiple database servers. The databases

are heavily used and reside on multiple SCSI RAID devices attached to servers. To

keep pace with competitive trends, your organization is considering the use of iSCSI.

Which statement will correctly apply to your LAN if iSCSI is implemented? ✔✔The use

of iSCSI will allow SCSI commands to flow over Ethernet

Which two statements comparing a SAN and a NAS are correct? ✔✔NAS is easier to

install than a SAN\n\nNAS typically uses either proprietary or trimmed-down version of

an operating system to reduce user licensing costs

Your organization wants to allow employees and partners to remotely access the

network. You must deploy a solution that provides centralized authentication. In

Partial preview of the text

Download Implementing Secure Network Protocols and Practices and more Exams Advanced Education in PDF only on Docsity!

CASP Exam A Complete Questions And Answers Graded A+

Which characteristic of PGP is different from the use of formal trust certificates? ✔✔The establishment of a web of trust between the users Your organization has implemented a PKI for issuing certificates. Your organization issued several certificates to a partner organization. You revoked the certificates today. Management is concerned that the revocation request grace period will prevent the certificates from being revoked in a timely manner. ✔✔It relates to the maximum response time taken by the CA for a revocation Your organization has implemented a PKI. You need to ensure that each user's browser automatically checks the status of the user's certificate. What should you implement? ✔✔OCSP\n Your organization has implemented a VPN that allows branch offices to connect to the main office. You have discovered that the key used on the VPN has been compromised. You need to ensure that the key is not compromised in the future. ✔✔Enable PFS on the main office and branch offices' ends of the VPN Your organization has decided to implement a VPN so that remote employees can connect to the internal network. You decide to implement the VPN using L2TP over IPSec. Which statements are true of IPSec? ✔✔IPSec can work in either tunnel or transport mode \n\nIPSec uses encapsulation security payload (ESP) & authentication headers (AH) as security protocols for encapsulation\n\nIPSec framework is used in a VPN implementation to secure transmissions Your organization needs to use a pseudo-random number generator (PRNG). You need to decide on which PRNG to use. What should your primary security consideration be? ✔✔The entropy of the PRNG All of the following are security risks associated with cloud computing except ✔✔False positives Your organization uses an Ethernet LAN and multiple database servers. The databases are heavily used and reside on multiple SCSI RAID devices attached to servers. To keep pace with competitive trends, your organization is considering the use of iSCSI. Which statement will correctly apply to your LAN if iSCSI is implemented? ✔✔The use of iSCSI will allow SCSI commands to flow over Ethernet Which two statements comparing a SAN and a NAS are correct? ✔✔NAS is easier to install than a SAN\n\nNAS typically uses either proprietary or trimmed-down version of an operating system to reduce user licensing costs Your organization wants to allow employees and partners to remotely access the network. You must deploy a solution that provides centralized authentication. In

addition, you have been asked to provide accounting and per-command authorization. What should you do? ✔✔Implement a TACACS+ server Your organization's management has recently spent time discussing attacks against companies and their infrastructure. During the meeting, the Stuxnet attack was discussed. Against which type of system did this attack occur? ✔✔SCADA Your company is considering using IPv6 instead of IPv4. Which improvements does IPv6 provide over IPv4? ✔✔Some header fields have been dropped or made optional\n\nThe IP header options allow more efficient forwarding and less rigid length limits\n You have been hired as a security consultant for a large organization. During a physical examination of the 10-story building, you discover several possible security issues. Which conditions are security concerns? ✔✔A glass-enclosed conference room is located on the tenth floor and contains large screen TVs\n\nEach floor contains a non- locked wiring closet Your organization implemented a new security policy to improve data flow because of changing business needs. As part of this new policy, you block all IGMP traffic over the network. As a result of this configuration, which condition will occur? ✔✔Multicast communications will be prevented Your organization's DNS servers have recently come under attack from spoofing attacks and domain hijacking attacks. You need to ensure the DNS server is authenticated before the transfer begins. What should you do? ✔✔Enable DNSSEC You are aware that any system on the DMZ can be compromised because the DMZ is accessible from the Internet. What should you do because of this? ✔✔Implement every computer on the DMZ as a bastion host You are deploying a VPN for remote users. You have decided to deploy the VPN gateway in its DMZ behind the external firewall. What are the benefits of this deployment? ✔✔The firewall can protect the VPN gateway\n\nThe firewall can inspect plain text from the VPN Management has recently become concerned about data exfiltration. They have asked that you identify areas where data exfiltration can possibly occur. Which situations are examples of data exfiltration methods? ✔✔The company's FTP site\n\nEmployees' USB flash drives used on the network\n\nStolen DVD backup disks\n\nSpyware As a security professional, you have been asked to advise an organization on which access control model to use. You have decided that role-based access control (RBAC) is the best options for the organization. What are two advantages of implementing this access control model? ✔✔Low security cost\n\nEasier to implement

You are your organization's security administrator. You need to ensure that your organization's data is accurate and secure. Which security objective should you implement? ✔✔Confidentiality and integrity You identify a security risk that you do not have in-house skills to address. You decide to procure contract resources to prevent this security risk. Which type of risk response strategy are you demonstrating? ✔✔Transference Which of the following is not a recommended strategic response to positive risks? ✔✔Transfer You have a database server that will be hacked twice a year. It is estimated that each incident will cost your organization $2,000. You can deploy a hardware solution that will prevent the hacking for $10,000. This new hardware solution has a five year lifecycle. Yearly maintenance for the new hardware solution will be $1,000. What should you do? ✔✔Mitigate the risk Your organization has responded to a security incident. The breach has been contained, and all systems have been recovered. What should you do last as part of the incident response? ✔✔Post-mortem review Which attack involves the use of a promiscuous mode for data analysis? ✔✔Packet sniffing Management has recently become concerned with fraudulent activity committed by employees. You are planning to implement a control that enables you to identify fraudulent activity by allowing an employee to perform more than one role in the organization. Which mechanism are you planning to implement? ✔✔Job rotation You have recently implemented several new security policies. As part of these policies, two-man controls were implemented to provide added security. Which statement best describes a two-man control? ✔✔Two operators review and approve each other's work Management at your organization has recently become concerned about the security of all personally identified information (PII) in your HR and customer databases. You have been asked to identify all PII information in the databases. Once all the PII has been identified, steps will be taken to protect this data. Which information in the databases is considered to be PII? ✔✔Full name\n\nSSN\n\nDOB\n\nEmail address Which factor does not minimize the security breach incidents committed by internal employees? ✔✔Nondisclosure agreements signed by employees As part of a new security initiative, your organization has decided that all employees must undergo security awareness training. What is the aim of this training? ✔✔All employees must understand their security responsibilities

Which document solicits information about a product that you may need to buy? ✔✔RFI You have been tasked with performing ongoing security research for your organization. During this research, you decide that you need to implement a network vulnerability scanner on your organization's network. Which tool should you use? ✔✔Nessus What defines the minimum level of security? ✔✔Baselines Your organization has recently become concerned over the use of instant messaging and social networking applications by employees. You have been asked to research security issues that may arise with the usage of these applications. During the research, you must determine the components involved in an instant message. What is an IM package? ✔✔ICQ Your organization has decided to integrate social networking into its marketing plan. You have been asked to research and design a security policy for social networking. Which factors should you consider as part of this design? ✔✔The information that can/cannot be posted\n\nThe amount of personal information that can be shown\n\nThe training of organizational personnel A vendor advertises that a security appliance that your organization is considering has an expected MTBF of 3 years. What is meant by MTBF? ✔✔The estimated amount of time that a piece of equipment should remain operational before failure Management has notified you that the mean time to repair (MTTR) a critical hard drive is too high. You need to address this issue with the least amount of expense. What should you do? ✔✔Add another hard drive, and implement disk mirroring Your organization has purchased a new security device. You have determined that the MTBF is six months and the MTTR is one day. The cost for each failure is estimated to be $5,000. The vendor has offered your organization a three-year maintenance plan for $10,000. You could also purchase an identical device to act as backup for $20,000. Another option is to hire a security practitioner who will be tasked with maintaining the security devices on the network for an annual salary of $45,000. You must protect your organization against the risk of failure in the most cost-efficient manner as possible. What should you do? ✔✔Purchase the maintenance plan Your organization has purchased a new security device. You have determined that the MTBF is six months and MTTR is one day. The cost for each failure is estimated to be $2,000. The vendor has offered your organization a three-year maintenance plan for $5,000 per year. You could also purchase another identical device to act as backup for $20,000. Another option is to hire a security practitioner who will be tasked with maintaining the security devices on the network for an annual salary of $45,000. You

Your organization has recently implemented Voice over IP (VoIP) to replace your PSTN telephone network. All PSTN phones have been replaced with VoIP phones. Users are complaining that the voice conversations are often distorted or slow in transmission. What should you do to attempt to resolve this issue? ✔✔Implement QoS Your organization uses XML to exchange data with other organizations. You have implemented Security Assertions Markup Language (SAML) to communicate the information needed. Management has recently become concerned about the security of this information. You need to implement security policies for the SAML and XML information. What should you implement? ✔✔XACML Recently, users in your organization have started complaining about the number of user IDs and passwords that they must remember to access different resources on your network. Management has asked you to implement a system whereby users are granted access to all resources after the initial domain authentication. What technology should you implement? ✔✔Single sign-on Your organization has built several trust relationships with several partner organizations. These trust relationships are used to allow cross certification of users. Which statement is not true of cross certification? ✔✔Cross certification checks the authenticity of the certificates in the certification path\n While developing a new system, the IT department considers the system's security requirements, such as encryption. Which phase of the system development life cycle is occurring? ✔✔Project initiation As your organization's security officer, you are currently completing audits to ensure that your security settings meet the established baselines. In which phase of the security management life cycle are you engaged? ✔✔Operations and maintenance You have configured the following filters on your company's packet-filtering firewall. Which rule will most likely result in a security breach? ✔✔Permit all inbound TCP connections

Implementing Secure Network Protocols and Practices, Exams of Advanced Education

Related documents

Partial preview of the text

Download Implementing Secure Network Protocols and Practices and more Exams Advanced Education in PDF only on Docsity!

CASP Exam A Complete Questions And Answers Graded A+