Replace CompTIA CAS-002 – An Overview 281 to 290

It is more faster and easier to pass the CompTIA CAS-002 exam by using Guaranteed CompTIA CompTIA Advanced Security Practitioner (CASP) questuins and answers. Immediate access to the Most up-to-date CAS-002 Exam and find the same core area CAS-002 questions with professionally verified answers, then PASS your exam with a high score now.


Free VCE & PDF File for CompTIA CAS-002 Real Exam
(Full Version!)

Pass on Your First TRY 100% Money Back Guarantee Realistic Practice Exam Questions

Free Instant Download NEW CAS-002 Exam Dumps (PDF & VCE):
Available on:

Q281. – (Topic 3) 

A corporation has expanded for the first time by integrating several newly acquired businesses. 

Which of the following are the FIRST tasks that the security team should undertake? (Select TWO). 

A. Remove acquired companies Internet access. 

B. Federate identity management systems. 

C. Install firewalls between the businesses. 

D. Re-image all end user computers to a standard image. 

E. Develop interconnection policy. 

F. Conduct a risk analysis of each acquired company’s networks. 

Answer: E,F 

Q282. – (Topic 1) 

The risk manager has requested a security solution that is centrally managed, can easily be updated, and protects end users' workstations from both known and unknown malicious attacks when connected to either the office or home network. Which of the following would BEST meet this requirement? 



C. Antivirus 




Q283. – (Topic 3) 

An administrator has a system hardening policy to only allow network access to certain services, to always use similar hardware, and to protect from unauthorized application configuration changes. 

Which of the following technologies would help meet this policy requirement? (Select TWO). 

A. Spam filter 

B. Solid state drives 

C. Management interface 

D. Virtualization 

E. Host firewall 

Answer: D,E 

Q284. – (Topic 2) 

Customers have recently reported incomplete purchase history and other anomalies while accessing their account history on the web server farm. Upon investigation, it has been determined that there are version mismatches of key e-commerce applications on the production web servers. The development team has direct access to the production servers and is most likely the cause of the different release versions. Which of the following process level solutions would address this problem? 

A. Implement change control practices at the organization level. 

B. Adjust the firewall ACL to prohibit development from directly accessing the production server farm. 

C. Update the vulnerability management plan to address data discrepancy issues. 

D. Change development methodology from strict waterfall to agile. 


Q285. – (Topic 2) 

A facilities manager has observed varying electric use on the company’s metered service lines. The facility management rarely interacts with the IT department unless new equipment is being delivered. However, the facility manager thinks that there is a correlation between spikes in electric use and IT department activity. Which of the following business processes and/or practices would provide better management of organizational resources with the IT department’s needs? (Select TWO). 

A. Deploying a radio frequency identification tagging asset management system 

B. Designing a business resource monitoring system 

C. Hiring a property custodian 

D. Purchasing software asset management software 

E. Facility management participation on a change control board 

F. Rewriting the change board charter 

G. Implementation of change management best practices 

Answer: E,G 

Q286. – (Topic 5) 

Two separate companies are in the process of integrating their authentication infrastructure into a unified single sign-on system. Currently, both companies use an AD backend and two factor authentication using TOTP. The system administrators have configured a trust relationship between the authentication backend to ensure proper process flow. How should the employees request access to shared resources before the authentication integration is complete? 

A. They should logon to the system using the username concatenated with the 6-digit code and their original password. 

B. They should logon to the system using the newly assigned global username: first.lastname#### where #### is the second factor code. 

C. They should use the username format: LAN\\first.lastname together with their original password and the next 6-digit code displayed when the token button is depressed. 

D. They should use the username format:, together with a password and their 6-digit code. 


Q287. – (Topic 1) 

Joe, the Chief Executive Officer (CEO), was an Information security professor and a Subject Matter Expert for over 20 years. He has designed a network defense method which he says is significantly better than prominent international standards. He has recommended that the company use his cryptographic method. Which of the following methodologies should be adopted? 

A. The company should develop an in-house solution and keep the algorithm a secret. 

B. The company should use the CEO’s encryption scheme. 

C. The company should use a mixture of both systems to meet minimum standards. 

D. The company should use the method recommended by other respected information security organizations. 


Q288. – (Topic 5) 

Every year, the accounts payable employee, Ann, takes a week off work for a vacation. She typically completes her responsibilities remotely during this week. Which of the following policies, when implemented, would allow the company to audit this employee's work and potentially discover improprieties? 

A. Job rotation 

B. Mandatory vacations 

C. Least privilege 

D. Separation of duties 


Q289. – (Topic 1) 

A government agency considers confidentiality to be of utmost importance and availability issues to be of least importance. Knowing this, which of the following correctly orders various vulnerabilities in the order of MOST important to LEAST important? 

A. Insecure direct object references, CSRF, Smurf 

B. Privilege escalation, Application DoS, Buffer overflow 

C. SQL injection, Resource exhaustion, Privilege escalation 

D. CSRF, Fault injection, Memory leaks 


Q290. – (Topic 1) 

A new internal network segmentation solution will be implemented into the enterprise that consists of 200 internal firewalls. As part of running a pilot exercise, it was determined that it takes three changes to deploy a new application onto the network before it is operational. Security now has a significant effect on overall availability. Which of the following would be the FIRST process to perform as a result of these findings? 

A. Lower the SLA to a more tolerable level and perform a risk assessment to see if the solution could be met by another solution. Reuse the firewall infrastructure on other projects. 

B. Perform a cost benefit analysis and implement the solution as it stands as long as the risks are understood by the business owners around the availability issues. Decrease the current SLA expectations to match the new solution. 

C. Engage internal auditors to perform a review of the project to determine why and how the project did not meet the security requirements. As part of the review ask them to review the control effectiveness. 

D. Review to determine if control effectiveness is in line with the complexity of the solution. Determine if the requirements can be met with a simpler solution.