51 CASP Questions Flashcards
A red team is able to connect a laptop with penetration testing tools directly into an open network port. The team then is able to take advantage of a vulnerability on the domain controller to create and promote a new enterprise administrator. Which of the following technologies would MOST likely eliminate this attack vector in the future?
- Monitor for anomalous creations of privileged domain accounts
- Install a NIPS with rules appropriate to drop most exploit traffic
- Ensure the domain controller has the latest security patches
- Implement 802.1x with certificate-based authentication
• Implement 802.1x with certificate-based authentication
Following a recent security incident on a web server, the security analyst takes HTTP traffic captures for further investigation. The analyst suspects certain .jpg files have important data hidden within them. Which of the following tools will help get all the pictures from within the HTTP traffic captured to a specified folder?
- tshark
- memdump
- nbstat
- dd
• tshark
A financial services company has proprietary trading algorithms, which were created and are maintained by a team of developers on their private source repository. If the details of this operation became known to competitors, the company’s ability to profit from its trading would disappear immediately. Which of the following would the company MOST likely use to protect its trading algorithms?
- Single-tenancy cloud
- Managed security service providers
- Virtual desktop infrastructure
- Cloud security broker
• Single-tenancy cloud
A company’s user community is being adversely affected by various types of email whose authenticity cannot be trusted. The Chief Information Security Officer must address the problem. Which of the following solutions would BEST support trustworthy communication solutions?
- Enabling spam filtering and DMARC
- Using MFA when logging into email clients and the domain
- Enforcing HTTPS everywhere so web traffic, including email, is secure
- Enabling SPF and DKIM on company servers
- Enforcing data classification labels before an email is sent to an outside party
• Enabling SPF and DKIM on company servers
While the code is still in the development environment, a security architect is testing the code stored in the code respository to ensure the top ten OWASP secure coding practices are being followed. Which of the following code analyzers will produce the desired results?
- Static
- Dynamic
- Fuzzer
- Peer review
• Static
A security administrator is opening connectivity on a firewall between Organization A and Organization B. Organization B just acquired Organization A. Which of the following risk mitigation strategies should the administrator implement to reduce the risk involved with this change?
- DLP on internal network nodes
- A network traffic analyzer for incoming traffic
- A proxy server to examine outgoing web traffic
- IPS/IDS monitoring on the new connection
• IPS/IDS monitoring on the new connection
An organization implemented a secure boot on its most critical application servers, which produce content and capability for other consuming servers. A recent incident, however, led the organization to implement a centralized attestation service for these critical servers. Which of the following MOST likely explains the nature of the incident that caused the organization to implement this remediation?
- An attacker masqueraded as an internal DNS server
- An attacker leveraged a heap overflow vulnerability in the OS
- An attacker was able to overwrite an OS integrity measurement register
- An attacker circumvented IEEE 802.1x network-level authentication requirements
• An attacker was able to overwrite an OS integrity measurement register
A security administrator is investigating an incident involving suspicious word processing documents on an employee’s computer, which was found powered off in the employee’s office. Which of the following tools is BEST suited for extracting full or partial word processing documents form unallocated disk space?
- memdump
- foremost
- dd
- nc
• foremost
A company makes consumer health devices and needs to maintain strict confidentiality of unreleased product designs. Recently, unauthorized photos of products still in development have been for sale on the dark web. The Chief Information Security Officer suspects an insider threat, but the team that uses the secret outdoor testing area has been vetted many times, and nothing suspicious has been found. Which of the following is the MOST likely cause of the unauthorized photos?
- The location of the testing facility was discovered by analyzing fitness device information the test engineers posted on a website
- One of the test engineers is working for a competitor and covertly installed a RAT on the marketing department’s servers
- The company failed to implement least privilege on network devices, and a hactivist published stolen public relations photos
- Pre-release marketing materials for a single device were accidentally left in a public location
• The company failed to implement least privilege on network devices, and a hactivist published stolen public relations photos
Joe, an application security engineer, is performing an audit of an environmental control application. He has implemented a robust SDLC process and is reviewing API calls available to the application. During the review, Joe finds the following in a log file:
POST /API/Data/Username=Jim&Password=Rustly&PowerKW&Efficiency
POST/API/Data/Username=John&Password=Doe&Uptime&temperature
POST/API/Data/Username=OTManager&Password=1gudPW§or5Sensor2=Off&Sector5sensor2status
Which of the following would BEST mitigate the issue Joe has found?
- Ensure the API uses SNMPv1
- Perform authentication via a secure channel
- Verify the API uses HTTP Get instead of POST
- Deploy a WAF in front of the API and implement rate limiting
• Perform authentication via a secure channel
Which of the following is the BEST reason to implement a separation of duties policy?
- It minimizes the risk of DOS due to continous monitoring
- It eliminates the need to enforce least privilege by logging all actions
- It increases the level of difficutly for a single employee to perpetrate fraud
- It removes barriers to collusion and collaboration between business units
• It increases the level of difficulty for a single employee to perpetrate fraud
An organization’s mobile device inventory recently provided notification that a zero-day vulnerability was identified in the code used to control the baseband of the devices. The device manufacturer is expediting a patch, but the rollout will take several months. Additionally, several mobile users recently returned from an overseas trip and report their phones now contain unknown applications, slowing device performance. Users have been unable to uninstall these application, which persist after wiping the devices. Which of the following MOST likely occurred and provides mitigation until the patches are released?
- Unauthentic firmware was installed; disable OTA updates and carrier roaming via MDM
- Users opened a spear-phishing email; disable third-party application stores and validate all signed code prior to execution
- An attacker downloaded monitoring applications; perform a full factory reset of the affected devices
- Users received an improperly encoded emergency broadcast message, leading to an integrity loss condition; disable emergency broadcast messages
• An attacker downloaded monitoring applications; perform a full factory reset of the affected devices
An organization is facing budget constraints. The Chief Technology Officer wants to add a new marketing platform, but the organization does not have the resources to obtain separate servers to run the new platform. The CTO recommends running the new marketing platform on a virtualized video-conferencing server because video conferencing is rarely used. The Chief Information Security Officer denies this request. Which of the following BEST explains the reason why the CISO has not approved the request?
- Privilege escalation attacks
- Performance and availability
- Weak DAR encryption
- Disparate security requirements
• Disparate security requirements
During an audit, it was determined form a sample that four out of 20 former employees were sill accessing their email accounts. An information security analyst is reviewing the access to determine if the audit was valid. Which of the following would assist with the validation and provide the necessary documentation to audit?
- Examining the termination notification process from human resources and employee account access logs
- Checking social media platforms for disclosure of company sensitive and proprietary information
- Sending the test email to the former employees to document and undeliverable email and review the ERP access
- Reviewing the email global account list and the collaboration platform for recent activity
• Examining the termination notification process from human resources and employee account access logs
An engineering team is developing and deploying a fleet of mobile devices to be used for specialized inventory management purposes. These devices should:
- Be based on open-source Android for user familiarity and ease
- Provide a single application for inventory management of physical assets
- Permit use of the camera by only the inventory application for the purposes of scanning
- Disallow any and all configuration baseline modifications
- Restrict all access to any device resource other than those required for use of the inventory management application
Which of the following approaches would BEST meet these security requirements?
- Set an application wrapping policy, wrap the application, distribute the inventory APK via the MAM tool, and test the application restrictions.
- Write a MAC sepolicy that defines domains with rules, label the inventory application, build the policy, and set to enforcing mode
- Swap out Android’s Linux kernel version for >2.4.0, build the kernel, build the Android, remove unnecessary functions via MDM, configure to block network access, and perform integration testing.
- Build and install an Android middleware policy with requirements added, copy the file into /usr/init, and then build the inventory application
• Build and install an Android middleware policy with requirements added, copy the file into /usr/init, and then build the inventory application
A hospital is using a functional magnetic resonance imaging (fMRI) scanner, which is controlled by a legacy desktop connected to the network. The manufacturer of the fMRI will not support patching of the legacy system. The legacy desktop needs to be network accessible on TCP port 445. A security administrator is concerned the legacy system will be vulnerable to exploits. Which of the following would be the BEST strategy to reduce the risk of an outage while still providing for security?
- Install HIDS and disable unused services
- Enable application whitelisting and disable SMB
- Segment the network and configure a controlled interface
- Apply only critical security patches for known vulnerabilities
• Segment the network and configure a controlled interface
A developer implements the following code snippet:
catch(Exception e){
if(log.isDebugEnabled()) log.debug(context, EVENTS.ADHOC, “Caught InvalidGSMException Exception –” + e.toString());
}
Which of the following vulnerabilities does this code snippet resolve?
- SQL injection
- Buffer overflow
- Missing session limit
- Information leakage
• Missing session limit
A secure facility has a server room that currently is controlled by a simple lock and key, and several administrators have copies of the key. To maintain regulatory compliance, a second lock, which is controlled by an application on the administrators’ smartphones, is purchased and installed. The application has various authentication methods that can be used. The criteria for choosing the most appropriate method are:
- It cannot be invasive to the end user
- It must be utilized as a second factor
- Information sharing must be avoided
- It must have a low false acceptance rate
Which of the following BEST meets the criteria?
- Facial recognition
- Swipe pattern
- Fingerprint scanning
- Complex passcode
- Token Card
• Facial recognition
The Chief Executive Officer of a fast-growing company no longer knows all the employees and is concerned about the company’s intellectual property being stolen by an employee. Employees are allowed to work remotely with flexible hours, creating unpredictable schedules. Roles are poorly defined due to frequent shifting needs across the company. Which of the following new initiatives by the information security team would BEST secure the company and mitigate the CEO’s concerns?
- Begin simulated phishing campaigns for employees and follow up with additional security awareness training.
- Seed company fileshares and servers with text documents containing fake passwords and then monitor for their use.
- Implement DLP to monitor data transfer between employee accounts and external parties and services
- Report data from a user-behavior monitoring tool and assign security analysis to review it daily
• Implement DLP to monitor data transfer between employee accounts and external parties and services
A manufacturing company’s security engineer is concerned a remote actor may be able to access the ICS that is used to monitor the factory lines. The security engineer recently proposed some techniques to reduce the attack surface of the ICS to the Chief Information Security Officer. Which of the following would BEST track the reductions to show the CISO the engineer’s plan is successful during each phase?
- Conducting tabletop exercises to evaluate system risk
- Contracting a third-party auditor after the project is finished
- Performing pre- and post-implementation penetration tests
- Running frequent vulnerability scans during the project
• Running frequent vulnerability scans during the project
