Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CASP > CASP Practice Test > Flashcards

CASP Practice Test Flashcards

1
Q

Which of the following is known as a ROT 3 cipher?

A. Caesar
B. Scytale
C. DES
D. AES

A

A. Caesar

Caesar cipher is an early form of encryption and is also known as a ROT3 cipher.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which of the following is not one of the four common goals of cryptography?

A. Privacy
B. Authentication
C. Availability
D. Integrity

A

C. Availability

The four common goals of cryptography include privacy, authentication, integrity, and non-repudiation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

The act of obtaining plain text from cipher text without a cryptographic key is known as what?

A. Encryption
B. Cryptanalysis
C. Hashing
D. Integrity verification

A

B. Cryptanalysis

Cryptanalysis is the act of obtaining plain text from cipher text without a cryptographic key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

______ is a measure of the randomness of data collected by an application or even an operating system and used to create a cryptography key

A. Encryption
B. Hashing
C. Entropy
D. Confusion

A

C. Entropy

While key size is important, the randomness of the key is also critical. Entropy is a measure of the randomness of data collected by an application or even an operating system and used to create a cryptography key

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following is not a symetric algrothim?

A. CAST
B. RC5
C. DES
D. RSA

A

D. RSA

Example of symmetric encryption techniques include CAST, DES, and RC5. RSA is a asymmetric algorithm

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

DES does how many rounds during the encryption process?

A. 2
B. 8
C. 16
D. 48

A

C. 16

DES does 16 rounds of substitution and transposition during the encryption process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

3DES does how many rounds during the encryption process?

A. 2
B. 8
C. 16
D. 48

A

D. 48

3DES does 48 rounds of substitution and transposition during the encryption process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Which of the following makes use of a stream cipher process?

A. DES ECB
B. RC4
C. RC5
D. CAST

A

B. RC4

RC4 is considered a stream cipher whereas DES ECB, RC5, and RC6 are block ciphers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

SAFER uses ___ blocks of data?

A. 8
B. 32
C. 64
D. 256

A

C. 64

Secure and Fast Encryption Routine is a block-based cipher that processes data in blocks of 64 and 128 bits.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DES has an effective key length of?

A. 32
B. 56
C. 64
D. 256

A

B. 56

The DES key size is 56- bits, and DES has four primary modes of operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Cisco first came up with which of the following remote access technology?

A. TACACS
B. RADIUS
C. Diameter
D. XTACACS

A

A. TACACS

Cisco has implemented a variety of remote access methods through its networking hardware and software. Originally, this was Terminal Access Controller Access Control System (TACACS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

These devices have the ability to perform deep packet inspection and look at requests and responses within the HTTP/HTTPS/SOAP/XML-RPC/Web Service layers.

A. Proxy
B. IDS
C. DMZ
D. WAF

A

D. WAF

A WAF is a firewall sitting between a web- client and a web server, analyzing OSI Layer-7 traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is another name for digital controllers?

A. SCADA
B. JK Flip/Flops
C. Cyber systems
D. NAC

A

A. SCADA

Yesterday’s analog controls have become today’s digital systems. These digital controls are known as Supervisory Control And Data Acquisition (SCADA) systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of the following doe VoIP not use?

A. IAX
B. H.121
C. SIP
D. RTP

A

B. H.121

VoIP makes use of protocols such as Session Initiation Protocol (SIP), H.323, Inter-Asterisk eXchange protocol (IAX), and Real-time Transport Protocol (RTP).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

HTTP functions at which layer of the TCP model?

A. Application
B. Host-to-host
C. Internet
D. Data link

A

A. Application

HTTP, and other protocols like Telnet and SNMP, function at the application layer where they provide network services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What TCP port does SMTP use?

A. 21
B. 23
C. 25
D. 80

A

C. 25

SMTP uses TCP port 25

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What UDP port does TFTP use?

A. 21
B. 69
C. 25
D. 161

A

B. 69

UDP port 69 is used for TFTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

This protocol is no longer used in IPv6?

A. ICMP
B. TCP
C. ARP
D. DNS

A

C. ARP

Say goodbye to ARP. While ARP is an integral part of IPv4, it is not used with IPv6. IPV6 makes use of NDP, the neighbor discovery protocol (NDP).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

An IPv4 header has a default length of _______________ .

A. 16 bytes
B. 8 bytes
C. 20 bytes
D. 40 bytes

A

C. 20 bytes

IPv4 has a 20 byte default header length and can be 60 bytes maximum with options.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

An ICMP type 8 message is best defined as?

A. Unreachable
B. Ping
C. Redirect
D. Time exceeded

A

B. Ping

ICMP is used for logical errors and diagnostics. An ICMP type 8 is a ping request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

___________________ describes a cloud solution where you are buying infrastructure

A. IaaS
B. BasF
C. MaaS
D. SaaS

A

A. IaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

This approach includes monitoring for networks, application, servers, applications, and remote systems .

A. IaaS
B. BasF
C. MaaS
D. SaaS

A

C. MaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Another name for a confused deputy attack is?

A. XSS
B. DoS
C. Session hijacking
D. Sniffing

A

A. XSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

This Cisco VLAN technology wraps the Ethernet frame, yet but it is not a standard used by all vendors.

A. ISL
B. QLAN
C. 802.1q
D. STP

A

A. ISL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

This VLAN standard places information inside the Ethernet frame.

A. ISL
B. QLAN
C. 802.1q
D. STP

A

C. 802.1q

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

______ is an attack in which an attacker tries to send data to hosts that belong to other VLANs

A. Spanning
B. VLAN hopping
C. Bridging
D. Scanning

A

B. VLAN hopping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

______ is a SAN standard used for connecting data storage facilities and allowing remote SCSI devices to communicate

A. HBA
B. vSCAN
C. FCoE
D. iSCSI

A

D. iSCSI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

______ can operate at speeds of 10 Gigabits gigabits per second and rides on top of the Ethernet protocol.

A. HBA
B. vSCAN
C. FCoE
D. iSCSI

A

C. FCoE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

_______ is implemented primarily at the HBA level.

A. LUN masking
B. vSCAN
C. FCoE
D. iSCSI

A

A. LUN masking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

_________ is the process of removing redundant data to improve enterprise storage utilization.

A. Data scanning
B. Data aggregation
C. Data duplication
D. Data mining

A

C. Data duplication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What implict command is at the end of every ACL?

A. A default deny all
B. An end statement
C. A default allow all
D. An allow statement

A

A. A default deny all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Snort can not filter on which of the following traffic types

A. IP
B. TCP
C. UDP
D. OSPF

A

D. OSPF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Extended ACL’s cannot by default examine which of the following?

A. Protocol
B. IPSEC data
C. DSCP
D. Precedent value

A

B. IPSEC data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is wrong with the following ACL?

interface Eth0 deny ip any any
deny tcp 10.10.10.128 0.0.0.63 any eq smtp deny tcp any eq 23 int ethernet 0 ip access-group 110 out

A. Access-group statement
B. Interface Eth0
C. Deny TCP statement
D. Deny all statement

A

D. Deny all statement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Which model uses the following, “This property states that an object at one level of integrity is not permitted to write to an object of higher integrity.”

A. Bell-LaPadula
B. Biba
C. Clark Wilson
D. Brewer Nash

A

B. Biba

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Which of the following Evaluation Assurance Levels (EAL) matches methodically designed tested, and reviewed?

A. EAL 1
B. EAL 2
C. EAL 3
D. EAL 4

A

D. EAL 4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Structurally tested is what EAL level?

A. EAL 1
B. EAL 2
C. EAL 3
D. EAL 4

A

B. EAL 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

ITSEC was designed for use in what region of the world?

A. China
B. Canada
C. Europe
D. USA

A

D. USA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Which of the following is used of identifying the version of OS running on a computer?

A. Nmap -O
B. Nmap -sS
C. Nmap -sU
D. Nmap –sT

A

A. Nmap -O

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Which of the following is a confidentiality based model?

A. Bell-LaPadula
B. Biba
C. Clark Wilson
D. Brewer Nash

A

A. Bell-LaPadula

41
Q

______ is not a replacement for a traditional firewall but simply adds another layer of protection

A. NAC
B. IDP
C. IDS
D. WAF

42
Q

You just finished a port scan and have found port 88 open. What application uses port 88?.

A. TFTP
B. Kerberos
C. LDAP
D. Finger

A

B. Kerberos

43
Q

How many steps of the TCP startup are completed in a stealth scan?

A. One
B. Two
C. Three
D. None

44
Q

After completing a port scan you have identified TCP port 80 as open. What should be your next step?

A. Banner grab
B. Map the attack surface
C. Launch a IIS exploit
D. Launch a Apache exploit

A

A. Banner grab

45
Q

With this form of test there is very little or no knowledge of the target network or its systems.

A. Crystal box
B. White box
C. Gray box
D. Black box

A

D. Black box

46
Q

This type of attack targets availability and is characterized by large amounts of traffic.

A. Session hijacking
B. Sniffing
C. DoS
D. SQL injection

47
Q

You have identified a system that may not have a functioning antivirus program. How can you check to see if it is working properly?

A. EICAR
B. Load known malware
C. Port scan
D. FERPA

48
Q

Your IDS has identified network traffic that appears to be a series of ARP replies with no corresponding ARP requests. What might be the purpose of this activity?

A. DNS poisoning
B. IPv6 traffic
C. ARP cache poisoning
D. Network discovery traffic

A

C. ARP cache poisoning

49
Q

This technique is used to determine the OS of a system by injecting traffic.

A. Hijacking
B. Active OS fingerprinting
C. Sniffing
D. Passive OS fingerprinting

A

B. Active OS fingerprinting

50
Q

_______ is the process of configuring a switch to see all the traffic on one specific port.

A. SPAN
B. ARP poisoning
C. Spoofing
D. Hijacking

51
Q

Which of the following is the formula for SLE?

A. AV * ALE
B. AV * EF
C. AV / EF
D. AV * ARO

A

B. AV * EF

52
Q

Which of the following is the formula for ALE?

A. SRE * ARO
B. AV * SLE
C. EF * ARO
D. SLE * ARO

A

D. SLE * ARO

53
Q

An ______is an item of value to an institution such as data, hardware, software, or physical property

A. Asset
B. Vulnerability
C. Tangible item
D. Risk

54
Q

A _________ can be best defined as a type of business entity in which two or more entities share potential profit and risk with each other

A. Incorporation
B. Partnership
C. Merger
D. Sole proprietorship

A

B. Partnership

55
Q

A ________ is a weakness in a system design, a weakness in the implementation of an operational procedure, or a weakness in how software or code

A. Asset
B. Vulnerability
C. Tangible item
D. Risk

A

B. Vulnerability

56
Q

This law was signed into law in 1999 and resulted in the most sweeping overhaul of financial services regulation in the United States

A. Patriot Act
B. HIPAA
C. GLBA
D. FISMA

57
Q

This encryption method is a type of secure cryptoprocessor targeted at managing cryptographic keys.

A. TrueCrypt
B. HSM
C. EFS
D. TPM

58
Q

Which of the following is a specialized chip that can be installed on the motherboard of a client and is used for encryption.

A. TrueCrypt
B. HSM
C. EFS
D. TPM

59
Q

Which of the following encryption algorithms can be used for data at rest and is based on the Rijndael algorithm?

A. AES
B. DES
C. RC
D. CAST

60
Q

ANSI X12 is used for which of the following?

A. Unix file transfers
B. PKI
C. Digital certificates
D. EDI

61
Q

This document dictates management’s commitment to the use, operation, and security of information systems

A. Procedure
B. Policy
C. Standard
D. Baseline

62
Q

This document is considered step by step and can be tied closely to hardware.

A. Procedure
B. Policy
C. Guideline
D. Baseline

A

A. Procedure

63
Q

These are considered tactical documents, as they lay out specific steps or processes required to meet a certain requirement

A. Procedure
B. Policy
C. Standard
D. Baseline

A

C. Standard

64
Q

While preparing to develop a document on patch management you have been asked to review current vulnerabilities. Which U.S. government agency is responsible for the creation of lists of known vulnerabilities in operating systems?

A. DoD
B. Secret service
C. NSA
D. NIST

65
Q

In the realm of Internet standards what document is used fore the creation of new requirements?

A. MOU
B. RFC
C. RFP
D. SLA

66
Q

This document specifies conditions and applied terms for outsourcing partner organizations that must share data and information resources.

A. MOU
B. RFC
C. RFP
D. SLA

67
Q

This document specifies the maximum amount of outage time?

A. MOU
B. RFC
C. RFP
D. SLA

68
Q

This document can be used to specify what former employees can discuss about company business after leaving the company.

A. BPA
B. MOU
C. NDA
D. SLA

69
Q

_______ is another example of a legally binding document that is designed to provide safeguards and compel certain actions among business partners

A. BPA
B. MOU
C. NDA
D. SLA

70
Q

This personal control is used to reduce fraud and ensure a backup if the employee is unavailable.

A. PKCS
B. SSL
C. TTS
D. Telnet

71
Q

Which of the following is not a vulnerability scanner?

A. Nessus
B. Wireshark
C. Satan
D. Saint

A

B. Wireshark

72
Q

An Nmap full connect scan uses which of the following?

A. Nmap -O
B. Nmap -sS
C. Nmap -sU
D. Nmap –sT

A

D. Nmap –sT

73
Q

Which of the following would best be used for forensic examination of a hard disk?

A. Helix
B. Backtrack
C. Knoppix
D. Auditor

74
Q

You have captured he following traffic with Windump. What best describes this protocol or application?

ICMP Type 3 Code 13

A. Ping message
B. Unreachable message
C. Redirect message
D. TTL failure message

A

B. Unreachable message

75
Q

Type 1 errors are also know as?

A. CER
B. FRR
C. Zepher
D. FAR

76
Q

Type 2 errors are also known as?

A. CER
B. FRR
C. Zepher
D. FAR

77
Q

Which of the following is true about CER?

A. A higher number is better
B. The number should always be 100%
C. A lower number is better
D. The number is always zero

A

C. A lower number is better

78
Q

This form of biometric authentication can report false errors because of heart disease or other vascular problems.

A. Iris
B. Palm
C. Retina
D. Hand geometry

79
Q

This RFC defines the Internet protocol.

A. RFC 1766
B. RFC 791
C. RFC 792
D. RFC 1700

A

B. RFC 791

80
Q

The CIA4N concept includes all of the following except.

A. Authorization
B. Non-repudiation
C. Identification
D. Accounting

A

C. Identification

81
Q

Which of the following is about finding the balance between the costs of security against the value of assets.

A. Performance management
B. Value delivery
C. Integration
D. Resource management

A

B. Value delivery

82
Q

_________ is about utilizing the security infrastructure efficiently and effectively with minimum waste.

A. Performance management
B. Value delivery
C. Enterprise architecture
D. Resource management

A

D. Resource management

83
Q

___________________ is the practice within information technology of organizing and documenting a company’s IT assets so that planning, management, and expansion can be enhanced

A. Performance management
B. Value delivery
C. Enterprise architecture
D. Resource management

A

A. Performance management

84
Q

This risk assessment method is similar to the structured review yet individuals present for the meeting must write their responses down and hand them to the team lead for review

A. Alpha Review
B. Structured Review
C. ODFM
D. Modified Delphi

A

D. Modified Delphi

85
Q

Security awareness is an example of which control category?

A. Detective
B. Preventive
C. Corrective
D. Compensating

A

B. Preventive

86
Q

Clustering is an example of a ____________ control.

A. Detective
B. Preventive
C. Corrective
D. Compensating

A

D. Compensating

87
Q

Patching is an example of which of the following controls?

A. Detective
B. Preventive
C. Corrective
D. Compensating

A

C. Corrective

88
Q

Reviewing audit logs is an example of which of the following?

A. Detective
B. Preventive
C. Corrective
D. Compensating

A

A. Detective

89
Q

Another name for the software vulnerability version model is which of the following?

A. Plan, do, check, and correct
B. Plan, secure, confirm, and remediate
C. Plan, detect, respond, and improve
D. Initial, repeatable, defined, and optimized

A

B. Plan, secure, confirm, and remediate

90
Q

You have completed a port scan and found port 31337 open. What application commonly uses this port?

A. NetBus
B. Beast
C. Back orifice
D. Loki

A

C. Back orifice

91
Q

You have completed a port scan and found port 12345 open. What application commonly uses this port?

A. NetBus
B. Beast
C. Back orifice
D. Loki

92
Q

Presence is used for which of the following?

A. Video conferencing for PC’s
B. Remote access for Apple computers
C. Video conferencing for Apple computers
D. Remote access for PC’s

A

D. Remote access for PC’s

93
Q

Which email application uses TCP port 143 by default?

A. SMTP
B. POP3
C. IMAP
D. SNMP

94
Q

Which email application uses TCP port 110 by default?

A. SMTP
B. POP3
C. IMAP
D. SNMP

95
Q

What is a SPAN port used for?

A. Mirroring traffic on a switch
B. A type of port scan
C. Used with VLAN’s to segment traffic
D. Used with VoIP

A

A. Mirroring traffic on a switch

96
Q

Which of the following best defines SPIT?

A. A type of session hijack
B. Used for sniffing
C. A form on MiTM attack
D. A type of SPAM

A

D. A type of SPAM

97
Q

______ is the variations in transmission latency that can cause packet loss and degraded VoIP call quality

A. Wow
B. Jitter
C. Flutter
D. Latency

98
Q

_______ is a delay in the transmission of a data packet

A. Wow
B. Jitter
C. Flutter
D. Latency

A

D. Latency

99
Q

This technology was seen as an improvement over RADIUS and is a form of centralized authentication.

A. Diameter
B. LDAP
C. CHAP
D. KryptoKnight

A

A. Diameter

CASP (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions