Free CompTIA CAS-002 Exam Dumps Questions & Answers

A security administrator was recently hired in a start-up company to represent the interest of security and to assist the network team in improving security in the company. The programmers are not on good terms with the security team and do not want to be distracted with security issues while they are working on a major project. Which of the following is the BEST time to make them address security issues in the project?

• A.  At the time they request
• B.  At the inception of the project
• C.  In the middle of the project
• D.  At the end of the project

An organization has several production critical SCADA supervisory systems that cannot follow the normal 30-day patching policy. Which of the following BEST maximizes the protection of these systems from malicious software?

• A.  Configure the systems to ensure only necessary applications are able to run
• B.  Configure the host firewall to ensure only the necessary applications have listening ports
• C.  Configure a firewall with deep packet inspection that restricts traffic to the systems
• D.  Configure a separate zone for the systems and restrict access to known ports

The Chief Information Officer (CIO) is reviewing the IT centric BIA and RA documentation.
The documentation shows that a single 24 hours downtime in a critical business function will cost the business $2.3 million. Additionally, the business unit which depends on the critical business function has determined that there is a high probability that a threat will materialize based on historical data. The CIO's budget does not allow for full system hardware replacement in case of a catastrophic failure, nor does it allow for the purchase of additional compensating controls. Which of the following should the CIO recommend to the finance director to minimize financial loss?

• A.  The company should avoid the risk.
• B.  The company should mitigate the risk.
• C.  The company should transfer the risk.
• D.  The company should accept the risk.

A large financial company has a team of security-focused architects and designers that contribute into broader IT architecture and design solutions. Concerns have been raised due to the security contributions having varying levels of quality and consistency. It has been agreed that a more formalized methodology is needed that can take business drivers, capabilities, baselines, and re-usable patterns into account. Which of the following would BEST help to achieve these objectives?

• A.  Introduce an ESA framework
• B.  Include SRTM in the SDLC
• C.  Construct a security control library
• D.  Construct a library of re-usable security patterns

An organization has implemented an Agile development process for front end web application development. A new security architect has just joined the company and wants to integrate security activities into the SDLC.
Which of the following activities MUST be mandated to ensure code quality from a security perspective? (Select TWO).

• A.  Security requirements are story boarded and make it into the build
• B.  Security standards and training is performed as part of the project
• C.  tatic and dynamic analysis is run as part of integration
• D.  For each major iteration penetration testing is performed
• E.  Daily stand-up meetings are held to ensure security requirements are understood
• F.  A security design is performed at the end of the requirements phase