QUESTION: 13

A systems security engineer is assisting an organization’s market survey team in reviewing requirements for an upcoming acquisition of mobile devices. The engineer expresses concerns to the survey team about a particular class of devices that uses a separate SoC for baseband radio I/O. For which of the following reasons is the engineer concerned?

These devices can communicate over networks older than HSPA+ and LTE standards, exposing device communications to poor encryptions routines
The organization will be unable to restrict the use of NFC, electromagnetic induction, and Bluetooth technologies
The associated firmware is more likely to remain out of date and potentially vulnerable
The manufacturers of the baseband radios are unable to enforce mandatory access controls within their driver set

Answer(s): B

Reveal Solution Next Question

QUESTION: 14

During a security assessment, an organization is advised of inadequate control over network segmentation. The assessor explains that the organization’s reliance on VLANs to segment traffic is insufficient to provide segmentation based on regulatory standards. Which of the following should the organization consider implementing along with VLANs to provide a greater level of segmentation?

Air gaps
Access control lists
Spanning tree protocol
Network virtualization
Elastic load balancing

Answer(s): D

Reveal Solution Next Question

QUESTION: 15

A security administrator was informed that a server unexpectedly rebooted. The administrator received an export of syslog entries for analysis:

Which of the following does the log sample indicate? (Choose two.)

A root user performed an injection attack via kernel module
Encrypted payroll data was successfully decrypted by the attacker
Jsmith successfully used a privilege escalation attack
Payroll data was exfiltrated to an attacker-controlled host
Buffer overflow in memory paging caused a kernel panic
Syslog entries were lost due to the host being rebooted

Answer(s): C,E

Reveal Solution Next Question

QUESTION: 16

An organization has employed the services of an auditing firm to perform a gap assessment in preparation for an upcoming audit. As part of the gap assessment, the auditor supporting the assessment recommends the organization engage with other industry partners to share information about emerging attacks to organizations in the industry in which the organization functions. Which of the following types of information could be drawn from such participation?

Threat modeling
Risk assessment
Vulnerability data
Threat intelligence
Risk metrics
Exploit frameworks

Answer(s): F

Reveal Solution Next Question

CompTIA Advanced Security Practitioner (CASP) CAS-003 Exam

QUESTION: 13

QUESTION: 14

QUESTION: 15

QUESTION: 16

CompTIA Advanced Security Practitioner (CASP)
CAS-003 Exam