最新的CompTIA Advanced Security Practitioner (CASP) Recertification Exam for Continuing Education - RC0-C02免費考試真題
A team is established to create a secure connection between software packages in order to list employee's remaining or unused benefits on their paycheck stubs. Which of the following business roles would be MOST effective on this team?
正確答案: B
The latest independent research shows that cyber attacks involving SCADA systems grew an average of
1 5% per year in each of the last four years, but that this year's growth has slowed to around 7%.
Over the same time period, the number of attacks against applications has decreased or stayed flat each year. At the start of the measure period, the incidence of PC boot loader or BIOS based attacks was negligible. Starting two years ago, the growth in the number of PC boot loader attacks has grown exponentially. Analysis of these trends would seem to suggest which of the following strategies should be employed?
1 5% per year in each of the last four years, but that this year's growth has slowed to around 7%.
Over the same time period, the number of attacks against applications has decreased or stayed flat each year. At the start of the measure period, the incidence of PC boot loader or BIOS based attacks was negligible. Starting two years ago, the growth in the number of PC boot loader attacks has grown exponentially. Analysis of these trends would seem to suggest which of the following strategies should be employed?
正確答案: A
說明：（僅 Fast2test 成員可見）
A corporation has Research and Development (R&D) and IT support teams, each requiring separate networks with independent control of their security boundaries to support department objectives.
The corporation's Information Security Officer (ISO) is responsible for providing firewall services to both departments, but does not want to increase the hardware footprint within the datacenter.
Which of the following should the ISO consider to provide the independent functionality required by each department's IT teams?
The corporation's Information Security Officer (ISO) is responsible for providing firewall services to both departments, but does not want to increase the hardware footprint within the datacenter.
Which of the following should the ISO consider to provide the independent functionality required by each department's IT teams?
正確答案: A
A company with 2000 workstations is considering purchasing a HIPS to minimize the impact of a system compromise from malware. Currently, the company projects a total cost of $50,000 for the next three years responding to and eradicating workstation malware. The Information Security Officer (ISO) has received three quotes from different companies that provide HIPS.
The first quote requires a $10,000 one-time fee, annual cost of $6 per workstation, and a 10% annual support fee based on the number of workstations.
The second quote requires a $15,000 one-time fee, an annual cost of $5 per workstation, and a 12% annual fee based on the number of workstations.
The third quote has no one-time fee, an annual cost of $8 per workstation, and a 15% annual fee based on the number of workstations.
Which solution should the company select if the contract is only valid for three years?
The first quote requires a $10,000 one-time fee, annual cost of $6 per workstation, and a 10% annual support fee based on the number of workstations.
The second quote requires a $15,000 one-time fee, an annual cost of $5 per workstation, and a 12% annual fee based on the number of workstations.
The third quote has no one-time fee, an annual cost of $8 per workstation, and a 15% annual fee based on the number of workstations.
Which solution should the company select if the contract is only valid for three years?
正確答案: D
說明：（僅 Fast2test 成員可見）
A security engineer on a large enterprise network needs to schedule maintenance within a fixed window of time. A total outage period of four hours is permitted for servers. Workstations can undergo maintenance from 8:00 pm to 6:00 am daily. Which of the following can specify parameters for the maintenance work? (Select TWO).
正確答案: D,E
說明：（僅 Fast2test 成員可見）
A security manager is looking into the following vendor proposal for a cloud-based SIEM solution.
The intention is that the cost of the SIEM solution will be justified by having reduced the number of incidents and therefore saving on the amount spent investigating incidents.
Proposal:
External cloud-based software as a service subscription costing $5,000 per month. Expected to reduce the number of current incidents per annum by 50%.
The company currently has ten security incidents per annum at an average cost of $10,000 per incident.
Which of the following is the ROI for this proposal after three years?
The intention is that the cost of the SIEM solution will be justified by having reduced the number of incidents and therefore saving on the amount spent investigating incidents.
Proposal:
External cloud-based software as a service subscription costing $5,000 per month. Expected to reduce the number of current incidents per annum by 50%.
The company currently has ten security incidents per annum at an average cost of $10,000 per incident.
Which of the following is the ROI for this proposal after three years?
正確答案: B
說明：（僅 Fast2test 成員可見）
A security analyst, Ann, states that she believes Internet facing file transfer servers are being attacked.
Which of the following is evidence that would aid Ann in making a case to management that action needs to be taken to safeguard these servers?
Which of the following is evidence that would aid Ann in making a case to management that action needs to be taken to safeguard these servers?
正確答案: A
說明：（僅 Fast2test 成員可見）
A penetration tester is inspecting traffic on a new mobile banking application and sends the following web request:
POST http://www.example.com/resources/NewBankAccount HTTP/1.1
Content-type: application/json
{
"account":
{ "creditAccount":"Credit Card Rewards account"}
{ "salesLeadRef":"www.example.com/badcontent/exploitme.exe"}
],
"customer":
{ "name":"Joe Citizen"}
{ "custRef":"3153151"}
Questions & Answers PDF
}
The banking website responds with:
HTIP/1.1 200 OK
{
}
"newAccountDetails":
{ "cardNumber":"1234123412341234"}
{ "cardExpiry":"2020-12-31"}
{ "cardCVV":"909"}
],
"marketingCookieTracker":"JSESSION1D=000000001"
"returnCode":"Account added successfully"
Which of the following are security weaknesses in this example? (Select TWO).
POST http://www.example.com/resources/NewBankAccount HTTP/1.1
Content-type: application/json
{
"account":
{ "creditAccount":"Credit Card Rewards account"}
{ "salesLeadRef":"www.example.com/badcontent/exploitme.exe"}
],
"customer":
{ "name":"Joe Citizen"}
{ "custRef":"3153151"}
Questions & Answers PDF
}
The banking website responds with:
HTIP/1.1 200 OK
{
}
"newAccountDetails":
{ "cardNumber":"1234123412341234"}
{ "cardExpiry":"2020-12-31"}
{ "cardCVV":"909"}
],
"marketingCookieTracker":"JSESSION1D=000000001"
"returnCode":"Account added successfully"
Which of the following are security weaknesses in this example? (Select TWO).
正確答案: A,B
說明：（僅 Fast2test 成員可見）
The following has been discovered in an internally developed application:
Error - Memory allocated but not freed:
char *myBuffer = malloc(BUFFER_SIZE); if (myBuffer != NULL) {
*myBuffer = STRING_WELCOME_MESSAGE; printf("Welcome to: %s\n", myBuffer);
} exit(0);
Which of the following security assessment methods are likely to reveal this security weakness? (Select
TWO).
Error - Memory allocated but not freed:
char *myBuffer = malloc(BUFFER_SIZE); if (myBuffer != NULL) {
*myBuffer = STRING_WELCOME_MESSAGE; printf("Welcome to: %s\n", myBuffer);
} exit(0);
Which of the following security assessment methods are likely to reveal this security weakness? (Select
TWO).
正確答案: A,C
說明：（僅 Fast2test 成員可見）