Free CompTIA Advanced Security Practitioner (CASP+) Questions and Answers

Question 1

What among the following DOES NOT constitute an open-source intelligence (OSINT) source?

Accepted Answer

Ping scan

Answer

Data used in open-source intelligence (OSINT) is obtained from open sources. Potential sources of OSINT data include social media, the deep web, WHOIS and DNS records, as well as other open data sources.
A ping scan takes place exclusively within a local area network (LAN) and is not disclosed to the general public. Consequently, a ping scan is not an OSINT source.

Question 2

A cloud storage company is Acme Cloud. A threat actor recently gained access to and successfully decrypted data from one of Acme Cloud's servers. However, the insufficient nature of the data prevented the threat actor from using it. Prior to the breach, Acme Cloud divided and re-encrypted the customer data among various servers.

What phrase best defines the method Acme Cloud uses to divide the data in order to lessen the chance of data leakage?

Accepted Answer

Bit splitting

Answer

Data is divided into smaller chunks, encrypted, and distributed across various storage locations using the bit splitting process. The data is meaningless if a threat actor compromises just one place.
Key escrow is the process of keeping an encryption key with a third party so that it can be produced when requests for decryption are made.
Data is encrypted using a stream cipher using a byte-by-byte or bit-by-bit approach.
Building a management layer to help implement control over an app without really changing it is called "application wrapping."

Question 3

As a security engineer at Acme Inc., you proactively look for and uncover security threats and process problems in your production environment by using a variety of automated tools, parsing logs, analyzing configurations, and carrying out manual testing.

Which phrase does BEST capture these activities?

Accepted Answer

Threat hunting

Answer

The process of finding dangers and problems that less proactive security tools and processes do not is known as threat hunting. Threat hunting aids in the discovery of threats that instruments such as signature-based scanners may overlook.
The technique of checking an endpoint for dangerous software is known as malware scanning. Not all of the activities listed in the question are covered by it.
Port scanning is the process of looking through an endpoint's open network ports. Not all of the activities listed in the question are covered by it.
Understanding a threat's intricate workings will help you reduce its potential impact and exposure.

Question 4

What kinds of services are utilized to supply network resources like users, servers, printers, and other organizational information?

Accepted Answer

Directory

Answer

The purpose of directory services is to give organizational data on users, servers, printers, and other network resources. An illustration of a directory service protocol is LDAP.
A federation is a collection of domains that have mutual trust.
A method of directly linking two networks is peering.
A command called STARTTLS is used to start using encrypted network communications.

Question 5

Which of the following is an improvement on Electronic Code Book (ECB) block cipher mode that connects each block together before being applied to the following block?

Accepted Answer

CBC

Answer

Blocks are chained together in cipher block chaining (CBC) because every resultant 64-bit ciphertext block is applied to the following block. CBC is thought to be an improvement to ECB, in part because it addresses the issues brought on by the ECB's requirement to individually encrypt each block of plaintext (which can leak information about the underlying data to eavesdroppers).
CBC is one of the cipher modes that can be used with the Advanced Encryption Standard (AES), a sort of block cipher, however, AES is not a cipher mode in and of itself.
Block ciphering and stream ciphering are both used in cipher feedback (CFB).
Output feedback (OFB): Employs stream ciphering and block ciphering with 8-bit or smaller blocks, and uses the key from the previous keystream to construct the next keystream.
Similar to OFB, counter mode (CTR) uses an incrementing IV counter to make sure that every block is encrypted with a different keystream.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

Free CompTIA Advanced Security Practitioner (CASP+) Questions and Answers