Free CompTIA Advanced Security Practitioner (CASP+) CAS-004 Questions and Answers

Question 1

To ensure that users can only access the resources they need to complete specific tasks, permissions must be provided. Which security principle ought to be used to fulfill the requirement?

Accepted Answer

Least privilege

Answer

To ensure that users can only access the resources they need to carry out certain tasks, the least privilege security concept should be used when granting permissions.
According to the least privilege concept, users should only be given the minimal level of access required to carry out their planned tasks or fulfill their job-related duties. Users should only have access to the resources and rights necessary for them to complete their tasks successfully, and nothing more.

Question 2

Security testing must have a low risk of influencing system stability because the company is in production. According to the board of directors, a third party won't have the development team's knowledge. Which of the subsequent tests is the ideal choice?

Accepted Answer

Development and security assurance teams do white-box testing.

Answer

The best course of action would be to combine white-box testing with involving the development and security assurance teams, given the need to conduct security testing with little risk of affecting system stability and the board of directors' concern about a third party lacking the development team's expertise.
Potential security flaws can be found through white-box testing, which necessitates understanding the system's underlying workings and source code. The risk of stability problems can be reduced by utilizing the development and security assurance teams' knowledge of the system and experience in the testing process to conduct extensive assessments.

Question 3

A keylogger is being operated by a Meterpreter shell on the CFO's laptop. What security principle is the keylogger most likely to violate?

Accepted Answer

Confidentiality

Answer

Most likely, the CFO's laptop's keylogger violates the security principle of secrecy.
The confidentiality of sensitive information relates to its defense against unauthorized access or disclosure. The keylogger on the CFO's laptop in this instance logs keystrokes, possibly sensitive data like passwords, login credentials, or private information entered by the CFO included. Keyloggers are designed to record information without the user's awareness or consent.

Question 4

You'll require a contract that enables your business to create a comprehensive risk allocation strategy and offers indemnity, a tactic for shielding one party from present or future losses. On which contract should you attempt to come to an understanding?

Accepted Answer

Service Master Agreement

Answer

You should strive to come to an agreement on a Service Master Agreement (SMA) contract in order to build a comprehensive risk allocation strategy and offer indemnity.
The rules and conditions governing the supply of services between two parties are spelled out in detail in a Service Master Agreement. It acts as a general contract that covers numerous services, undertakings, or engagements for a predetermined time. In order to streamline the contracting process for upcoming services or projects, a SMA offers flexibility and efficiency.

Question 5

Your business began examining various systems for a project that was technical in nature and security-related. You narrowed down your options to three companies, and each of them submitted you an RFI. What is the following request you are going to make to those three vendors?

Accepted Answer

RFQ

Answer

The next stage would normally be to ask those suppliers for RFQs after obtaining the RFIs (Request for Information) from the three companies for your technical security-focused project (Request for Quotation).
Request for Quotation, or RFQ, is a formal document used to request formal offers and comprehensive pricing information from prospective vendors. It usually comes after the preliminary round of information gathering via RFIs, during which suppliers gave broad descriptions of their solutions, capabilities, and services.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

Free CompTIA Advanced Security Practitioner (CASP+) CAS-004 Questions and Answers