CASP Practice Exam 2 UPDATED ACTUAL
Exam Questions and CORRECT Answers
Your company performs a security audit. This audit uncovers that some of the encryption keys
that secure the company business-to-business (B2B) financial transactions with its partners may
be too weak. The security administrator needs to ensure that financial transactions will not be
compromised if a weak encryption key is found. What should the security administrator do?
Options:
A. Implement PFS on all VPN tunnels.
B. Implement PFS on all SSH connections.
C. Enable entropy on all SSLv2 transactions.
D. Implement AES256-CBC for all encrypted data. - CORRECT ANSWER - Answer: A
Explanation: The security administrator should implement PFS on all VPN tunnels. This will
ensure that the B2B financial transactions will not be compromised if a weak encryption key is
found. Perfect forward secrecy (PFS) ensures that a session key derived from a set of long-term
keys cannot be compromised if one of the long-term keys is compromised in the future.
Users report that they are having trouble with certificates. After researching the issue, you
discover that workstations on Network B are unable to validate certificates, while workstations
on Network A are having no issues. You need to ensure that each certificate is validated by a
single server that returns the validity of that certificate. What should you use?
Options:
A. XACML
,B. OCSP
C. DRM
D. S/MIME - CORRECT ANSWER - Answer: B
Explanation: Online Certificate Status Protocol (OCSP) allows a certificate to be validated by a
single server that returns the validity of that certificate.
After a security incident, you revoke the SSL certificate for your company's web server,
www.pearson.com. Later, you discover that a few other servers are generating certificate errors:
ftp.pearson.com, mail.pearson.com, and partners.pearson.com. Which of the following is MOST
likely the reason for this?
Options:
A. Certificates should be revoked at the domain level.
B. The CRL has not been updated yet.
C. The servers used a wildcard certificate.
D. The web server is the CA for the PKI. - CORRECT ANSWER - Answer: C
Explanation: The most likely reason for a few other servers generating certificate errors is that
the servers used a wildcard certificate.
An employee of your company files a complaint with a security administrator. While sniffing
network traffic, the employee discovers that financially confidential emails were passing
,between two warehouse users. The two users deny having sent confidential emails to each other.
You need to allow for non-repudiation and prevent network sniffers from reading the
confidential mail. What should you do?
Options:
A. Implement transport encryption and authentication hashing.
B. Implement transport encryption and legal mail hold.
C. Implement legal mail hold and authentication hashing.
D. Implement transport encryption and digital signatures. - CORRECT ANSWER -
Answer: D
Explanation: To allow for non-repudiation and prevent network sniffers from reading the
confidential mail, you should implement transport encryption and digital signatures. Transport
encryption protects all information transmitted over the network. Digital signatures ensure that
the source of the email can be verified.
You need to install a patch for a human resources application. When you access the vendor's
website, it shows that the patch is located on four different servers. A hash value is given. What
should you do to ensure that you obtain the appropriate, unchanged patch?
Options:
A. Download and install any version of the patch. The patch is valid and unchanged if it is
located on the vendor's servers.
B. Download all the versions of the patch, use MD5 to calculate the hash value of each version
you downloaded, and compare the hash value obtained to the hash value given by the vendor.
Install the patch that has a hash value that matches the hash value given by the vendor.
, C. Download the first version of the patch, use MD5 to calculate the hash value of the version
you downloaded, and compare the hash value obtained to the hash value given by the vendor. If
the hash value is the same, install that patch. If the hash val - CORRECT ANSWER -
Answer: C
Explanation: You should download the first version of the patch, use MD5 to calculate the hash
value of the version you downloaded, and compare the hash value obtained to the hash value
given by the vendor. If the hash value is the same, install that patch. If the hash value is different,
try the next version of the patch and follow the same procedure.
Your company has invested an increasing amount in security due to the changing threat
landscape. The company is trying to reduce costs, and the CFO has queried the security budget.
At the same time, you as a security practitioner are actively requesting additional funding to
support new initiatives. These initiatives will mitigate security incidents such as several that have
occurred due to ineffective controls.
You assess the current controls framework and provide recommendations on whether preventive,
detective, or corrective controls should be implemented. How should you explain which controls
to implement?
Options:
A. While corrective controls are more costly to implement, they are needed only for real attacks
on high-value assets. Put controls in place after a real attack has occurred.
B. Detective controls are less costly to implement than preventive controls and should be
encouraged wherever possible; corr - CORRECT ANSWER - Answer: D
Explanation: You should explain that the company should use preventive controls before an
event occurs, use detective controls during an event, and use corrective controls after an event
has occurred. Therefore, you should use a combination of controls.
Exam Questions and CORRECT Answers
Your company performs a security audit. This audit uncovers that some of the encryption keys
that secure the company business-to-business (B2B) financial transactions with its partners may
be too weak. The security administrator needs to ensure that financial transactions will not be
compromised if a weak encryption key is found. What should the security administrator do?
Options:
A. Implement PFS on all VPN tunnels.
B. Implement PFS on all SSH connections.
C. Enable entropy on all SSLv2 transactions.
D. Implement AES256-CBC for all encrypted data. - CORRECT ANSWER - Answer: A
Explanation: The security administrator should implement PFS on all VPN tunnels. This will
ensure that the B2B financial transactions will not be compromised if a weak encryption key is
found. Perfect forward secrecy (PFS) ensures that a session key derived from a set of long-term
keys cannot be compromised if one of the long-term keys is compromised in the future.
Users report that they are having trouble with certificates. After researching the issue, you
discover that workstations on Network B are unable to validate certificates, while workstations
on Network A are having no issues. You need to ensure that each certificate is validated by a
single server that returns the validity of that certificate. What should you use?
Options:
A. XACML
,B. OCSP
C. DRM
D. S/MIME - CORRECT ANSWER - Answer: B
Explanation: Online Certificate Status Protocol (OCSP) allows a certificate to be validated by a
single server that returns the validity of that certificate.
After a security incident, you revoke the SSL certificate for your company's web server,
www.pearson.com. Later, you discover that a few other servers are generating certificate errors:
ftp.pearson.com, mail.pearson.com, and partners.pearson.com. Which of the following is MOST
likely the reason for this?
Options:
A. Certificates should be revoked at the domain level.
B. The CRL has not been updated yet.
C. The servers used a wildcard certificate.
D. The web server is the CA for the PKI. - CORRECT ANSWER - Answer: C
Explanation: The most likely reason for a few other servers generating certificate errors is that
the servers used a wildcard certificate.
An employee of your company files a complaint with a security administrator. While sniffing
network traffic, the employee discovers that financially confidential emails were passing
,between two warehouse users. The two users deny having sent confidential emails to each other.
You need to allow for non-repudiation and prevent network sniffers from reading the
confidential mail. What should you do?
Options:
A. Implement transport encryption and authentication hashing.
B. Implement transport encryption and legal mail hold.
C. Implement legal mail hold and authentication hashing.
D. Implement transport encryption and digital signatures. - CORRECT ANSWER -
Answer: D
Explanation: To allow for non-repudiation and prevent network sniffers from reading the
confidential mail, you should implement transport encryption and digital signatures. Transport
encryption protects all information transmitted over the network. Digital signatures ensure that
the source of the email can be verified.
You need to install a patch for a human resources application. When you access the vendor's
website, it shows that the patch is located on four different servers. A hash value is given. What
should you do to ensure that you obtain the appropriate, unchanged patch?
Options:
A. Download and install any version of the patch. The patch is valid and unchanged if it is
located on the vendor's servers.
B. Download all the versions of the patch, use MD5 to calculate the hash value of each version
you downloaded, and compare the hash value obtained to the hash value given by the vendor.
Install the patch that has a hash value that matches the hash value given by the vendor.
, C. Download the first version of the patch, use MD5 to calculate the hash value of the version
you downloaded, and compare the hash value obtained to the hash value given by the vendor. If
the hash value is the same, install that patch. If the hash val - CORRECT ANSWER -
Answer: C
Explanation: You should download the first version of the patch, use MD5 to calculate the hash
value of the version you downloaded, and compare the hash value obtained to the hash value
given by the vendor. If the hash value is the same, install that patch. If the hash value is different,
try the next version of the patch and follow the same procedure.
Your company has invested an increasing amount in security due to the changing threat
landscape. The company is trying to reduce costs, and the CFO has queried the security budget.
At the same time, you as a security practitioner are actively requesting additional funding to
support new initiatives. These initiatives will mitigate security incidents such as several that have
occurred due to ineffective controls.
You assess the current controls framework and provide recommendations on whether preventive,
detective, or corrective controls should be implemented. How should you explain which controls
to implement?
Options:
A. While corrective controls are more costly to implement, they are needed only for real attacks
on high-value assets. Put controls in place after a real attack has occurred.
B. Detective controls are less costly to implement than preventive controls and should be
encouraged wherever possible; corr - CORRECT ANSWER - Answer: D
Explanation: You should explain that the company should use preventive controls before an
event occurs, use detective controls during an event, and use corrective controls after an event
has occurred. Therefore, you should use a combination of controls.
